fix(eks): policy does not exist or is not attachable in China and GovCloud regions

[pahud]

Reopening this PR because #25170 was closed by accident.

As ECR Public is not available in China regions and GovCloud, AmazonElasticContainerRegistryPublicReadOnly IAM managed policy would not be available in those affected regions and should not be attached to the role. This PR implements a CfnCondition to determine if ECR public is available based on Aws.Partition of the deploying region and conditionally attach AmazonElasticContainerRegistryPublicReadOnly to the kubectl-provider handler role.

This PR has been tested in the following regions:

• *cn-north-1
• *cn-northwest-1
• us-east-1

• I can confirm the role is created correctly in cn regions but due to
  • (custom-resources): StateNotFoundError: State functionActiveV2 not found #24358
  • eks: fail to create eks nodegroup in cn-north-1 #24696
    The cluster and nodegroup are still failing to create in CN.

Closes #24743 #24808 #25178

[gitpod-io]

[corymhall]

@pahud are you sure that it is not possible to pull images from ECR public in china regions? From what I understand of ECR public it only exists in us-east-1 (which is why you have to run get-login-password from us-east-1). Could it be that the issue is just that the IAM managed policy doesn't exist in China? What if we just added a custom policy with the necessary permissions?

[corymhall]

🚀

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: c2d6e63
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[justin007755]

Hello @pahud ,

We are still encountering below when using latest cdk version to create eks and corresponding resources like helm chart etc, and I tested cdk-2.65.0 which looks good, however, it's hard for us to use this cdk version considering other facts, so do we have a ETA or workaround for this issue?

---

2023-05-19 14:12:02 UTC+0800 HandlerServiceRoleFCDC14AE
CREATE_FAILED Policy arn:aws-cn:iam::aws:policy/AmazonElasticContainerRegistryPublicReadOnly does not exist or is not attachable. (Service: AmazonIdentityManagement; Status Code: 404; Error Code: NoSuchEntity; Request ID: 8a2723e1-3330-40e4-af9c-d45b6e6aa3b3; Proxy: null)

---