eks: renaming the cluster would trigger rollback due to not authorized to delete the cluster

[pahud]

Describe the bug

Given the code:

 const cluster = new eks.Cluster(this, 'demo-eks-cluster', {
      vpc,
      clusterName: 'foo',
      defaultCapacity: 0,
      version: eks.KubernetesVersion.V1_29,
      kubectlLayer: new KubectlLayer(this, 'kubectlLayer'),
    });

If we rename the clusterName, it would trigger the replacement due to this, which creates a new one and delete the existing one. But we are seeing not authorized error hence rollback.

11:12:03 AM | DELETE_FAILED        | AWS::CloudFormation::CustomResource | demo-eks-cluster/R...e/Resource/De
fault
Received response status [FAILED] from custom resource. Message returned: User:
arn:aws:sts::<deducted>:assumed-role/dummy-stack1-demoeksclusterCreationRoleD556FC0C-eSVJAmlypMdd/AWSCDK.EK
SCluster.Delete.ec88927b-3c8e-4b8f-bd7b-94445b11de48 is not authorized to perform: eks:DeleteCluster on resou
rce: arn:aws:eks:us-east-1:<deducted>:cluster/foo

Logs: /aws/lambda/dummy-stack1-awscdkawseksCl-OnEventHandler42BEBAE0-F7RpMPmuSPA5

at throwDefaultError (/var/runtime/node_modules/@aws-sdk/node_modules/@smithy/smithy-client/dist-cjs/default-
error-handler.js:8:22)
at /var/runtime/node_modules/@aws-sdk/node_modules/@smithy/smithy-client/dist-cjs/default-error-handler.js:18
:39
at de_DeleteClusterCommandError (/var/runtime/node_modules/@aws-sdk/client-eks/dist-cjs/protocols/Aws_restJso
n1.js:1526:20)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async /var/runtime/node_modules/@aws-sdk/node_modules/@smithy/middleware-serde/dist-cjs/deserializerMiddle
ware.js:7:24

I am not sure if update clusterName should trigger replacement but obviously we probably need to add the relevant permissions to the cluster resource handler.

Expected Behavior

update the clusterName should not fail. Preferably in-place update but if replacement is necessary, it should not fail and roll back.

Current Behavior

fail and roll back

Reproduction Steps

as described above

Possible Solution

1. Let's test if we can simply trigger the in-palace update rather than replacement.
2. If replacement is necessary, add eks:DeleteCluster on the cluster resource to the custom resource handler role.

Additional Information/Context

No response

CDK CLI Version

v2.130.0

Framework Version

No response

Node.js Version

v18.16.0

OS

mac os x

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

internal tracking: D120674266

[pahud]

From CFN's perspective, updating the cluster Name does trigger replacement:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-eks-cluster.html#cfn-eks-cluster-name

So I think it makes sense here.

If fact the cluster resource handler role does have eks:DeleteCluster

aws-cdk/packages/aws-cdk-lib/aws-eks/lib/cluster-resource.ts

Lines 153 to 166 in cfd93b9

	creationRole.addToPolicy(new iam.PolicyStatement({
	actions: [
	'eks:CreateCluster',
	'eks:DescribeCluster',
	'eks:DescribeUpdate',
	'eks:DeleteCluster',
	'eks:UpdateClusterVersion',
	'eks:UpdateClusterConfig',
	'eks:CreateFargateProfile',
	'eks:TagResource',
	'eks:UntagResource',
	],
	resources: resourceArns,
	}));

but the resource ARN actually has changed to the new one hence not authorized.

[pahud]

OK I guess the best solution is to add a note in the doc to work around like this as it doesn't make sense to allow the cluster admin role to eks:DeleteCluster on *.

    const cluster = new eks.Cluster(this, 'demo-eks-cluster', {
      vpc,
      clusterName: 'foo', // will rename to 'bar'
      defaultCapacity: 0,
      version: eks.KubernetesVersion.V1_29,
      kubectlLayer: new KubectlLayer(this, 'kubectlLayer'),
    });

    // allow the cluster admin role to delete the 'foo' cluster
    cluster.adminRole.addToPolicy(new iam.PolicyStatement({
      actions: ['eks:DeleteCluster'],
      resources: [ 
        Stack.of(this).formatArn({ service: 'eks', resource: 'cluster', resourceName: 'foo' }),
    ]
    }))

[pahud]

related to #24174

[pahud]

closing with #29283

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.