fix(eks): partition is hardcoded in ALB controller IAM policies

packages/aws-cdk-lib/aws-eks/lib/alb-controller.ts

@@ -1,14 +1,14 @@
 import * as fs from 'fs';
 import * as path from 'path';
-import { Construct, Node } from 'constructs';
+import { Construct } from 'constructs';
 import { Cluster } from './cluster';
 import { HelmChart } from './helm-chart';
 import { ServiceAccount } from './service-account';
 import * as iam from '../../aws-iam';
 
 // v2 - keep this import as a separate section to reduce merge conflict when forward merging with the v2 branch.
 // eslint-disable-next-line
-import { Duration, Names, Stack } from '../../core';
+import { Aws, Duration, Names, Stack } from '../../core';
 
 /**
  * Controller version.
@@ -263,7 +263,11 @@ export class AlbController extends Construct {
     const policy: any = props.policy ?? JSON.parse(fs.readFileSync(path.join(__dirname, 'addons', `alb-iam_policy-${props.version.version}.json`), 'utf8'));
 
     for (const statement of policy.Statement) {
-      serviceAccount.addToPrincipalPolicy(iam.PolicyStatement.fromJson(statement));
+      const rewrittenStatement = {
+        ...statement,
+        Resource: this.rewritePolicyResources(statement.Resource),
+      };
+      serviceAccount.addToPrincipalPolicy(iam.PolicyStatement.fromJson(rewrittenStatement));
     }
 
     // https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/deploy/installation/#add-controller-to-cluster
@@ -293,8 +297,24 @@ export class AlbController extends Construct {
     });
 
     // the controller relies on permissions deployed using these resources.
-    Node.of(chart).addDependency(serviceAccount);
-    Node.of(chart).addDependency(props.cluster.openIdConnectProvider);
-    Node.of(chart).addDependency(props.cluster.awsAuth);
+    chart.node.addDependency(serviceAccount);
+    chart.node.addDependency(props.cluster.openIdConnectProvider);
+    chart.node.addDependency(props.cluster.awsAuth);
+  }
+
+  private rewritePolicyResources(resources: string | string[] | undefined): string | string[] | undefined {
+    // This is safe to disable because we're actually replacing the literal partition with a reference to
+    // the stack partition (which is hardcoded into the JSON files) to prevent issues such as
+    // aws/aws-cdk#22520.
+    // eslint-disable-next-line @aws-cdk/no-literal-partition
+    const rewriteResource = (s: string) => s.replace('arn:aws:', `arn:${Aws.PARTITION}:`);
+
+    if (!resources) {
+      return resources;
+    }
+    if (!Array.isArray(resources)) {
+      return rewriteResource(resources);
+    }
+    return resources.map(rewriteResource);
   }
 }

packages/aws-cdk-lib/aws-eks/test/alb-controller.test.ts

@@ -70,6 +70,21 @@ test('throws when a policy is not defined for a custom version', () => {
   })).toThrowError("'albControllerOptions.policy' is required when using a custom controller version");
 });
 
+test.each(['us-gov-west-1', 'cn-north-1'])('stack does not include hard-coded partition', (region) => {
+  const { stack } = testFixture(region);
+  const cluster = new Cluster(stack, 'Cluster', {
+    version: KubernetesVersion.V1_25,
+  });
+
+  AlbController.create(stack, {
+    cluster,
+    version: AlbControllerVersion.V2_5_1,
+  });
+
+  const template = Template.fromStack(stack);
+  expect(JSON.stringify(template)).not.toContain('arn:aws');
+});
+
 test('correct helm chart version is set for selected alb controller version', () => {
   const { stack } = testFixture();
 

packages/aws-cdk-lib/aws-eks/test/util.ts

@@ -3,22 +3,23 @@ import { App, Stack } from '../../core';
 import { Cluster, ClusterProps, KubernetesVersion } from '../lib';
 
 const CLUSTER_VERSION = KubernetesVersion.V1_25;
+const DEFAULT_REGION = 'us-east-1';
 
-export function testFixture() {
-  const { stack, app } = testFixtureNoVpc();
+export function testFixture(region: string = DEFAULT_REGION) {
+  const { stack, app } = testFixtureNoVpc(region);
   const vpc = new ec2.Vpc(stack, 'VPC');
 
   return { stack, vpc, app };
 }
 
-export function testFixtureNoVpc() {
+export function testFixtureNoVpc(region: string = DEFAULT_REGION) {
   const app = new App();
-  const stack = new Stack(app, 'Stack', { env: { region: 'us-east-1' } });
+  const stack = new Stack(app, 'Stack', { env: { region } });
   return { stack, app };
 }
 
-export function testFixtureCluster(props: Omit<ClusterProps, 'version'> = {}) {
-  const { stack, app } = testFixtureNoVpc();
+export function testFixtureCluster(props: Omit<ClusterProps, 'version'> = {}, region: string = DEFAULT_REGION) {
+  const { stack, app } = testFixtureNoVpc(region);
   const cluster = new Cluster(stack, 'Cluster', {
     version: CLUSTER_VERSION,
     prune: false, // mainly because this feature was added later and we wanted to avoid having to update all test expectations....