[aws-eks] Fail to create FargateProfile - Missing permissions for `ec2:DescribeSubnets`

We just annouced the Fargate support for Amazon EKS in 4 additional regions and I was trying to deploy a simple EKS+Fargate cluster to them ended up missiong permissions failure in eu-central-1, ap-southeast-1 and ap-southeast-2.

Reproduction Steps

import * as cdk from '@aws-cdk/core';
import * as eks from '@aws-cdk/aws-eks';
import * as ec2 from '@aws-cdk/aws-ec2';
import * as iam from '@aws-cdk/aws-iam';

export class EksfgStack extends cdk.Stack {
  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'Vpc', {
        maxAzs: 3,
        natGateways: 1
      });

    const mastersRole = new iam.Role(this, 'AdminRole', {
      assumedBy: new iam.AccountRootPrincipal()
    });

    const cluster = new eks.Cluster(this, 'Cluster', {
      vpc,
      mastersRole
    });

    cluster.addFargateProfile('FargateProfile', {
      selectors: [
        { namespace: 'default' },
        { namespace: 'kube-system' },
      ]
    })

    new cdk.CfnOutput(this, 'Region', { value: this.region })

  }
}

Error Log

Cluster/fargate-profile-FargateProfile/Resource/Default (ClusterfargateprofileFargateProfileA6BADBA5) Failed to create resource. Error: Missing permissions for `ec2:DescribeSubnets` action

Environment

• CLI Version : 1.35.0
• Framework Version: 1.35.0
• OS : Mac OS X
• Language : Typescript

Other

---

This is 🐛 Bug Report

[pahud]

Can we just add those permissions always?

Yes, looks like adding the additional ec2:DescribeRouteTables will fix this issue. I am testing manually in different regions. Will create a PR for it today.

[eladb]

Can we just add those permissions always?