Can't create EKS cluster - InvalidParameterException

[c13]

I'm trying to create a cluster in cluster/terraform folder, but the command "terraform apply" gives me the error

module.eks.aws_eks_cluster.this[0]: Still creating... [1m40s elapsed] module.eks.aws_eks_cluster.this[0]: Still creating... [1m50s elapsed] Error: creating EKS Cluster (karpenter-blueprints): operation error EKS: CreateCluster, https response error StatusCode: 400, RequestID: xxx, InvalidParameterException: Role with arn: arn:aws:iam::xxx:role/karpenter-blueprints-cluster-20241020164557819100000001, could not be assumed because it does not exist or the trusted entity is not correct

Terraform v1.9.3 on darwin_arm64

• provider registry.terraform.io/alekc/kubectl v2.1.2
• provider registry.terraform.io/hashicorp/aws v5.72.1
• provider registry.terraform.io/hashicorp/cloudinit v2.3.5
• provider registry.terraform.io/hashicorp/helm v2.16.1
• provider registry.terraform.io/hashicorp/kubernetes v2.33.0
• provider registry.terraform.io/hashicorp/null v3.2.3
• provider registry.terraform.io/hashicorp/time v0.12.1
• provider registry.terraform.io/hashicorp/tls v4.0.6
• provider registry.terraform.io/kreuzwerker/docker v3.0.2

aws-cli/2.18.10 Python/3.12.7 Darwin/23.6.0 source/arm64

I haven't changed any module version Kubernetes | 1.30 Karpenter | v1.0.1 Terraform | 1.9.3 AWS EKS | v20.23.0 EKS Blueprints Addons | v1.16.3

[jakeskyaws]

Hi @c13. I pulled the latest main branch and wasn’t able to replicate the issue you're facing.

It looks like an issue related to the IAM role that the EKS cluster is trying to assume.

We are using the eks module to build the cluster. Is there a possibility that there was a terraform apply error prior to running the terraform apply for the blueprint itself ?

Could we check the following:

IAM Role Exists:

aws iam get-role --role-name karpenter-blueprints-cluster-20241020164557819100000001

Verify the Trust Relationship: The EKS service must be trusted by this IAM role. You can check the trust relationship in the IAM role's configuration. It should look something like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

[c13]

Hello Jake,

Thank you for your answer!

I have destroyed and recreated the cluster. Error says "Error: creating EKS Cluster (karpenter-blueprints): operation error EKS: CreateCluster, https response error StatusCode: 400, RequestID: xxx, InvalidParameterException: Role with arn: arn:aws:iam::xxx:role/karpenter-blueprints-cluster-20241022103201571200000002, could not be assumed because it does not exist or the trusted entity is not correct"

Role karpenter-blueprints-cluster-20241022103201571200000002 exists

There are two policies attached and a customer managed policy

• AmazonEKSClusterPolicy
• AmazonEKSVPCResourceController
• karpenter-blueprints-cluster-ClusterEncryption2024102210322607380000000e

  {
  "Statement": [
      {
          "Action": [
              "kms:Encrypt",
              "kms:Decrypt",
              "kms:ListGrants",
              "kms:DescribeKey"
          ],
          "Effect": "Allow",
          "Resource": "arn:aws:kms:us-east-1:004613421440:key/df2c3d84-1b2b-4ba7-97af-5c3eb6e51b76"
      }
  ],
  "Version": "2012-10-17"
  }

Trust relation exists

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EKSClusterAssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": "eks.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

[jakeskyaws]

This all seems correct. Are there any valuable insights in Cloudtrail to help us identify the issues with assuming the role ?