[Bug]: CodePipeline lab IAM issues

[niallthomson]

Installation method

Own AWS account

What happened?

The CodePipeline lab is currently failing due to IAM issues. The lab content has not changed so this seems to be related to service changes on the CodePipeline side.

What did you expect to happen?

Should work

How can we reproduce it?

Run the lab

Anything else we need to know?

No response

EKS version

1.33

[niallthomson]

Started investigating this and had to add the following to the CodePipeline IAM role:

+  statement {
+    effect = "Allow"
+    actions = [
+      "ec2:DescribeDhcpOptions",
+      "ec2:DescribeNetworkInterfaces",
+      "ec2:DescribeRouteTables",
+      "ec2:DescribeSubnets",
+      "ec2:DescribeSecurityGroups",
+      "ec2:DescribeVpcs"
+    ]
+    resources = ["*"]
+  }
+
+  statement {
+    effect = "Allow"
+    actions = [
+      "ec2:CreateNetworkInterface",
+    ]
+    resources = ["*"]
+    condition {
+      test = "StringEqualsIfExists"
+      variable = "ec2:Subnet"
+      values = local.subnet_arns
+    }
+  }
+
+  statement {
+    effect = "Allow"
+    actions = [
+      "ec2:DeleteNetworkInterface"
+    ]
+    resources = ["*"]
+    condition {
+      test = "StringEqualsIfExists"
+      variable = "ec2:Subnet"
+      values = local.subnet_arns
+    }
+  }
+
+  statement {
+    effect = "Allow"
+    actions = [
+      "ec2:CreateNetworkInterfacePermission"
+    ]
+    resources = ["*"]
+    condition {
+      test = "ArnEquals"
+      variable = "ec2:Subnet"
+      values = local.subnet_arns
+    }
+  }
+

Then the CodePipeline deploy stage just reported an error with no logs.