From 45ff3a906a9fe585925483ed08ddccf27899087d Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Mon, 5 Oct 2026 20:19:13 -0400
Subject: [PATCH] fix(ci): grant the Fargate service-linked role path (#185)

CreateFargateProfile authorizes iam:CreateServiceLinkedRole on eks-fargate.amazonaws.com, not eks-fargate-pods.amazonaws.com.
---
 lib/actions-runner-hcptf-stack.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/actions-runner-hcptf-stack.ts b/lib/actions-runner-hcptf-stack.ts
index 8df9f48..4c3a6f5 100644
--- a/lib/actions-runner-hcptf-stack.ts
+++ b/lib/actions-runner-hcptf-stack.ts
@@ -400,6 +400,7 @@ function iamPolicyDocument(): object {
         Resource: [
           `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks.amazonaws.com/*`,
           `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-fargate-pods.amazonaws.com/*`,
+          `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-fargate.amazonaws.com/*`,
           `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-nodegroup.amazonaws.com/*`,
           `arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKS`,
           `arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKSForFargate`,
@@ -417,6 +418,7 @@ function iamPolicyDocument(): object {
               "eks.amazonaws.com",
               "eks-nodegroup.amazonaws.com",
               "eks-fargate-pods.amazonaws.com",
+              "eks-fargate.amazonaws.com",
             ],
           },
         },
@@ -431,6 +433,7 @@ function iamPolicyDocument(): object {
           `arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKSNodegroup`,
           `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks.amazonaws.com/*`,
           `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-fargate-pods.amazonaws.com/*`,
+          `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-fargate.amazonaws.com/*`,
           `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-nodegroup.amazonaws.com/*`,
         ],
       },
@@ -467,6 +470,7 @@ function planPolicy(hcpArn: string, githubArn: string): object {
           `arn:aws:iam::${ACCOUNT}:role/tf-managed/*`,
           `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks.amazonaws.com/*`,
           `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-fargate-pods.amazonaws.com/*`,
+          `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-fargate.amazonaws.com/*`,
           `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-nodegroup.amazonaws.com/*`,
           `arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKS`,
           `arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKSForFargate`,