From 4e68cf1ccf31dbd5bd5ac90f0dbd28ae010675eb Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Mon, 5 Oct 2026 20:09:46 -0400
Subject: [PATCH] fix(ci): allow CreateServiceLinkedRole on EKS role names
 (#184)

CreateFargateProfile authorizes the service-linked role by its pathless name before the role exists.
---
 lib/actions-runner-hcptf-stack.ts | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/lib/actions-runner-hcptf-stack.ts b/lib/actions-runner-hcptf-stack.ts
index 6449acb..8df9f48 100644
--- a/lib/actions-runner-hcptf-stack.ts
+++ b/lib/actions-runner-hcptf-stack.ts
@@ -421,6 +421,19 @@ function iamPolicyDocument(): object {
           },
         },
       },
+      {
+        Sid: "ServiceLinkedRoleNames",
+        Effect: "Allow",
+        Action: ["iam:CreateServiceLinkedRole", "iam:TagRole"],
+        Resource: [
+          `arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKS`,
+          `arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKSForFargate`,
+          `arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKSNodegroup`,
+          `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks.amazonaws.com/*`,
+          `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-fargate-pods.amazonaws.com/*`,
+          `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-nodegroup.amazonaws.com/*`,
+        ],
+      },
       {
         Sid: "PassAwsServiceRoles",
         Effect: "Allow",