From ca174d232286d5bdaaf74cfa56056ae43b678c94 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Mon, 5 Oct 2026 20:00:07 -0400
Subject: [PATCH] fix(ci): allow GetRole on EKS service role names (#183)

---
 lib/actions-runner-hcptf-stack.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/actions-runner-hcptf-stack.ts b/lib/actions-runner-hcptf-stack.ts
index 1b60d8f..6449acb 100644
--- a/lib/actions-runner-hcptf-stack.ts
+++ b/lib/actions-runner-hcptf-stack.ts
@@ -401,6 +401,9 @@ function iamPolicyDocument(): object {
           `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks.amazonaws.com/*`,
           `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-fargate-pods.amazonaws.com/*`,
           `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-nodegroup.amazonaws.com/*`,
+          `arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKS`,
+          `arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKSForFargate`,
+          `arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKSNodegroup`,
         ],
       },
       {
@@ -452,6 +455,9 @@ function planPolicy(hcpArn: string, githubArn: string): object {
           `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks.amazonaws.com/*`,
           `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-fargate-pods.amazonaws.com/*`,
           `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-nodegroup.amazonaws.com/*`,
+          `arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKS`,
+          `arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKSForFargate`,
+          `arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKSNodegroup`,
           `arn:aws:iam::${ACCOUNT}:role/hcptf-actions-runner`,
           `arn:aws:iam::${ACCOUNT}:role/hcptf-actions-runner-plan`,
           `arn:aws:iam::${ACCOUNT}:role/githubdeploy-seahaven-org-baseline`,