feat: Update AWS Load Balancer controller policy to match v2.13 of the upstream project

[RafiGreenberg]

Description

Latest release of AWS LBC (v2.13.x) adds this permission ec2:DescribeRouteTables

Motivation and Context

latest IAM Policy for AWS LBC: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/install/iam_policy.json

Breaking Changes

No.

Testing

• Tested using my fork:

module "aws_load_balancer_controller_irsa" {
  source = "git::https://github.com/RafiGreenberg/terraform-aws-iam//modules/iam-role-for-service-accounts-eks"

  role_name = "aws-load-balancer-controller"

  attach_load_balancer_controller_policy = true
  oidc_providers = {
    main = {
      provider_arn               = module.eks.oidc_provider_arn
      namespace_service_accounts = ["kube-system:aws-load-balancer-controller"]
    }
  }
}

• Plan:

$ tf plan
~ resource "aws_iam_policy" "load_balancer_controller" {
        id               = "arn:aws:iam::xxxxx:policy/AmazonEKS_AWS_Load_Balancer_Controller-20250603185119521400000001"
        name             = "AmazonEKS_AWS_Load_Balancer_Controller-20250603185119521400000001"
      ~ policy           = jsonencode(
          ~ {
              ~ Statement = [
                    {
                        Action    = "iam:CreateServiceLinkedRole"
                        Condition = {
                            StringEquals = {
                                "iam:AWSServiceName" = "elasticloadbalancing.amazonaws.com"
                            }
                        }
                        Effect    = "Allow"
                        Resource  = "*"
                    },
                  ~ {
                      ~ Action   = [
                            # (19 unchanged elements hidden)
                            "ec2:DescribeSecurityGroups",
                          + "ec2:DescribeRouteTables",
                            "ec2:DescribeNetworkInterfaces",
                            # (7 unchanged elements hidden)
                        ]
                        # (2 unchanged attributes hidden)
                    },
                    {
                        Action   = [
                            "wafv2:GetWebACLForResource",
                            "wafv2:GetWebACL",
                            "wafv2:DisassociateWebACL",
                            "wafv2:AssociateWebACL",
                            "waf-regional:GetWebACLForResource",
                            "waf-regional:GetWebACL",
                            "waf-regional:DisassociateWebACL",
                            "waf-regional:AssociateWebACL",
                            "shield:GetSubscriptionState",
                            "shield:DescribeProtection",
                            "shield:DeleteProtection",
                            "shield:CreateProtection",
                            "iam:ListServerCertificates",
                            "iam:GetServerCertificate",
                            "cognito-idp:DescribeUserPoolClient",
                            "acm:ListCertificates",
                            "acm:DescribeCertificate",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                    },
                    # (12 unchanged elements hidden)
                ]
                # (1 unchanged attribute hidden)
            }
        )
        tags             = {}
        # (7 unchanged attributes hidden)
    }
Plan: 0 to add, 1 to change, 0 to destroy.

Tested successfully - ingress using ALB works now

Events:
  Type    Reason                  Age    From     Message
  ----    ------                  ----   ----     -------
  Normal  SuccessfullyReconciled  4m45s  ingress  Successfully reconciled

Closes: #568

[RafiGreenberg]

Breaking PR was: kubernetes-sigs/aws-load-balancer-controller#4109

[antonbabenko]

This PR is included in version 5.56.0 🎉

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.