From b80ec258ad1811d1ed1ab2790e4737033d4b6746 Mon Sep 17 00:00:00 2001
From: Edward Viaene <ward.viaene@gmail.com>
Date: Tue, 31 Jul 2018 18:14:57 +0000
Subject: [PATCH] fix #5

---
 eks-demo/iam.tf | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/eks-demo/iam.tf b/eks-demo/iam.tf
index 7f97b80..b3375c3 100644
--- a/eks-demo/iam.tf
+++ b/eks-demo/iam.tf
@@ -26,3 +26,29 @@ resource "aws_iam_role_policy_attachment" "demo-cluster-AmazonEKSServicePolicy"
   policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
   role       = "${aws_iam_role.demo-cluster.name}"
 }
+
+# If no loadbalancer was ever created in this region, then this following role is necessary
+resource "aws_iam_role_policy" "demo-cluster-service-linked-role" {
+  name = "service-linked-role"
+  role = "${aws_iam_role.demo-cluster.name}"
+
+  policy = <<EOF
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": "iam:CreateServiceLinkedRole",
+                "Resource": "arn:aws:iam::*:role/aws-service-role/*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "ec2:DescribeAccountAttributes"
+                ],
+                "Resource": "*"
+            }
+        ]
+    }
+EOF
+}