fix #5

eks-demo/iam.tf

@@ -26,3 +26,29 @@ resource "aws_iam_role_policy_attachment" "demo-cluster-AmazonEKSServicePolicy"
   policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
   role       = "${aws_iam_role.demo-cluster.name}"
 }
+
+# If no loadbalancer was ever created in this region, then this following role is necessary
+resource "aws_iam_role_policy" "demo-cluster-service-linked-role" {
+  name = "service-linked-role"
+  role = "${aws_iam_role.demo-cluster.name}"
+
+  policy = <<EOF
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": "iam:CreateServiceLinkedRole",
+                "Resource": "arn:aws:iam::*:role/aws-service-role/*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "ec2:DescribeAccountAttributes"
+                ],
+                "Resource": "*"
+            }
+        ]
+    }
+EOF
+}