aws-eks: KubectlProvider fails to create/update in govcloud

[wongma7]

Describe the bug

In govcloud (aws-us-gov partition), "Amazon ECR public registries aren't supported." https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-ecr.html

The managed policy "AmazonElasticContainerRegistryPublicReadOnly" does not exist there.

#24104 added this managed policy "AmazonElasticContainerRegistryPublicReadOnly" and now KubectlProvider HandlerServiceRole fails to create/update.

Expected Behavior

KubectlProvider HandlerServiceRole successfully creates/updates in govcloud same as in other AWS partitions

Current Behavior

KubectlProvider HandlerServiceRole fails to create/update in govcloud

Reproduction Steps

Create a 1.25 EKS cluster in govcloud*

const cluster = new eks.Cluster(this, 'hello-eks', {
  version: eks.KubernetesVersion.V1_25,
});

Possible Solution

Wrap this:

    // For OCI helm chart public ECR authorization.
    this.handlerRole.addManagedPolicy(
      iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonElasticContainerRegistryPublicReadOnly'),
    );

in a partition check

Additional Information/Context

No response

CDK CLI Version

2.27.0 (build 8e89048)

"aws-cdk": "^2.69.0",

Framework Version

"aws-cdk": "^2.69.0",

Node.js Version

v18.14.0

OS

linux

Language

Typescript

Language Version

No response

Other information

No response

[pahud]

Thank you. I am working on this issue at #25215. Will add gov cloud in the exclusion list.

[pahud]

closed by #25215

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.