fix(eks): policy does not exist or is not attachable in China regions

[pahud]

As ECR Public is not available in China regions and govcloud, AmazonElasticContainerRegistryPublicReadOnly is not available and should not be attached to the role. This PR implements a RegionInfo method to determine if ECR public is available in current region and conditionally attach AmazonElasticContainerRegistryPublicReadOnly policy to the role.

Closes #24743 #24808

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: c675f43
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[pahud]

Exemption Request

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

PRs must pass status checks before we can provide a meaningful review.

If you would like to request an exemption from the status checks or clarification on feedback, please leave a comment on this PR containing Exemption Request and/or Clarification Request.

[TheRealAmazonKendra]

Is there any handling we can do for when a token is being used? It seems like it's a fairly common use case and this fix would still result in an error for those users.

[pahud]

Yes thank you for the heads up. I will fix this soon.

[pahud]

@TheRealAmazonKendra Correct me if I am wrong. We probably can't conditionally attach the managed policy if we can't tell the region in the synth stage(region agnostic). In this case, we probably should always assume EcrPublicAvailable to be false and not attach the AmazonElasticContainerRegistryPublicReadOnly policy:

export function EcrPublicAvailable(region: any): boolean {
  if (region && !Token.isUnresolved(region)) {
    return RegionInfo.get(region).ecrPublicAvailable;
  } else {
    // we can't determine region in the synth time, assuming false.
    return false;
  }
}

And we should not run this as well:

aws-cdk/packages/@aws-cdk/aws-eks/lib/kubectl-handler/helm/__init__.py

Line 115 in 0f56583

f"aws ecr-public get-login-password --region us-east-1 | " \

Another option is to throw an error if stack.region is not specified just like below. But this will make stack.region always required when we create the eks.Cluster(breaking changes?).

aws-cdk/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.ts

Lines 335 to 337 in 0f56583

	if (Token.isUnresolved(stack.region)) {
	throw new Error(`region (${stack.region}) cannot be a token and must be configured to one of: ${supportedRegions}`);
	}

What do you think?

[pahud]

close in favor of #25170