Not possible to spin-up node with Karpenter submodule IAM Role when using SnapshotID

[sanjinp]

Description

We have a use-case where we want to use pre-created EBS volume snapshots, and current karpenter submodule does not permit access to snapshot resources.

• Module version [latest]:

• Terraform version:
  1.3.9

• Provider version(s):
  4.64.0

Steps to reproduce the behavior:

Try to spin ec2 machine with defined pre-created SnapshotID,

  blockDeviceMappings:
    - deviceName: /dev/xvda
      ebs:
        volumeSize: 4Gi
        volumeType: gp3
        encrypted: true
    - deviceName: /dev/xvdb
      ebs:
        volumeSize: 40Gi
        volumeType: gp3
        encrypted: true
        snapshotID: snap-********

Expected behavior

EC2 machine should successfully boot

Actual behavior

We receive error on Karpenter controller with no permissions related to snapshots

Terminal Output Screenshot(s)

{
  "allowed": false,
  "explicitDeny": false,
  "matchedStatements": {
    "items": []
  },
  "failures": {
    "items": []
  },
  "context": {
    "principal": {
      "id": "<REDACTED>:<REDACTED>",
      "arn": "arn:aws:sts::<REDACTED>:assumed-role/KarpenterIRSA-<REDACTED>"
    },
    "action": "ec2:RunInstances",
    "resource": "arn:aws:ec2:us-east-2::snapshot/snap-<REDACTED>",
    "conditions": {
      "items": [
        {
          "key": "ec2:ParentVolume",
          "values": {
            "items": [
              {
                "value": "arn:aws:ec2:us-east-2:<REDACTED>:volume/vol-<REDACTED>"
              }
            ]
          }
        },
        {
          "key": "aws:Resource",
          "values": {
            "items": [
              {
                "value": "snapshot/snap-<REDACTED>"
              }
            ]
          }
        },
        {
          "key": "aws:Account",
          "values": {
            "items": [
              {
                "value": "<REDACTED>"
              }
            ]
          }
        },
        {
          "key": "ec2:ResourceTag/Name",
          "values": {
            "items": [
              {
                "value": "<REDACTED>"
              }
            ]
          }
        },
        {
          "key": "ec2:IsLaunchTemplateResource",
          "values": {
            "items": [
              {
                "value": "true"
              }
            ]
          }
        },
        {
          "key": "aws:Region",
          "values": {
            "items": [
              {
                "value": "us-east-2"
              }
            ]
          }
        },
        {
          "key": "aws:Service",
          "values": {
            "items": [
              {
                "value": "ec2"
              }
            ]
          }
        },
        {
          "key": "<REDACTED>:Name",
          "values": {
            "items": [
              {
                "value": "<REDACTED>"
              }
            ]
          }
        },
        {
          "key": "ec2:VolumeSize",
          "values": {
            "items": [
              {
                "value": "40"
              }
            ]
          }
        },
        {
          "key": "ec2:SnapshotID",
          "values": {
            "items": [
              {
                "value": "snap-<REDACTED>"
              }
            ]
          }
        },
        {
          "key": "ec2:Owner",
          "values": {
            "items": [
              {
                "value": "<REDACTED>"
              }
            ]
          }
        },
        {
          "key": "aws:Type",
          "values": {
            "items": [
              {
                "value": "snapshot"
              }
            ]
          }
        },
        {
          "key": "ec2:Region",
          "values": {
            "items": [
              {
                "value": "us-east-2"
              }
            ]
          }
        },
        {
          "key": "ec2:SnapshotTime",
          "values": {
            "items": [
              {
                "value": "<REDACTED>"
              }
            ]
          }
        },
        {
          "key": "aws:ARN",
          "values": {
            "items": [
              {
                "value": "arn:aws:ec2:us-east-2::snapshot/snap-<REDACTED>"
              }
            ]
          }
        },
        {
          "key": "ec2:LaunchTemplate",
          "values": {
            "items": [
              {
                "value": "arn:aws:ec2:us-east-2:<REDACTED>:launch-template/<REDACTED>"
              }
            ]
          }
        }
      ]
    }
  }
}

Additional context

We lack permissions access to Snapshot ARN, in /modules/karpenter/main.tf
with value: "arn:${local.partition}:ec2:*::snapshot/*"

[bryantbiggs]

closed in #2649

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.