eks: policy does not exist or is not attachable in China regions

[pahud]

Describe the bug

When I deployed eks cluster to cn-north-1 I got the error:

Policy arn:aws-cn:iam::aws:policy/AmazonElasticContainerRegistryPublicReadOnly does not exist or is not attachable. (Service: AmazonIdentityManagement; Status Code: 404; Error Code: NoSuchEntity; Request ID: 084210a1-3251-4868-9420-f5e47d62f66a; Proxy: null)

Expected Behavior

successful deployment

Current Behavior

fail to deploy with the error message above.

Reproduction Steps

      const cluster = new eks.Cluster(this, 'Cluster', {
        vpc,
        version: eks.KubernetesVersion.V1_25,
        kubectlLayer: new KubectlLayer(this, 'KubectlLayer'),
        defaultCapacity: 0,
      })

Possible Solution

ECR Public is not available in AWS China regions and the AmazonElasticContainerRegistryPublicReadOnly is not available. We probably should exclude it when deploying in China regions. And this brings up another issue - if the eks cluster in China is trying to helm install charts from ECR public, it should not run the aws ecr-public commands like this:

aws-cdk/packages/@aws-cdk/aws-eks/lib/kubectl-handler/helm/__init__.py

Line 115 in a51346e

f"aws ecr-public get-login-password --region us-east-1 | " \

We probably should fix that in a separate PR.

Additional Information/Context

No response

CDK CLI Version

2.69.0

Framework Version

No response

Node.js Version

v19.6.0

OS

mac os x

Language

Typescript

Language Version

No response

Other information

No response

[pahud]

PR underway.

[wongma7]

it also affects govcloud #24808.

I'm not sure if I can downgrade CDK to work around the issue because the cluster is 1.25 and changelog says I need 2.69.0 for 1.25 support

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.