<p>I'm currently working on installing Goldilocks Helm chart to an EKS cluster. I have enabled an ingress for the tool's dashboard by manipulating a single Helm chart value. The problem is that, the ingress fails to deploy because default IAM policy for ALB controller is missing a single IAM policy statement. Therefore, I have created the required statement and linked it to the new policy.</p>
<p>When attempting to pass this custom IAM policy to the albController, I encountered the following <code>error: TypeError: policy.Statement</code> is not iterable. I'm facing difficulty in determining the expected property type for albController policy since it has no type defined (<code>any</code> type).</p>
<pre><code>const elbAllowAddTags = new iam.PolicyStatement({
      resources: [&quot;*&quot;],
      effect: iam.Effect.ALLOW,
      actions: [&quot;elasticloadbalancing:AddTags&quot;],
      conditions: { &quot;StringEquals&quot;: { &quot;elasticloadbalancing:CreateAction&quot;: &quot;CreateTargetGroup&quot; } }
    })

    const elbPolicy = new iam.Policy(scope, &quot;elbPolicy&quot;, {
      policyName: &quot;elbPolicy&quot;,
      statements: [elbAllowAddTags],
    });
  
  const eksCluster = new eks.Cluster(scope, id, {
    albController: {
      ...
      policy: elbPolicy,
    },
</code></pre>

rytis-valiukas
<p>Here an example from the <a href="https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_eks-readme.html" rel="nofollow noreferrer">CDK Docs</a></p>
<pre><code>declare const cluster: eks.Cluster;

const consoleReadOnlyRole = new iam.Role(this, 'ConsoleReadOnlyRole', {
assumedBy: new iam.ArnPrincipal('arn_for_trusted_principal'),
});
consoleReadOnlyRole.addToPolicy(new iam.PolicyStatement({
 actions: [
 'eks:AccessKubernetesApi',
 'eks:Describe*',
 'eks:List*',
 ],
 resources: [ cluster.clusterArn ],
 }));

// Add this role to system:masters RBAC group
cluster.awsAuth.addMastersRole(consoleReadOnlyRole)
</code></pre>
