title: Pod execution role is not found in auth config or does not have all required permissions. How can I debug?
body: <h3>Objective</h3>
  <p>I want o be able to deploy AWS EKS using Fargate. I have successfully made the deployment work with a <code>node_group</code>. However, when I shifted to using Fargate, it seems that the pods are all stuck in the pending state.</p>
  <h3>How my current code looks like</h3>
  <p>I am provisioning using Terraform (not necessarily looking for a Terraform answer). This is how I create my EKS Cluster:</p>
  <pre class="lang-sh prettyprint-override"><code>module &quot;eks_cluster&quot; {
    source                            = &quot;terraform-aws-modules/eks/aws&quot;
    version                           = &quot;13.2.1&quot;
    cluster_name                      = &quot;${var.project_name}-${var.env_name}&quot;
    cluster_version                   = var.cluster_version
    vpc_id                            = var.vpc_id
    cluster_enabled_log_types         = [&quot;api&quot;, &quot;audit&quot;, &quot;authenticator&quot;, &quot;controllerManager&quot;, &quot;scheduler&quot;]
    enable_irsa                       = true
    subnets                           = concat(var.private_subnet_ids, var.public_subnet_ids)
    create_fargate_pod_execution_role = true
    write_kubeconfig                  = false
    fargate_pod_execution_role_name   = &quot;${var.project_name}-role&quot;
    # Assigning worker groups
    node_groups = {
      my_nodes = {
        desired_capacity = 1
        max_capacity     = 1
        min_capacity     = 1
        instance_type    = var.nodes_instance_type
        subnets          = var.private_subnet_ids
      }
    }
  }
  </code></pre>
  <p>And this is how I provision the Fargate profile:</p>
  <pre class="lang-sh prettyprint-override"><code>//#  Create EKS Fargate profile
  resource &quot;aws_eks_fargate_profile&quot; &quot;fargate_profile&quot; {
    cluster_name           = module.eks_cluster.cluster_id
    fargate_profile_name   = &quot;${var.project_name}-fargate-profile-${var.env_name}&quot;
    pod_execution_role_arn = aws_iam_role.fargate_iam_role.arn
    subnet_ids             = var.private_subnet_ids
  
    selector {
      namespace = var.project_name
    }
  }
  </code></pre>
  <p>And this is how I created and attach the required policies:</p>
  <pre class="lang-sh prettyprint-override"><code>//# Create IAM Role for Fargate Profile
  resource &quot;aws_iam_role&quot; &quot;fargate_iam_role&quot; {
    name                  = &quot;${var.project_name}-fargate-role-${var.env_name}&quot;
    force_detach_policies = true
    assume_role_policy    = jsonencode({
      Statement = [{
        Action    = &quot;sts:AssumeRole&quot;
        Effect    = &quot;Allow&quot;
        Principal = {
          Service = &quot;eks-fargate-pods.amazonaws.com&quot;
        }
      }]
      Version   = &quot;2012-10-17&quot;
    })
  }
  
  # Attach IAM Policy for Fargate
  resource &quot;aws_iam_role_policy_attachment&quot; &quot;fargate_pod_execution&quot; {
    role       = aws_iam_role.fargate_iam_role.name
    policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy&quot;
  }
  </code></pre>
  <h3>What I have tried but seems not to work</h3>
  <p>Running <code>kubectl describe pod</code> I get:</p>
  <pre><code>Events:
    Type     Reason            Age   From               Message
    ----     ------            ----  ----               -------
    Warning  FailedScheduling  14s   fargate-scheduler  Misconfigured Fargate Profile: fargate profile fargate-airflow-fargate-profile-dev blocked for new launches due to: Pod execution role is not found in auth config or does not have all required permissions for launching fargate pods.
  </code></pre>
  <h3>Other things I have tried but without success</h3>
  <p>I have tried mapping the role via the module's feature like:</p>
  <pre class="lang-sh prettyprint-override"><code>module &quot;eks_cluster&quot; {
    source                            = &quot;terraform-aws-modules/eks/aws&quot;
    version                           = &quot;13.2.1&quot;
    cluster_name                      = &quot;${var.project_name}-${var.env_name}&quot;
    cluster_version                   = var.cluster_version
    vpc_id                            = var.vpc_id
    cluster_enabled_log_types         = [&quot;api&quot;, &quot;audit&quot;, &quot;authenticator&quot;, &quot;controllerManager&quot;, &quot;scheduler&quot;]
    enable_irsa                       = true
    subnets                           = concat(var.private_subnet_ids, var.public_subnet_ids)
    create_fargate_pod_execution_role = true
    write_kubeconfig                  = false
    fargate_pod_execution_role_name   = &quot;${var.project_name}-role&quot;
    # Assigning worker groups
    node_groups = {
      my_nodes = {
        desired_capacity = 1
        max_capacity     = 1
        min_capacity     = 1
        instance_type    = var.nodes_instance_type
        subnets          = var.private_subnet_ids
      }
    }
  # Trying to map role
    map_roles = [
      {
        rolearn  = aws_eks_fargate_profile.airflow.arn
        username = aws_eks_fargate_profile.airflow.fargate_profile_name
        groups   = [&quot;system:*&quot;]
      }
    ]
  }
  </code></pre>
  <p>But my attempt was not successful. How can I debug this issue? And what is the cause behind it?</p>