fix(iam): starting from 2025 amazon requires explicit auth when resto…

…ring from snapshot

kubernetes-sigs/aws-ebs-csi-driver#2190

iam.tf

@@ -17,6 +17,17 @@ data "aws_iam_policy_document" "ebs_controller_policy" {
     ]
   }
 
+  # https://github.com/kubernetes-sigs/aws-ebs-csi-driver/issues/2190
+  statement {
+    effect = "Allow"
+
+    resources = [
+      "arn:${var.arn_format}:ec2:*:*:snapshot/*",
+    ]
+
+    actions = ["ec2:CreateVolume"]
+  }
+
   statement {
     effect = "Allow"
 
@@ -163,4 +174,4 @@ module "ebs_controller_role" {
   role_policy_arns              = concat([aws_iam_policy.ebs_controller_policy.arn], var.additional_iam_policies_arns)
   oidc_fully_qualified_subjects = ["system:serviceaccount:${var.namespace}:${local.controller_name}"]
   tags                          = var.tags
-}
+}