Update ALB controller IAM policy (cloudposse/terraform-aws-components#696)

Author: Nuru

src/main.tf

@@ -28,18 +28,32 @@ module "alb_controller" {
   iam_role_enabled = true
   # https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.2.1/docs/install/iam_policy.json
   iam_policy_statements = [
+    {
+      sid       = "AllowCreateServiceLinkedRole"
+      effect    = "Allow"
+      resources = ["*"]
+
+      actions = ["iam:CreateServiceLinkedRole"]
+      conditions = [
+        {
+          test     = "StringEquals"
+          variable = "AWSServiceName"
+          values   = ["elasticloadbalancing.amazonaws.com"]
+        }
+      ]
+    },
     {
       sid       = "AllowManageCompute"
       effect    = "Allow"
       resources = ["*"]
 
       actions = [
-        "iam:CreateServiceLinkedRole",
         "ec2:DescribeAccountAttributes",
         "ec2:DescribeAddresses",
         "ec2:DescribeAvailabilityZones",
         "ec2:DescribeInternetGateways",
         "ec2:DescribeVpcs",
+        "ec2:DescribeVpcPeeringConnections",
         "ec2:DescribeSubnets",
         "ec2:DescribeSecurityGroups",
         "ec2:DescribeInstances",
@@ -259,6 +273,37 @@ module "alb_controller" {
         }
       ]
     },
+    {
+      sid    = "AllowAddTagsOnCreate"
+      effect = "Allow"
+
+      resources = [
+        "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
+        "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
+        "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
+      ]
+
+      actions = ["elasticloadbalancing:AddTags"]
+
+      conditions = [
+        {
+          test     = "StringEquals"
+          variable = "elasticloadbalancing:CreateAction"
+
+          values = [
+            "CreateTargetGroup",
+            "CreateLoadBalancer",
+            # See https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/2692#issuecomment-1426242236
+            "CreateListener",
+          ]
+        },
+        {
+          test     = "Null"
+          variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
+          values   = ["false"]
+        }
+      ]
+    },
     {
       sid       = "AllowRegisterTargets"
       effect    = "Allow"