fix: Allow for both amazonaws.com.cn and amazonaws.com conditions in PassRole as required for AWS CN (#3422)

* Allow for both amazonaws.com.cn and amazonaws.com conditions as required for AWS CN

* Allow for both amazonaws.com.cn and amazonaws.com conditions as required for AWS CN - set in correct policy

---------

Co-authored-by: Oliver Smith <[email protected]>

Author: datty

modules/karpenter/policy.tf

@@ -585,7 +585,7 @@ data "aws_iam_policy_document" "v1" {
     condition {
       test     = "StringEquals"
       variable = "iam:PassedToService"
-      values   = ["ec2.${local.dns_suffix}"]
+      values   = distinct(["ec2.${local.dns_suffix}", "ec2.amazonaws.com"])
     }
   }