Merge pull request #130 from sunilarjun/update-eks-permission

Sync EKS Page with Community Docs
rancher · Jan 9, 2025 · 1fba539 · 1fba539
2 parents 2b487c3 + 0650a01
commit 1fba539
Showing 8 changed files with 1,038 additions and 1,243 deletions.
diff --git a/versions/latest/modules/en/pages/cluster-deployment/hosted-kubernetes/eks/eks.adoc b/versions/latest/modules/en/pages/cluster-deployment/hosted-kubernetes/eks/eks.adoc
@@ -85,7 +85,7 @@ This https://aws.amazon.com/blogs/opensource/managing-eks-clusters-rancher/[tuto
 
 == Minimum EKS Permissions
 
-These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. You'll need additional permissions for Rancher to provision the `Service Role` and `VPC` resources. If you create these resources *before* you create the cluster, they'll be available when you configure the cluster.
+These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. These permissions allow Rancher to create the Service Role and Virtual Private Cloud (VPC) resources on the users' behalf, if necessary.
 
 [NOTE]
 ====
@@ -96,140 +96,68 @@ In EKS v1.23 and above, you must use the out-of-tree drivers for EBS-backed volu
 |===
 | Resource | Description
 
-| Service Role
-| Provides permissions that allow Kubernetes to manage resources on your behalf. Rancher can create the service role with the following <<_service_role_permissions,Service Role Permissions>>.
-
-| VPC
-| Provides isolated network resources utilised by EKS and worker nodes. Rancher can create the VPC resources with the following <<_vpc_permissions,VPC Permissions>>.
-
 | EBS CSI Driver add-on
 | Provides permissions that allow Kubernetes to interact with EBS and configure the cluster to enable the add-on (required for EKS v1.23 and above). Rancher can install the add-on with the following <<_ebs_csi_driver_addon_permissions,EBS CSI Driver addon Permissions>>.
 |===
 
 Resource targeting uses `*` as the ARN of many of the resources created cannot be known before creating the EKS cluster in Rancher.
 
-[,json]
-----
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Sid": "EC2Permissions",
-            "Effect": "Allow",
-            "Action": [
-                "ec2:RunInstances",
-                "ec2:RevokeSecurityGroupIngress",
-                "ec2:RevokeSecurityGroupEgress",
-                "ec2:DescribeInstanceTypes",
-                "ec2:DescribeRegions",
-                "ec2:DescribeVpcs",
-                "ec2:DescribeTags",
-                "ec2:DescribeSubnets",
-                "ec2:DescribeSecurityGroups",
-                "ec2:DescribeRouteTables",
-                "ec2:DescribeLaunchTemplateVersions",
-                "ec2:DescribeLaunchTemplates",
-                "ec2:DescribeKeyPairs",
-                "ec2:DescribeInternetGateways",
-                "ec2:DescribeImages",
-                "ec2:DescribeAvailabilityZones",
-                "ec2:DescribeAccountAttributes",
-                "ec2:DeleteTags",
-                "ec2:DeleteLaunchTemplateVersions",
-                "ec2:DeleteLaunchTemplate",
-                "ec2:DeleteSecurityGroup",
-                "ec2:DeleteKeyPair",
-                "ec2:CreateTags",
-                "ec2:CreateSecurityGroup",
-                "ec2:CreateLaunchTemplateVersion",
-                "ec2:CreateLaunchTemplate",
-                "ec2:CreateKeyPair",
-                "ec2:AuthorizeSecurityGroupIngress",
-                "ec2:AuthorizeSecurityGroupEgress"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "CloudFormationPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "cloudformation:ListStacks",
-                "cloudformation:ListStackResources",
-                "cloudformation:DescribeStacks",
-                "cloudformation:DescribeStackResources",
-                "cloudformation:DescribeStackResource",
-                "cloudformation:DeleteStack",
-                "cloudformation:CreateStackSet",
-                "cloudformation:CreateStack"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "IAMPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "iam:PassRole",
-                "iam:ListRoles",
-                "iam:ListRoleTags",
-                "iam:ListInstanceProfilesForRole",
-                "iam:ListInstanceProfiles",
-                "iam:ListAttachedRolePolicies",
-                "iam:GetRole",
-                "iam:GetInstanceProfile",
-                "iam:DetachRolePolicy",
-                "iam:DeleteRole",
-                "iam:CreateRole",
-                "iam:AttachRolePolicy"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "KMSPermissions",
-            "Effect": "Allow",
-            "Action": "kms:ListKeys",
-            "Resource": "*"
-        },
-        {
-            "Sid": "EKSPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "eks:UpdateNodegroupVersion",
-                "eks:UpdateNodegroupConfig",
-                "eks:UpdateClusterVersion",
-                "eks:UpdateClusterConfig",
-                "eks:UntagResource",
-                "eks:TagResource",
-                "eks:ListUpdates",
-                "eks:ListTagsForResource",
-                "eks:ListNodegroups",
-                "eks:ListFargateProfiles",
-                "eks:ListClusters",
-                "eks:DescribeUpdate",
-                "eks:DescribeNodegroup",
-                "eks:DescribeFargateProfile",
-                "eks:DescribeCluster",
-                "eks:DeleteNodegroup",
-                "eks:DeleteFargateProfile",
-                "eks:DeleteCluster",
-                "eks:CreateNodegroup",
-                "eks:CreateFargateProfile",
-                "eks:CreateCluster"
-            ],
-            "Resource": "*"
-        }
-    ]
-}
-----
-
-=== Service Role Permissions
-
-These are permissions that are needed during EKS cluster creation, so Rancher can create a service role on the users' behalf.
-
 [,json]
 ----
 {
   "Version": "2012-10-17",
   "Statement": [
+    {
+      "Sid": "EC2Permissions",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:AuthorizeSecurityGroupEgress",
+        "ec2:AuthorizeSecurityGroupIngress",
+        "ec2:CreateKeyPair",
+        "ec2:CreateLaunchTemplate",
+        "ec2:CreateLaunchTemplateVersion",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateTags",
+        "ec2:DeleteKeyPair",
+        "ec2:DeleteLaunchTemplate",
+        "ec2:DeleteLaunchTemplateVersions",
+        "ec2:DeleteSecurityGroup",
+        "ec2:DeleteTags",
+        "ec2:DescribeAccountAttributes",
+        "ec2:DescribeAvailabilityZones",
+        "ec2:DescribeImages",
+        "ec2:DescribeInternetGateways",
+        "ec2:DescribeInstanceTypes",
+        "ec2:DescribeKeyPairs",
+        "ec2:DescribeLaunchTemplateVersions",
+        "ec2:DescribeLaunchTemplates",
+        "ec2:DescribeRegions",
+        "ec2:DescribeRouteTables",
+        "ec2:DescribeSecurityGroups",
+        "ec2:DescribeSubnets",
+        "ec2:DescribeTags",
+        "ec2:DescribeVpcs",
+        "ec2:RevokeSecurityGroupEgress",
+        "ec2:RevokeSecurityGroupIngress",
+        "ec2:RunInstances"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "CloudFormationPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "cloudformation:CreateStack",
+        "cloudformation:CreateStackSet",
+        "cloudformation:DeleteStack",
+        "cloudformation:DescribeStackResource",
+        "cloudformation:DescribeStackResources",
+        "cloudformation:DescribeStacks",
+        "cloudformation:ListStackResources",
+        "cloudformation:ListStacks"
+      ],
+      "Resource": "*"
+    },
     {
       "Sid": "IAMPermissions",
       "Effect": "Allow",
@@ -250,7 +178,70 @@ These are permissions that are needed during EKS cluster creation, so Rancher ca
         "iam:ListRoles",
         "iam:ListRoleTags",
         "iam:PassRole",
-        "iam:RemoveRoleFromInstanceProfile"
+        "iam:RemoveRoleFromInstanceProfile",
+        "iam:TagRole"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "KMSPermissions",
+      "Effect": "Allow",
+      "Action": "kms:ListKeys",
+      "Resource": "*"
+    },
+    {
+      "Sid": "EKSPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "eks:CreateCluster",
+        "eks:CreateFargateProfile",
+        "eks:CreateNodegroup",
+        "eks:DeleteCluster",
+        "eks:DeleteFargateProfile",
+        "eks:DeleteNodegroup",
+        "eks:DescribeAddon",
+        "eks:DescribeCluster",
+        "eks:DescribeFargateProfile",
+        "eks:DescribeNodegroup",
+        "eks:DescribeUpdate",
+        "eks:ListClusters",
+        "eks:ListFargateProfiles",
+        "eks:ListNodegroups",
+        "eks:ListTagsForResource",
+        "eks:ListUpdates",
+        "eks:TagResource",
+        "eks:UntagResource",
+        "eks:UpdateClusterConfig",
+        "eks:UpdateClusterVersion",
+        "eks:UpdateNodegroupConfig",
+        "eks:UpdateNodegroupVersion"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "VPCPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:AssociateRouteTable",
+        "ec2:AttachInternetGateway",
+        "ec2:CreateInternetGateway",
+        "ec2:CreateRoute",
+        "ec2:CreateRouteTable",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateSubnet",
+        "ec2:CreateVpc",
+        "ec2:DeleteInternetGateway",
+        "ec2:DeleteRoute",
+        "ec2:DeleteRouteTable",
+        "ec2:DeleteSubnet",
+        "ec2:DeleteTags",
+        "ec2:DeleteVpc",
+        "ec2:DescribeVpcs",
+        "ec2:DetachInternetGateway",
+        "ec2:DisassociateRouteTable",
+        "ec2:ModifySubnetAttribute",
+        "ec2:ModifyVpcAttribute",
+        "ec2:ReplaceRoute"
       ],
       "Resource": "*"
     }
@@ -284,84 +275,37 @@ arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
 arn:aws:iam::aws:policy/AmazonEKSServicePolicy
 ----
 
-=== VPC Permissions
+=== EBS CSI Driver addon Permissions
 
-These are permissions that are needed by Rancher to create a Virtual Private Cloud (VPC) and associated resources.
+The following are the required permissions for installing the Amazon EBS CSI Driver add-on.
 
 [,json]
 ----
 {
   "Version": "2012-10-17",
   "Statement": [
     {
-      "Sid": "VPCPermissions",
       "Effect": "Allow",
       "Action": [
-        "ec2:ReplaceRoute",
-        "ec2:ModifyVpcAttribute",
-        "ec2:ModifySubnetAttribute",
-        "ec2:DisassociateRouteTable",
-        "ec2:DetachInternetGateway",
-        "ec2:DescribeVpcs",
-        "ec2:DeleteVpc",
-        "ec2:DeleteTags",
-        "ec2:DeleteSubnet",
-        "ec2:DeleteRouteTable",
-        "ec2:DeleteRoute",
-        "ec2:DeleteInternetGateway",
-        "ec2:CreateVpc",
-        "ec2:CreateSubnet",
-        "ec2:CreateSecurityGroup",
-        "ec2:CreateRouteTable",
-        "ec2:CreateRoute",
-        "ec2:CreateInternetGateway",
-        "ec2:AttachInternetGateway",
-        "ec2:AssociateRouteTable"
+        "eks:AssociateIdentityProviderConfig",
+        "eks:CreateAddon",
+        "eks:DeleteAddon",
+        "eks:DescribeAddonConfiguration",
+        "eks:DescribeAddonVersions",
+        "eks:DescribeIdentityProviderConfig",
+        "eks:ListAddons",
+        "eks:ListIdentityProviderConfigs",
+        "eks:UpdateAddon",
+        "iam:CreateOpenIDConnectProvider",
+        "iam:ListOpenIDConnectProviders",
+        "sts:AssumeRoleWithWebIdentity"
       ],
       "Resource": "*"
     }
   ]
 }
 ----
 
-=== EBS CSI Driver addon Permissions
-
-The following are the required permissions for installing the Amazon EBS CSI Driver add-on.
-
-[,json]
-----
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Action": [
-                "iam:GetRole",
-                "eks:DescribeAddonConfiguration",
-                "eks:UpdateAddon",
-                "eks:ListAddons",
-                "iam:CreateRole",
-                "iam:AttachRolePolicy",
-                "eks:DescribeAddon",
-                "iam:CreateOpenIDConnectProvider",
-                "iam:PassRole",
-                "eks:DescribeIdentityProviderConfig",
-                "eks:DeleteAddon",
-                "iam:ListOpenIDConnectProviders",
-                "iam:ListAttachedRolePolicies",
-                "eks:CreateAddon",
-                "eks:DescribeCluster",
-                "eks:DescribeAddonVersions",
-                "sts:AssumeRoleWithWebIdentity",
-                "eks:AssociateIdentityProviderConfig",
-                "eks:ListIdentityProviderConfigs"
-            ],
-            "Resource": "*"
-        }
-    ]
-}
-----
-
 == Syncing
 
 The EKS provisioner can synchronize the state of an EKS cluster between Rancher and the provider. For an in-depth technical explanation of how this works, see xref:cluster-deployment/hosted-kubernetes/sync-clusters.adoc[Syncing.]

diff --git a/versions/latest/modules/zh/pages/cluster-deployment/hosted-kubernetes/eks/eks.adoc b/versions/latest/modules/zh/pages/cluster-deployment/hosted-kubernetes/eks/eks.adoc
@@ -85,141 +85,73 @@ AWS 开源博客上的这篇link:https://aws.amazon.com/blogs/opensource/managin
 
 == 最小 EKS 权限
 
-这些是访问 Rancher EKS 驱动程序的全部功能所需的最低权限集。你需要 Rancher 的其他权限才能配置 `Service Role` 和 `VPC` 资源。如果你在创建集群**之前**创建了这些资源，你在配置集群时将可以使用这些资源。
+These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. These permissions allow Rancher to create the Service Role and Virtual Private Cloud (VPC) resources on the users' behalf, if necessary.
 
 |===
 | 资源 | 描述
 
 | 服务角色
 | 提供允许 Kubernetes 代表你管理资源的权限。Rancher 可以使用以下<<_服务角色权限,服务角色权限>>来创建服务角色。
-
-| VPC
-| 提供 EKS 和 Worker 节点使用的隔离网络资源。Rancher 使用以下 <<_vpc_权限,VPC 权限>>创建 VPC 资源。
 |===
 
 资源定位使用 `*` 作为在 Rancher 中创建 EKS 集群之前，无法已知创建的资源的名称（ARN）。
 
-[,json]
-----
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Sid": "EC2Permissions",
-            "Effect": "Allow",
-            "Action": [
-                "ec2:RunInstances",
-                "ec2:RevokeSecurityGroupIngress",
-                "ec2:RevokeSecurityGroupEgress",
-                "ec2:DescribeInstanceTypes",
-                "ec2:DescribeRegions",
-                "ec2:DescribeVpcs",
-                "ec2:DescribeTags",
-                "ec2:DescribeSubnets",
-                "ec2:DescribeSecurityGroups",
-                "ec2:DescribeRouteTables",
-                "ec2:DescribeLaunchTemplateVersions",
-                "ec2:DescribeLaunchTemplates",
-                "ec2:DescribeKeyPairs",
-                "ec2:DescribeInternetGateways",
-                "ec2:DescribeImages",
-                "ec2:DescribeAvailabilityZones",
-                "ec2:DescribeAccountAttributes",
-                "ec2:DeleteTags",
-                "ec2:DeleteLaunchTemplate",
-                "ec2:DeleteSecurityGroup",
-                "ec2:DeleteKeyPair",
-                "ec2:CreateTags",
-                "ec2:CreateSecurityGroup",
-                "ec2:CreateLaunchTemplateVersion",
-                "ec2:CreateLaunchTemplate",
-                "ec2:CreateKeyPair",
-                "ec2:AuthorizeSecurityGroupIngress",
-                "ec2:AuthorizeSecurityGroupEgress"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "CloudFormationPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "cloudformation:ListStacks",
-                "cloudformation:ListStackResources",
-                "cloudformation:DescribeStacks",
-                "cloudformation:DescribeStackResources",
-                "cloudformation:DescribeStackResource",
-                "cloudformation:DeleteStack",
-                "cloudformation:CreateStackSet",
-                "cloudformation:CreateStack"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "IAMPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "iam:PassRole",
-                "iam:ListRoles",
-                "iam:ListRoleTags",
-                "iam:ListInstanceProfilesForRole",
-                "iam:ListInstanceProfiles",
-                "iam:ListAttachedRolePolicies",
-                "iam:GetRole",
-                "iam:GetInstanceProfile",
-                "iam:DetachRolePolicy",
-                "iam:DeleteRole",
-                "iam:CreateRole",
-                "iam:AttachRolePolicy"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "KMSPermissions",
-            "Effect": "Allow",
-            "Action": "kms:ListKeys",
-            "Resource": "*"
-        },
-        {
-            "Sid": "EKSPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "eks:UpdateNodegroupVersion",
-                "eks:UpdateNodegroupConfig",
-                "eks:UpdateClusterVersion",
-                "eks:UpdateClusterConfig",
-                "eks:UntagResource",
-                "eks:TagResource",
-                "eks:ListUpdates",
-                "eks:ListTagsForResource",
-                "eks:ListNodegroups",
-                "eks:ListFargateProfiles",
-                "eks:ListClusters",
-                "eks:DescribeUpdate",
-                "eks:DescribeNodegroup",
-                "eks:DescribeFargateProfile",
-                "eks:DescribeCluster",
-                "eks:DeleteNodegroup",
-                "eks:DeleteFargateProfile",
-                "eks:DeleteCluster",
-                "eks:CreateNodegroup",
-                "eks:CreateFargateProfile",
-                "eks:CreateCluster"
-            ],
-            "Resource": "*"
-        }
-    ]
-}
-----
-
-=== 服务角色权限
-
-这些是 EKS 集群创建期间所需的权限，以便 Rancher 可以代表用户创建服务角色。
-
 [,json]
 ----
 {
   "Version": "2012-10-17",
   "Statement": [
+    {
+      "Sid": "EC2Permissions",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:AuthorizeSecurityGroupEgress",
+        "ec2:AuthorizeSecurityGroupIngress",
+        "ec2:CreateKeyPair",
+        "ec2:CreateLaunchTemplate",
+        "ec2:CreateLaunchTemplateVersion",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateTags",
+        "ec2:DeleteKeyPair",
+        "ec2:DeleteLaunchTemplate",
+        "ec2:DeleteLaunchTemplateVersions",
+        "ec2:DeleteSecurityGroup",
+        "ec2:DeleteTags",
+        "ec2:DescribeAccountAttributes",
+        "ec2:DescribeAvailabilityZones",
+        "ec2:DescribeImages",
+        "ec2:DescribeInternetGateways",
+        "ec2:DescribeInstanceTypes",
+        "ec2:DescribeKeyPairs",
+        "ec2:DescribeLaunchTemplateVersions",
+        "ec2:DescribeLaunchTemplates",
+        "ec2:DescribeRegions",
+        "ec2:DescribeRouteTables",
+        "ec2:DescribeSecurityGroups",
+        "ec2:DescribeSubnets",
+        "ec2:DescribeTags",
+        "ec2:DescribeVpcs",
+        "ec2:RevokeSecurityGroupEgress",
+        "ec2:RevokeSecurityGroupIngress",
+        "ec2:RunInstances"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "CloudFormationPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "cloudformation:CreateStack",
+        "cloudformation:CreateStackSet",
+        "cloudformation:DeleteStack",
+        "cloudformation:DescribeStackResource",
+        "cloudformation:DescribeStackResources",
+        "cloudformation:DescribeStacks",
+        "cloudformation:ListStackResources",
+        "cloudformation:ListStacks"
+      ],
+      "Resource": "*"
+    },
     {
       "Sid": "IAMPermissions",
       "Effect": "Allow",
@@ -240,7 +172,70 @@ AWS 开源博客上的这篇link:https://aws.amazon.com/blogs/opensource/managin
         "iam:ListRoles",
         "iam:ListRoleTags",
         "iam:PassRole",
-        "iam:RemoveRoleFromInstanceProfile"
+        "iam:RemoveRoleFromInstanceProfile",
+        "iam:TagRole"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "KMSPermissions",
+      "Effect": "Allow",
+      "Action": "kms:ListKeys",
+      "Resource": "*"
+    },
+    {
+      "Sid": "EKSPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "eks:CreateCluster",
+        "eks:CreateFargateProfile",
+        "eks:CreateNodegroup",
+        "eks:DeleteCluster",
+        "eks:DeleteFargateProfile",
+        "eks:DeleteNodegroup",
+        "eks:DescribeAddon",
+        "eks:DescribeCluster",
+        "eks:DescribeFargateProfile",
+        "eks:DescribeNodegroup",
+        "eks:DescribeUpdate",
+        "eks:ListClusters",
+        "eks:ListFargateProfiles",
+        "eks:ListNodegroups",
+        "eks:ListTagsForResource",
+        "eks:ListUpdates",
+        "eks:TagResource",
+        "eks:UntagResource",
+        "eks:UpdateClusterConfig",
+        "eks:UpdateClusterVersion",
+        "eks:UpdateNodegroupConfig",
+        "eks:UpdateNodegroupVersion"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "VPCPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:AssociateRouteTable",
+        "ec2:AttachInternetGateway",
+        "ec2:CreateInternetGateway",
+        "ec2:CreateRoute",
+        "ec2:CreateRouteTable",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateSubnet",
+        "ec2:CreateVpc",
+        "ec2:DeleteInternetGateway",
+        "ec2:DeleteRoute",
+        "ec2:DeleteRouteTable",
+        "ec2:DeleteSubnet",
+        "ec2:DeleteTags",
+        "ec2:DeleteVpc",
+        "ec2:DescribeVpcs",
+        "ec2:DetachInternetGateway",
+        "ec2:DisassociateRouteTable",
+        "ec2:ModifySubnetAttribute",
+        "ec2:ModifyVpcAttribute",
+        "ec2:ReplaceRoute"
       ],
       "Resource": "*"
     }
@@ -274,39 +269,30 @@ arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
 arn:aws:iam::aws:policy/AmazonEKSServicePolicy
 ----
 
-=== VPC 权限
+=== EBS CSI Driver addon Permissions
 
-这些是 Rancher 创建虚拟私有云 (VPC) 和相关资源所需的权限。
+The following are the required permissions for installing the Amazon EBS CSI Driver add-on.
 
 [,json]
 ----
 {
   "Version": "2012-10-17",
   "Statement": [
     {
-      "Sid": "VPCPermissions",
       "Effect": "Allow",
       "Action": [
-        "ec2:ReplaceRoute",
-        "ec2:ModifyVpcAttribute",
-        "ec2:ModifySubnetAttribute",
-        "ec2:DisassociateRouteTable",
-        "ec2:DetachInternetGateway",
-        "ec2:DescribeVpcs",
-        "ec2:DeleteVpc",
-        "ec2:DeleteTags",
-        "ec2:DeleteSubnet",
-        "ec2:DeleteRouteTable",
-        "ec2:DeleteRoute",
-        "ec2:DeleteInternetGateway",
-        "ec2:CreateVpc",
-        "ec2:CreateSubnet",
-        "ec2:CreateSecurityGroup",
-        "ec2:CreateRouteTable",
-        "ec2:CreateRoute",
-        "ec2:CreateInternetGateway",
-        "ec2:AttachInternetGateway",
-        "ec2:AssociateRouteTable"
+        "eks:AssociateIdentityProviderConfig",
+        "eks:CreateAddon",
+        "eks:DeleteAddon",
+        "eks:DescribeAddonConfiguration",
+        "eks:DescribeAddonVersions",
+        "eks:DescribeIdentityProviderConfig",
+        "eks:ListAddons",
+        "eks:ListIdentityProviderConfigs",
+        "eks:UpdateAddon",
+        "iam:CreateOpenIDConnectProvider",
+        "iam:ListOpenIDConnectProviders",
+        "sts:AssumeRoleWithWebIdentity"
       ],
       "Resource": "*"
     }

diff --git a/versions/v2.10/modules/en/pages/cluster-deployment/hosted-kubernetes/eks/eks.adoc b/versions/v2.10/modules/en/pages/cluster-deployment/hosted-kubernetes/eks/eks.adoc
@@ -85,7 +85,7 @@ This https://aws.amazon.com/blogs/opensource/managing-eks-clusters-rancher/[tuto
 
 == Minimum EKS Permissions
 
-These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. You'll need additional permissions for Rancher to provision the `Service Role` and `VPC` resources. If you create these resources *before* you create the cluster, they'll be available when you configure the cluster.
+These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. These permissions allow Rancher to create the Service Role and Virtual Private Cloud (VPC) resources on the users' behalf, if necessary.
 
 [NOTE]
 ====
@@ -96,140 +96,68 @@ In EKS v1.23 and above, you must use the out-of-tree drivers for EBS-backed volu
 |===
 | Resource | Description
 
-| Service Role
-| Provides permissions that allow Kubernetes to manage resources on your behalf. Rancher can create the service role with the following <<_service_role_permissions,Service Role Permissions>>.
-
-| VPC
-| Provides isolated network resources utilised by EKS and worker nodes. Rancher can create the VPC resources with the following <<_vpc_permissions,VPC Permissions>>.
-
 | EBS CSI Driver add-on
 | Provides permissions that allow Kubernetes to interact with EBS and configure the cluster to enable the add-on (required for EKS v1.23 and above). Rancher can install the add-on with the following <<_ebs_csi_driver_addon_permissions,EBS CSI Driver addon Permissions>>.
 |===
 
 Resource targeting uses `*` as the ARN of many of the resources created cannot be known before creating the EKS cluster in Rancher.
 
-[,json]
-----
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Sid": "EC2Permissions",
-            "Effect": "Allow",
-            "Action": [
-                "ec2:RunInstances",
-                "ec2:RevokeSecurityGroupIngress",
-                "ec2:RevokeSecurityGroupEgress",
-                "ec2:DescribeInstanceTypes",
-                "ec2:DescribeRegions",
-                "ec2:DescribeVpcs",
-                "ec2:DescribeTags",
-                "ec2:DescribeSubnets",
-                "ec2:DescribeSecurityGroups",
-                "ec2:DescribeRouteTables",
-                "ec2:DescribeLaunchTemplateVersions",
-                "ec2:DescribeLaunchTemplates",
-                "ec2:DescribeKeyPairs",
-                "ec2:DescribeInternetGateways",
-                "ec2:DescribeImages",
-                "ec2:DescribeAvailabilityZones",
-                "ec2:DescribeAccountAttributes",
-                "ec2:DeleteTags",
-                "ec2:DeleteLaunchTemplateVersions",
-                "ec2:DeleteLaunchTemplate",
-                "ec2:DeleteSecurityGroup",
-                "ec2:DeleteKeyPair",
-                "ec2:CreateTags",
-                "ec2:CreateSecurityGroup",
-                "ec2:CreateLaunchTemplateVersion",
-                "ec2:CreateLaunchTemplate",
-                "ec2:CreateKeyPair",
-                "ec2:AuthorizeSecurityGroupIngress",
-                "ec2:AuthorizeSecurityGroupEgress"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "CloudFormationPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "cloudformation:ListStacks",
-                "cloudformation:ListStackResources",
-                "cloudformation:DescribeStacks",
-                "cloudformation:DescribeStackResources",
-                "cloudformation:DescribeStackResource",
-                "cloudformation:DeleteStack",
-                "cloudformation:CreateStackSet",
-                "cloudformation:CreateStack"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "IAMPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "iam:PassRole",
-                "iam:ListRoles",
-                "iam:ListRoleTags",
-                "iam:ListInstanceProfilesForRole",
-                "iam:ListInstanceProfiles",
-                "iam:ListAttachedRolePolicies",
-                "iam:GetRole",
-                "iam:GetInstanceProfile",
-                "iam:DetachRolePolicy",
-                "iam:DeleteRole",
-                "iam:CreateRole",
-                "iam:AttachRolePolicy"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "KMSPermissions",
-            "Effect": "Allow",
-            "Action": "kms:ListKeys",
-            "Resource": "*"
-        },
-        {
-            "Sid": "EKSPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "eks:UpdateNodegroupVersion",
-                "eks:UpdateNodegroupConfig",
-                "eks:UpdateClusterVersion",
-                "eks:UpdateClusterConfig",
-                "eks:UntagResource",
-                "eks:TagResource",
-                "eks:ListUpdates",
-                "eks:ListTagsForResource",
-                "eks:ListNodegroups",
-                "eks:ListFargateProfiles",
-                "eks:ListClusters",
-                "eks:DescribeUpdate",
-                "eks:DescribeNodegroup",
-                "eks:DescribeFargateProfile",
-                "eks:DescribeCluster",
-                "eks:DeleteNodegroup",
-                "eks:DeleteFargateProfile",
-                "eks:DeleteCluster",
-                "eks:CreateNodegroup",
-                "eks:CreateFargateProfile",
-                "eks:CreateCluster"
-            ],
-            "Resource": "*"
-        }
-    ]
-}
-----
-
-=== Service Role Permissions
-
-These are permissions that are needed during EKS cluster creation, so Rancher can create a service role on the users' behalf.
-
 [,json]
 ----
 {
   "Version": "2012-10-17",
   "Statement": [
+    {
+      "Sid": "EC2Permissions",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:AuthorizeSecurityGroupEgress",
+        "ec2:AuthorizeSecurityGroupIngress",
+        "ec2:CreateKeyPair",
+        "ec2:CreateLaunchTemplate",
+        "ec2:CreateLaunchTemplateVersion",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateTags",
+        "ec2:DeleteKeyPair",
+        "ec2:DeleteLaunchTemplate",
+        "ec2:DeleteLaunchTemplateVersions",
+        "ec2:DeleteSecurityGroup",
+        "ec2:DeleteTags",
+        "ec2:DescribeAccountAttributes",
+        "ec2:DescribeAvailabilityZones",
+        "ec2:DescribeImages",
+        "ec2:DescribeInternetGateways",
+        "ec2:DescribeInstanceTypes",
+        "ec2:DescribeKeyPairs",
+        "ec2:DescribeLaunchTemplateVersions",
+        "ec2:DescribeLaunchTemplates",
+        "ec2:DescribeRegions",
+        "ec2:DescribeRouteTables",
+        "ec2:DescribeSecurityGroups",
+        "ec2:DescribeSubnets",
+        "ec2:DescribeTags",
+        "ec2:DescribeVpcs",
+        "ec2:RevokeSecurityGroupEgress",
+        "ec2:RevokeSecurityGroupIngress",
+        "ec2:RunInstances"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "CloudFormationPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "cloudformation:CreateStack",
+        "cloudformation:CreateStackSet",
+        "cloudformation:DeleteStack",
+        "cloudformation:DescribeStackResource",
+        "cloudformation:DescribeStackResources",
+        "cloudformation:DescribeStacks",
+        "cloudformation:ListStackResources",
+        "cloudformation:ListStacks"
+      ],
+      "Resource": "*"
+    },
     {
       "Sid": "IAMPermissions",
       "Effect": "Allow",
@@ -250,7 +178,70 @@ These are permissions that are needed during EKS cluster creation, so Rancher ca
         "iam:ListRoles",
         "iam:ListRoleTags",
         "iam:PassRole",
-        "iam:RemoveRoleFromInstanceProfile"
+        "iam:RemoveRoleFromInstanceProfile",
+        "iam:TagRole"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "KMSPermissions",
+      "Effect": "Allow",
+      "Action": "kms:ListKeys",
+      "Resource": "*"
+    },
+    {
+      "Sid": "EKSPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "eks:CreateCluster",
+        "eks:CreateFargateProfile",
+        "eks:CreateNodegroup",
+        "eks:DeleteCluster",
+        "eks:DeleteFargateProfile",
+        "eks:DeleteNodegroup",
+        "eks:DescribeAddon",
+        "eks:DescribeCluster",
+        "eks:DescribeFargateProfile",
+        "eks:DescribeNodegroup",
+        "eks:DescribeUpdate",
+        "eks:ListClusters",
+        "eks:ListFargateProfiles",
+        "eks:ListNodegroups",
+        "eks:ListTagsForResource",
+        "eks:ListUpdates",
+        "eks:TagResource",
+        "eks:UntagResource",
+        "eks:UpdateClusterConfig",
+        "eks:UpdateClusterVersion",
+        "eks:UpdateNodegroupConfig",
+        "eks:UpdateNodegroupVersion"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "VPCPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:AssociateRouteTable",
+        "ec2:AttachInternetGateway",
+        "ec2:CreateInternetGateway",
+        "ec2:CreateRoute",
+        "ec2:CreateRouteTable",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateSubnet",
+        "ec2:CreateVpc",
+        "ec2:DeleteInternetGateway",
+        "ec2:DeleteRoute",
+        "ec2:DeleteRouteTable",
+        "ec2:DeleteSubnet",
+        "ec2:DeleteTags",
+        "ec2:DeleteVpc",
+        "ec2:DescribeVpcs",
+        "ec2:DetachInternetGateway",
+        "ec2:DisassociateRouteTable",
+        "ec2:ModifySubnetAttribute",
+        "ec2:ModifyVpcAttribute",
+        "ec2:ReplaceRoute"
       ],
       "Resource": "*"
     }
@@ -284,84 +275,37 @@ arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
 arn:aws:iam::aws:policy/AmazonEKSServicePolicy
 ----
 
-=== VPC Permissions
+=== EBS CSI Driver addon Permissions
 
-These are permissions that are needed by Rancher to create a Virtual Private Cloud (VPC) and associated resources.
+The following are the required permissions for installing the Amazon EBS CSI Driver add-on.
 
 [,json]
 ----
 {
   "Version": "2012-10-17",
   "Statement": [
     {
-      "Sid": "VPCPermissions",
       "Effect": "Allow",
       "Action": [
-        "ec2:ReplaceRoute",
-        "ec2:ModifyVpcAttribute",
-        "ec2:ModifySubnetAttribute",
-        "ec2:DisassociateRouteTable",
-        "ec2:DetachInternetGateway",
-        "ec2:DescribeVpcs",
-        "ec2:DeleteVpc",
-        "ec2:DeleteTags",
-        "ec2:DeleteSubnet",
-        "ec2:DeleteRouteTable",
-        "ec2:DeleteRoute",
-        "ec2:DeleteInternetGateway",
-        "ec2:CreateVpc",
-        "ec2:CreateSubnet",
-        "ec2:CreateSecurityGroup",
-        "ec2:CreateRouteTable",
-        "ec2:CreateRoute",
-        "ec2:CreateInternetGateway",
-        "ec2:AttachInternetGateway",
-        "ec2:AssociateRouteTable"
+        "eks:AssociateIdentityProviderConfig",
+        "eks:CreateAddon",
+        "eks:DeleteAddon",
+        "eks:DescribeAddonConfiguration",
+        "eks:DescribeAddonVersions",
+        "eks:DescribeIdentityProviderConfig",
+        "eks:ListAddons",
+        "eks:ListIdentityProviderConfigs",
+        "eks:UpdateAddon",
+        "iam:CreateOpenIDConnectProvider",
+        "iam:ListOpenIDConnectProviders",
+        "sts:AssumeRoleWithWebIdentity"
       ],
       "Resource": "*"
     }
   ]
 }
 ----
 
-=== EBS CSI Driver addon Permissions
-
-The following are the required permissions for installing the Amazon EBS CSI Driver add-on.
-
-[,json]
-----
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Action": [
-                "iam:GetRole",
-                "eks:DescribeAddonConfiguration",
-                "eks:UpdateAddon",
-                "eks:ListAddons",
-                "iam:CreateRole",
-                "iam:AttachRolePolicy",
-                "eks:DescribeAddon",
-                "iam:CreateOpenIDConnectProvider",
-                "iam:PassRole",
-                "eks:DescribeIdentityProviderConfig",
-                "eks:DeleteAddon",
-                "iam:ListOpenIDConnectProviders",
-                "iam:ListAttachedRolePolicies",
-                "eks:CreateAddon",
-                "eks:DescribeCluster",
-                "eks:DescribeAddonVersions",
-                "sts:AssumeRoleWithWebIdentity",
-                "eks:AssociateIdentityProviderConfig",
-                "eks:ListIdentityProviderConfigs"
-            ],
-            "Resource": "*"
-        }
-    ]
-}
-----
-
 == Syncing
 
 The EKS provisioner can synchronize the state of an EKS cluster between Rancher and the provider. For an in-depth technical explanation of how this works, see xref:cluster-deployment/hosted-kubernetes/sync-clusters.adoc[Syncing.]

diff --git a/versions/v2.10/modules/zh/pages/cluster-deployment/hosted-kubernetes/eks/eks.adoc b/versions/v2.10/modules/zh/pages/cluster-deployment/hosted-kubernetes/eks/eks.adoc
@@ -85,141 +85,73 @@ AWS 开源博客上的这篇link:https://aws.amazon.com/blogs/opensource/managin
 
 == 最小 EKS 权限
 
-这些是访问 Rancher EKS 驱动程序的全部功能所需的最低权限集。你需要 Rancher 的其他权限才能配置 `Service Role` 和 `VPC` 资源。如果你在创建集群**之前**创建了这些资源，你在配置集群时将可以使用这些资源。
+These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. These permissions allow Rancher to create the Service Role and Virtual Private Cloud (VPC) resources on the users' behalf, if necessary.
 
 |===
 | 资源 | 描述
 
 | 服务角色
 | 提供允许 Kubernetes 代表你管理资源的权限。Rancher 可以使用以下<<_服务角色权限,服务角色权限>>来创建服务角色。
-
-| VPC
-| 提供 EKS 和 Worker 节点使用的隔离网络资源。Rancher 使用以下 <<_vpc_权限,VPC 权限>>创建 VPC 资源。
 |===
 
 资源定位使用 `*` 作为在 Rancher 中创建 EKS 集群之前，无法已知创建的资源的名称（ARN）。
 
-[,json]
-----
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Sid": "EC2Permissions",
-            "Effect": "Allow",
-            "Action": [
-                "ec2:RunInstances",
-                "ec2:RevokeSecurityGroupIngress",
-                "ec2:RevokeSecurityGroupEgress",
-                "ec2:DescribeInstanceTypes",
-                "ec2:DescribeRegions",
-                "ec2:DescribeVpcs",
-                "ec2:DescribeTags",
-                "ec2:DescribeSubnets",
-                "ec2:DescribeSecurityGroups",
-                "ec2:DescribeRouteTables",
-                "ec2:DescribeLaunchTemplateVersions",
-                "ec2:DescribeLaunchTemplates",
-                "ec2:DescribeKeyPairs",
-                "ec2:DescribeInternetGateways",
-                "ec2:DescribeImages",
-                "ec2:DescribeAvailabilityZones",
-                "ec2:DescribeAccountAttributes",
-                "ec2:DeleteTags",
-                "ec2:DeleteLaunchTemplate",
-                "ec2:DeleteSecurityGroup",
-                "ec2:DeleteKeyPair",
-                "ec2:CreateTags",
-                "ec2:CreateSecurityGroup",
-                "ec2:CreateLaunchTemplateVersion",
-                "ec2:CreateLaunchTemplate",
-                "ec2:CreateKeyPair",
-                "ec2:AuthorizeSecurityGroupIngress",
-                "ec2:AuthorizeSecurityGroupEgress"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "CloudFormationPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "cloudformation:ListStacks",
-                "cloudformation:ListStackResources",
-                "cloudformation:DescribeStacks",
-                "cloudformation:DescribeStackResources",
-                "cloudformation:DescribeStackResource",
-                "cloudformation:DeleteStack",
-                "cloudformation:CreateStackSet",
-                "cloudformation:CreateStack"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "IAMPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "iam:PassRole",
-                "iam:ListRoles",
-                "iam:ListRoleTags",
-                "iam:ListInstanceProfilesForRole",
-                "iam:ListInstanceProfiles",
-                "iam:ListAttachedRolePolicies",
-                "iam:GetRole",
-                "iam:GetInstanceProfile",
-                "iam:DetachRolePolicy",
-                "iam:DeleteRole",
-                "iam:CreateRole",
-                "iam:AttachRolePolicy"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "KMSPermissions",
-            "Effect": "Allow",
-            "Action": "kms:ListKeys",
-            "Resource": "*"
-        },
-        {
-            "Sid": "EKSPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "eks:UpdateNodegroupVersion",
-                "eks:UpdateNodegroupConfig",
-                "eks:UpdateClusterVersion",
-                "eks:UpdateClusterConfig",
-                "eks:UntagResource",
-                "eks:TagResource",
-                "eks:ListUpdates",
-                "eks:ListTagsForResource",
-                "eks:ListNodegroups",
-                "eks:ListFargateProfiles",
-                "eks:ListClusters",
-                "eks:DescribeUpdate",
-                "eks:DescribeNodegroup",
-                "eks:DescribeFargateProfile",
-                "eks:DescribeCluster",
-                "eks:DeleteNodegroup",
-                "eks:DeleteFargateProfile",
-                "eks:DeleteCluster",
-                "eks:CreateNodegroup",
-                "eks:CreateFargateProfile",
-                "eks:CreateCluster"
-            ],
-            "Resource": "*"
-        }
-    ]
-}
-----
-
-=== 服务角色权限
-
-这些是 EKS 集群创建期间所需的权限，以便 Rancher 可以代表用户创建服务角色。
-
 [,json]
 ----
 {
   "Version": "2012-10-17",
   "Statement": [
+    {
+      "Sid": "EC2Permissions",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:AuthorizeSecurityGroupEgress",
+        "ec2:AuthorizeSecurityGroupIngress",
+        "ec2:CreateKeyPair",
+        "ec2:CreateLaunchTemplate",
+        "ec2:CreateLaunchTemplateVersion",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateTags",
+        "ec2:DeleteKeyPair",
+        "ec2:DeleteLaunchTemplate",
+        "ec2:DeleteLaunchTemplateVersions",
+        "ec2:DeleteSecurityGroup",
+        "ec2:DeleteTags",
+        "ec2:DescribeAccountAttributes",
+        "ec2:DescribeAvailabilityZones",
+        "ec2:DescribeImages",
+        "ec2:DescribeInternetGateways",
+        "ec2:DescribeInstanceTypes",
+        "ec2:DescribeKeyPairs",
+        "ec2:DescribeLaunchTemplateVersions",
+        "ec2:DescribeLaunchTemplates",
+        "ec2:DescribeRegions",
+        "ec2:DescribeRouteTables",
+        "ec2:DescribeSecurityGroups",
+        "ec2:DescribeSubnets",
+        "ec2:DescribeTags",
+        "ec2:DescribeVpcs",
+        "ec2:RevokeSecurityGroupEgress",
+        "ec2:RevokeSecurityGroupIngress",
+        "ec2:RunInstances"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "CloudFormationPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "cloudformation:CreateStack",
+        "cloudformation:CreateStackSet",
+        "cloudformation:DeleteStack",
+        "cloudformation:DescribeStackResource",
+        "cloudformation:DescribeStackResources",
+        "cloudformation:DescribeStacks",
+        "cloudformation:ListStackResources",
+        "cloudformation:ListStacks"
+      ],
+      "Resource": "*"
+    },
     {
       "Sid": "IAMPermissions",
       "Effect": "Allow",
@@ -240,7 +172,70 @@ AWS 开源博客上的这篇link:https://aws.amazon.com/blogs/opensource/managin
         "iam:ListRoles",
         "iam:ListRoleTags",
         "iam:PassRole",
-        "iam:RemoveRoleFromInstanceProfile"
+        "iam:RemoveRoleFromInstanceProfile",
+        "iam:TagRole"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "KMSPermissions",
+      "Effect": "Allow",
+      "Action": "kms:ListKeys",
+      "Resource": "*"
+    },
+    {
+      "Sid": "EKSPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "eks:CreateCluster",
+        "eks:CreateFargateProfile",
+        "eks:CreateNodegroup",
+        "eks:DeleteCluster",
+        "eks:DeleteFargateProfile",
+        "eks:DeleteNodegroup",
+        "eks:DescribeAddon",
+        "eks:DescribeCluster",
+        "eks:DescribeFargateProfile",
+        "eks:DescribeNodegroup",
+        "eks:DescribeUpdate",
+        "eks:ListClusters",
+        "eks:ListFargateProfiles",
+        "eks:ListNodegroups",
+        "eks:ListTagsForResource",
+        "eks:ListUpdates",
+        "eks:TagResource",
+        "eks:UntagResource",
+        "eks:UpdateClusterConfig",
+        "eks:UpdateClusterVersion",
+        "eks:UpdateNodegroupConfig",
+        "eks:UpdateNodegroupVersion"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "VPCPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:AssociateRouteTable",
+        "ec2:AttachInternetGateway",
+        "ec2:CreateInternetGateway",
+        "ec2:CreateRoute",
+        "ec2:CreateRouteTable",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateSubnet",
+        "ec2:CreateVpc",
+        "ec2:DeleteInternetGateway",
+        "ec2:DeleteRoute",
+        "ec2:DeleteRouteTable",
+        "ec2:DeleteSubnet",
+        "ec2:DeleteTags",
+        "ec2:DeleteVpc",
+        "ec2:DescribeVpcs",
+        "ec2:DetachInternetGateway",
+        "ec2:DisassociateRouteTable",
+        "ec2:ModifySubnetAttribute",
+        "ec2:ModifyVpcAttribute",
+        "ec2:ReplaceRoute"
       ],
       "Resource": "*"
     }
@@ -274,39 +269,30 @@ arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
 arn:aws:iam::aws:policy/AmazonEKSServicePolicy
 ----
 
-=== VPC 权限
+=== EBS CSI Driver addon Permissions
 
-这些是 Rancher 创建虚拟私有云 (VPC) 和相关资源所需的权限。
+The following are the required permissions for installing the Amazon EBS CSI Driver add-on.
 
 [,json]
 ----
 {
   "Version": "2012-10-17",
   "Statement": [
     {
-      "Sid": "VPCPermissions",
       "Effect": "Allow",
       "Action": [
-        "ec2:ReplaceRoute",
-        "ec2:ModifyVpcAttribute",
-        "ec2:ModifySubnetAttribute",
-        "ec2:DisassociateRouteTable",
-        "ec2:DetachInternetGateway",
-        "ec2:DescribeVpcs",
-        "ec2:DeleteVpc",
-        "ec2:DeleteTags",
-        "ec2:DeleteSubnet",
-        "ec2:DeleteRouteTable",
-        "ec2:DeleteRoute",
-        "ec2:DeleteInternetGateway",
-        "ec2:CreateVpc",
-        "ec2:CreateSubnet",
-        "ec2:CreateSecurityGroup",
-        "ec2:CreateRouteTable",
-        "ec2:CreateRoute",
-        "ec2:CreateInternetGateway",
-        "ec2:AttachInternetGateway",
-        "ec2:AssociateRouteTable"
+        "eks:AssociateIdentityProviderConfig",
+        "eks:CreateAddon",
+        "eks:DeleteAddon",
+        "eks:DescribeAddonConfiguration",
+        "eks:DescribeAddonVersions",
+        "eks:DescribeIdentityProviderConfig",
+        "eks:ListAddons",
+        "eks:ListIdentityProviderConfigs",
+        "eks:UpdateAddon",
+        "iam:CreateOpenIDConnectProvider",
+        "iam:ListOpenIDConnectProviders",
+        "sts:AssumeRoleWithWebIdentity"
       ],
       "Resource": "*"
     }

diff --git a/versions/v2.8/modules/en/pages/cluster-deployment/hosted-kubernetes/eks/eks.adoc b/versions/v2.8/modules/en/pages/cluster-deployment/hosted-kubernetes/eks/eks.adoc
@@ -102,113 +102,114 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
 [,json]
 ----
 {
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Sid": "EC2Permissions",
-            "Effect": "Allow",
-            "Action": [
-                "ec2:RunInstances",
-                "ec2:RevokeSecurityGroupIngress",
-                "ec2:RevokeSecurityGroupEgress",
-                "ec2:DescribeInstanceTypes",
-                "ec2:DescribeRegions",
-                "ec2:DescribeVpcs",
-                "ec2:DescribeTags",
-                "ec2:DescribeSubnets",
-                "ec2:DescribeSecurityGroups",
-                "ec2:DescribeRouteTables",
-                "ec2:DescribeLaunchTemplateVersions",
-                "ec2:DescribeLaunchTemplates",
-                "ec2:DescribeKeyPairs",
-                "ec2:DescribeInternetGateways",
-                "ec2:DescribeImages",
-                "ec2:DescribeAvailabilityZones",
-                "ec2:DescribeAccountAttributes",
-                "ec2:DeleteTags",
-                "ec2:DeleteLaunchTemplateVersions",
-                "ec2:DeleteLaunchTemplate",
-                "ec2:DeleteSecurityGroup",
-                "ec2:DeleteKeyPair",
-                "ec2:CreateTags",
-                "ec2:CreateSecurityGroup",
-                "ec2:CreateLaunchTemplateVersion",
-                "ec2:CreateLaunchTemplate",
-                "ec2:CreateKeyPair",
-                "ec2:AuthorizeSecurityGroupIngress",
-                "ec2:AuthorizeSecurityGroupEgress"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "CloudFormationPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "cloudformation:ListStacks",
-                "cloudformation:ListStackResources",
-                "cloudformation:DescribeStacks",
-                "cloudformation:DescribeStackResources",
-                "cloudformation:DescribeStackResource",
-                "cloudformation:DeleteStack",
-                "cloudformation:CreateStackSet",
-                "cloudformation:CreateStack"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "IAMPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "iam:PassRole",
-                "iam:ListRoles",
-                "iam:ListRoleTags",
-                "iam:ListInstanceProfilesForRole",
-                "iam:ListInstanceProfiles",
-                "iam:ListAttachedRolePolicies",
-                "iam:GetRole",
-                "iam:GetInstanceProfile",
-                "iam:DetachRolePolicy",
-                "iam:DeleteRole",
-                "iam:CreateRole",
-                "iam:AttachRolePolicy"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "KMSPermissions",
-            "Effect": "Allow",
-            "Action": "kms:ListKeys",
-            "Resource": "*"
-        },
-        {
-            "Sid": "EKSPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "eks:UpdateNodegroupVersion",
-                "eks:UpdateNodegroupConfig",
-                "eks:UpdateClusterVersion",
-                "eks:UpdateClusterConfig",
-                "eks:UntagResource",
-                "eks:TagResource",
-                "eks:ListUpdates",
-                "eks:ListTagsForResource",
-                "eks:ListNodegroups",
-                "eks:ListFargateProfiles",
-                "eks:ListClusters",
-                "eks:DescribeUpdate",
-                "eks:DescribeNodegroup",
-                "eks:DescribeFargateProfile",
-                "eks:DescribeCluster",
-                "eks:DeleteNodegroup",
-                "eks:DeleteFargateProfile",
-                "eks:DeleteCluster",
-                "eks:CreateNodegroup",
-                "eks:CreateFargateProfile",
-                "eks:CreateCluster"
-            ],
-            "Resource": "*"
-        }
-    ]
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "EC2Permissions",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:AuthorizeSecurityGroupEgress",
+        "ec2:AuthorizeSecurityGroupIngress",
+        "ec2:CreateKeyPair",
+        "ec2:CreateLaunchTemplate",
+        "ec2:CreateLaunchTemplateVersion",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateTags",
+        "ec2:DeleteKeyPair",
+        "ec2:DeleteLaunchTemplate",
+        "ec2:DeleteLaunchTemplateVersions",
+        "ec2:DeleteSecurityGroup",
+        "ec2:DeleteTags",
+        "ec2:DescribeAccountAttributes",
+        "ec2:DescribeAvailabilityZones",
+        "ec2:DescribeImages",
+        "ec2:DescribeInternetGateways",
+        "ec2:DescribeInstanceTypes",
+        "ec2:DescribeKeyPairs",
+        "ec2:DescribeLaunchTemplateVersions",
+        "ec2:DescribeLaunchTemplates",
+        "ec2:DescribeRegions",
+        "ec2:DescribeRouteTables",
+        "ec2:DescribeSecurityGroups",
+        "ec2:DescribeSubnets",
+        "ec2:DescribeTags",
+        "ec2:DescribeVpcs",
+        "ec2:RevokeSecurityGroupEgress",
+        "ec2:RevokeSecurityGroupIngress",
+        "ec2:RunInstances"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "CloudFormationPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "cloudformation:CreateStack",
+        "cloudformation:CreateStackSet",
+        "cloudformation:DeleteStack",
+        "cloudformation:DescribeStackResource",
+        "cloudformation:DescribeStackResources",
+        "cloudformation:DescribeStacks",
+        "cloudformation:ListStackResources",
+        "cloudformation:ListStacks"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "IAMPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "iam:AttachRolePolicy",
+        "iam:CreateRole",
+        "iam:DetachRolePolicy",
+        "iam:DeleteRole",
+        "iam:GetRole",
+        "iam:GetInstanceProfile",
+        "iam:ListAttachedRolePolicies",
+        "iam:ListInstanceProfilesForRole",
+        "iam:ListInstanceProfiles",
+        "iam:ListRoles",
+        "iam:ListRoleTags",
+        "iam:PassRole"
+        "iam:TagRole"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "KMSPermissions",
+      "Effect": "Allow",
+      "Action": "kms:ListKeys",
+      "Resource": "*"
+    },
+    {
+      "Sid": "EKSPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "eks:CreateCluster",
+        "eks:CreateFargateProfile",
+        "eks:CreateNodegroup",
+        "eks:DeleteCluster",
+        "eks:DeleteFargateProfile",
+        "eks:DeleteNodegroup",
+        "eks:DescribeCluster",
+        "eks:DescribeFargateProfile",
+        "eks:DescribeNodegroup",
+        "eks:DescribeUpdate",
+        "eks:ListClusters",
+        "eks:ListFargateProfiles",
+        "eks:ListNodegroups",
+        "eks:ListTagsForResource",
+        "eks:ListUpdates",
+        "eks:TagResource",
+        "eks:UntagResource",
+        "eks:UpdateClusterConfig",
+        "eks:UpdateClusterVersion",
+        "eks:UpdateNodegroupConfig",
+        "eks:UpdateNodegroupVersion"
+      ],
+      "Resource": "*"
+    }
+  ]
 }
 ----
 
@@ -241,7 +242,8 @@ These are permissions that are needed during EKS cluster creation, so Rancher ca
         "iam:ListRoles",
         "iam:ListRoleTags",
         "iam:PassRole",
-        "iam:RemoveRoleFromInstanceProfile"
+        "iam:RemoveRoleFromInstanceProfile",
+        "iam:TagRole"
       ],
       "Resource": "*"
     }
@@ -288,26 +290,26 @@ These are permissions that are needed by Rancher to create a Virtual Private Clo
       "Sid": "VPCPermissions",
       "Effect": "Allow",
       "Action": [
-        "ec2:ReplaceRoute",
-        "ec2:ModifyVpcAttribute",
-        "ec2:ModifySubnetAttribute",
-        "ec2:DisassociateRouteTable",
-        "ec2:DetachInternetGateway",
-        "ec2:DescribeVpcs",
-        "ec2:DeleteVpc",
-        "ec2:DeleteTags",
-        "ec2:DeleteSubnet",
-        "ec2:DeleteRouteTable",
-        "ec2:DeleteRoute",
-        "ec2:DeleteInternetGateway",
-        "ec2:CreateVpc",
-        "ec2:CreateSubnet",
-        "ec2:CreateSecurityGroup",
-        "ec2:CreateRouteTable",
-        "ec2:CreateRoute",
-        "ec2:CreateInternetGateway",
+        "ec2:AssociateRouteTable",
         "ec2:AttachInternetGateway",
-        "ec2:AssociateRouteTable"
+        "ec2:CreateInternetGateway",
+        "ec2:CreateRoute",
+        "ec2:CreateRouteTable",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateSubnet",
+        "ec2:CreateVpc",
+        "ec2:DeleteInternetGateway",
+        "ec2:DeleteRoute",
+        "ec2:DeleteRouteTable",
+        "ec2:DeleteSubnet",
+        "ec2:DeleteTags",
+        "ec2:DeleteVpc",
+        "ec2:DescribeVpcs",
+        "ec2:DetachInternetGateway",
+        "ec2:DisassociateRouteTable",
+        "ec2:ModifySubnetAttribute",
+        "ec2:ModifyVpcAttribute",
+        "ec2:ReplaceRoute"
       ],
       "Resource": "*"
     }

diff --git a/versions/v2.8/modules/zh/pages/cluster-deployment/hosted-kubernetes/eks/eks.adoc b/versions/v2.8/modules/zh/pages/cluster-deployment/hosted-kubernetes/eks/eks.adoc
@@ -102,112 +102,114 @@ AWS 开源博客上的这篇link:https://aws.amazon.com/blogs/opensource/managin
 [,json]
 ----
 {
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Sid": "EC2Permissions",
-            "Effect": "Allow",
-            "Action": [
-                "ec2:RunInstances",
-                "ec2:RevokeSecurityGroupIngress",
-                "ec2:RevokeSecurityGroupEgress",
-                "ec2:DescribeInstanceTypes",
-                "ec2:DescribeRegions",
-                "ec2:DescribeVpcs",
-                "ec2:DescribeTags",
-                "ec2:DescribeSubnets",
-                "ec2:DescribeSecurityGroups",
-                "ec2:DescribeRouteTables",
-                "ec2:DescribeLaunchTemplateVersions",
-                "ec2:DescribeLaunchTemplates",
-                "ec2:DescribeKeyPairs",
-                "ec2:DescribeInternetGateways",
-                "ec2:DescribeImages",
-                "ec2:DescribeAvailabilityZones",
-                "ec2:DescribeAccountAttributes",
-                "ec2:DeleteTags",
-                "ec2:DeleteLaunchTemplate",
-                "ec2:DeleteSecurityGroup",
-                "ec2:DeleteKeyPair",
-                "ec2:CreateTags",
-                "ec2:CreateSecurityGroup",
-                "ec2:CreateLaunchTemplateVersion",
-                "ec2:CreateLaunchTemplate",
-                "ec2:CreateKeyPair",
-                "ec2:AuthorizeSecurityGroupIngress",
-                "ec2:AuthorizeSecurityGroupEgress"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "CloudFormationPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "cloudformation:ListStacks",
-                "cloudformation:ListStackResources",
-                "cloudformation:DescribeStacks",
-                "cloudformation:DescribeStackResources",
-                "cloudformation:DescribeStackResource",
-                "cloudformation:DeleteStack",
-                "cloudformation:CreateStackSet",
-                "cloudformation:CreateStack"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "IAMPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "iam:PassRole",
-                "iam:ListRoles",
-                "iam:ListRoleTags",
-                "iam:ListInstanceProfilesForRole",
-                "iam:ListInstanceProfiles",
-                "iam:ListAttachedRolePolicies",
-                "iam:GetRole",
-                "iam:GetInstanceProfile",
-                "iam:DetachRolePolicy",
-                "iam:DeleteRole",
-                "iam:CreateRole",
-                "iam:AttachRolePolicy"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "KMSPermissions",
-            "Effect": "Allow",
-            "Action": "kms:ListKeys",
-            "Resource": "*"
-        },
-        {
-            "Sid": "EKSPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "eks:UpdateNodegroupVersion",
-                "eks:UpdateNodegroupConfig",
-                "eks:UpdateClusterVersion",
-                "eks:UpdateClusterConfig",
-                "eks:UntagResource",
-                "eks:TagResource",
-                "eks:ListUpdates",
-                "eks:ListTagsForResource",
-                "eks:ListNodegroups",
-                "eks:ListFargateProfiles",
-                "eks:ListClusters",
-                "eks:DescribeUpdate",
-                "eks:DescribeNodegroup",
-                "eks:DescribeFargateProfile",
-                "eks:DescribeCluster",
-                "eks:DeleteNodegroup",
-                "eks:DeleteFargateProfile",
-                "eks:DeleteCluster",
-                "eks:CreateNodegroup",
-                "eks:CreateFargateProfile",
-                "eks:CreateCluster"
-            ],
-            "Resource": "*"
-        }
-    ]
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "EC2Permissions",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:AuthorizeSecurityGroupEgress",
+        "ec2:AuthorizeSecurityGroupIngress",
+        "ec2:CreateKeyPair",
+        "ec2:CreateLaunchTemplate",
+        "ec2:CreateLaunchTemplateVersion",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateTags",
+        "ec2:DeleteKeyPair",
+        "ec2:DeleteLaunchTemplate",
+        "ec2:DeleteLaunchTemplateVersions",
+        "ec2:DeleteSecurityGroup",
+        "ec2:DeleteTags",
+        "ec2:DescribeAccountAttributes",
+        "ec2:DescribeAvailabilityZones",
+        "ec2:DescribeImages",
+        "ec2:DescribeInternetGateways",
+        "ec2:DescribeInstanceTypes",
+        "ec2:DescribeKeyPairs",
+        "ec2:DescribeLaunchTemplateVersions",
+        "ec2:DescribeLaunchTemplates",
+        "ec2:DescribeRegions",
+        "ec2:DescribeRouteTables",
+        "ec2:DescribeSecurityGroups",
+        "ec2:DescribeSubnets",
+        "ec2:DescribeTags",
+        "ec2:DescribeVpcs",
+        "ec2:RevokeSecurityGroupEgress",
+        "ec2:RevokeSecurityGroupIngress",
+        "ec2:RunInstances"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "CloudFormationPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "cloudformation:CreateStack",
+        "cloudformation:CreateStackSet",
+        "cloudformation:DeleteStack",
+        "cloudformation:DescribeStackResource",
+        "cloudformation:DescribeStackResources",
+        "cloudformation:DescribeStacks",
+        "cloudformation:ListStackResources",
+        "cloudformation:ListStacks"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "IAMPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "iam:AttachRolePolicy",
+        "iam:CreateRole",
+        "iam:DetachRolePolicy",
+        "iam:DeleteRole",
+        "iam:GetRole",
+        "iam:GetInstanceProfile",
+        "iam:ListAttachedRolePolicies",
+        "iam:ListInstanceProfilesForRole",
+        "iam:ListInstanceProfiles",
+        "iam:ListRoles",
+        "iam:ListRoleTags",
+        "iam:PassRole"
+        "iam:TagRole"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "KMSPermissions",
+      "Effect": "Allow",
+      "Action": "kms:ListKeys",
+      "Resource": "*"
+    },
+    {
+      "Sid": "EKSPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "eks:CreateCluster",
+        "eks:CreateFargateProfile",
+        "eks:CreateNodegroup",
+        "eks:DeleteCluster",
+        "eks:DeleteFargateProfile",
+        "eks:DeleteNodegroup",
+        "eks:DescribeCluster",
+        "eks:DescribeFargateProfile",
+        "eks:DescribeNodegroup",
+        "eks:DescribeUpdate",
+        "eks:ListClusters",
+        "eks:ListFargateProfiles",
+        "eks:ListNodegroups",
+        "eks:ListTagsForResource",
+        "eks:ListUpdates",
+        "eks:TagResource",
+        "eks:UntagResource",
+        "eks:UpdateClusterConfig",
+        "eks:UpdateClusterVersion",
+        "eks:UpdateNodegroupConfig",
+        "eks:UpdateNodegroupVersion"
+      ],
+      "Resource": "*"
+    }
+  ]
 }
 ----
 
@@ -240,7 +242,8 @@ AWS 开源博客上的这篇link:https://aws.amazon.com/blogs/opensource/managin
         "iam:ListRoles",
         "iam:ListRoleTags",
         "iam:PassRole",
-        "iam:RemoveRoleFromInstanceProfile"
+        "iam:RemoveRoleFromInstanceProfile",
+        "iam:TagRole"
       ],
       "Resource": "*"
     }
@@ -287,26 +290,26 @@ arn:aws:iam::aws:policy/AmazonEKSServicePolicy
       "Sid": "VPCPermissions",
       "Effect": "Allow",
       "Action": [
-        "ec2:ReplaceRoute",
-        "ec2:ModifyVpcAttribute",
-        "ec2:ModifySubnetAttribute",
-        "ec2:DisassociateRouteTable",
-        "ec2:DetachInternetGateway",
-        "ec2:DescribeVpcs",
-        "ec2:DeleteVpc",
-        "ec2:DeleteTags",
-        "ec2:DeleteSubnet",
-        "ec2:DeleteRouteTable",
-        "ec2:DeleteRoute",
-        "ec2:DeleteInternetGateway",
-        "ec2:CreateVpc",
-        "ec2:CreateSubnet",
-        "ec2:CreateSecurityGroup",
-        "ec2:CreateRouteTable",
-        "ec2:CreateRoute",
-        "ec2:CreateInternetGateway",
+        "ec2:AssociateRouteTable",
         "ec2:AttachInternetGateway",
-        "ec2:AssociateRouteTable"
+        "ec2:CreateInternetGateway",
+        "ec2:CreateRoute",
+        "ec2:CreateRouteTable",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateSubnet",
+        "ec2:CreateVpc",
+        "ec2:DeleteInternetGateway",
+        "ec2:DeleteRoute",
+        "ec2:DeleteRouteTable",
+        "ec2:DeleteSubnet",
+        "ec2:DeleteTags",
+        "ec2:DeleteVpc",
+        "ec2:DescribeVpcs",
+        "ec2:DetachInternetGateway",
+        "ec2:DisassociateRouteTable",
+        "ec2:ModifySubnetAttribute",
+        "ec2:ModifyVpcAttribute",
+        "ec2:ReplaceRoute"
       ],
       "Resource": "*"
     }

diff --git a/versions/v2.9/modules/en/pages/cluster-deployment/hosted-kubernetes/eks/eks.adoc b/versions/v2.9/modules/en/pages/cluster-deployment/hosted-kubernetes/eks/eks.adoc
@@ -85,7 +85,7 @@ This https://aws.amazon.com/blogs/opensource/managing-eks-clusters-rancher/[tuto
 
 == Minimum EKS Permissions
 
-These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. You'll need additional permissions for Rancher to provision the `Service Role` and `VPC` resources. If you create these resources *before* you create the cluster, they'll be available when you configure the cluster.
+These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. These permissions allow Rancher to create the Service Role and Virtual Private Cloud (VPC) resources on the users' behalf, if necessary.
 
 [NOTE]
 ====
@@ -96,140 +96,68 @@ In EKS v1.23 and above, you must use the out-of-tree drivers for EBS-backed volu
 |===
 | Resource | Description
 
-| Service Role
-| Provides permissions that allow Kubernetes to manage resources on your behalf. Rancher can create the service role with the following <<_service_role_permissions,Service Role Permissions>>.
-
-| VPC
-| Provides isolated network resources utilised by EKS and worker nodes. Rancher can create the VPC resources with the following <<_vpc_permissions,VPC Permissions>>.
-
 | EBS CSI Driver add-on
 | Provides permissions that allow Kubernetes to interact with EBS and configure the cluster to enable the add-on (required for EKS v1.23 and above). Rancher can install the add-on with the following <<_ebs_csi_driver_addon_permissions,EBS CSI Driver addon Permissions>>.
 |===
 
 Resource targeting uses `*` as the ARN of many of the resources created cannot be known before creating the EKS cluster in Rancher.
 
-[,json]
-----
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Sid": "EC2Permissions",
-            "Effect": "Allow",
-            "Action": [
-                "ec2:RunInstances",
-                "ec2:RevokeSecurityGroupIngress",
-                "ec2:RevokeSecurityGroupEgress",
-                "ec2:DescribeInstanceTypes",
-                "ec2:DescribeRegions",
-                "ec2:DescribeVpcs",
-                "ec2:DescribeTags",
-                "ec2:DescribeSubnets",
-                "ec2:DescribeSecurityGroups",
-                "ec2:DescribeRouteTables",
-                "ec2:DescribeLaunchTemplateVersions",
-                "ec2:DescribeLaunchTemplates",
-                "ec2:DescribeKeyPairs",
-                "ec2:DescribeInternetGateways",
-                "ec2:DescribeImages",
-                "ec2:DescribeAvailabilityZones",
-                "ec2:DescribeAccountAttributes",
-                "ec2:DeleteTags",
-                "ec2:DeleteLaunchTemplateVersions",
-                "ec2:DeleteLaunchTemplate",
-                "ec2:DeleteSecurityGroup",
-                "ec2:DeleteKeyPair",
-                "ec2:CreateTags",
-                "ec2:CreateSecurityGroup",
-                "ec2:CreateLaunchTemplateVersion",
-                "ec2:CreateLaunchTemplate",
-                "ec2:CreateKeyPair",
-                "ec2:AuthorizeSecurityGroupIngress",
-                "ec2:AuthorizeSecurityGroupEgress"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "CloudFormationPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "cloudformation:ListStacks",
-                "cloudformation:ListStackResources",
-                "cloudformation:DescribeStacks",
-                "cloudformation:DescribeStackResources",
-                "cloudformation:DescribeStackResource",
-                "cloudformation:DeleteStack",
-                "cloudformation:CreateStackSet",
-                "cloudformation:CreateStack"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "IAMPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "iam:PassRole",
-                "iam:ListRoles",
-                "iam:ListRoleTags",
-                "iam:ListInstanceProfilesForRole",
-                "iam:ListInstanceProfiles",
-                "iam:ListAttachedRolePolicies",
-                "iam:GetRole",
-                "iam:GetInstanceProfile",
-                "iam:DetachRolePolicy",
-                "iam:DeleteRole",
-                "iam:CreateRole",
-                "iam:AttachRolePolicy"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "KMSPermissions",
-            "Effect": "Allow",
-            "Action": "kms:ListKeys",
-            "Resource": "*"
-        },
-        {
-            "Sid": "EKSPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "eks:UpdateNodegroupVersion",
-                "eks:UpdateNodegroupConfig",
-                "eks:UpdateClusterVersion",
-                "eks:UpdateClusterConfig",
-                "eks:UntagResource",
-                "eks:TagResource",
-                "eks:ListUpdates",
-                "eks:ListTagsForResource",
-                "eks:ListNodegroups",
-                "eks:ListFargateProfiles",
-                "eks:ListClusters",
-                "eks:DescribeUpdate",
-                "eks:DescribeNodegroup",
-                "eks:DescribeFargateProfile",
-                "eks:DescribeCluster",
-                "eks:DeleteNodegroup",
-                "eks:DeleteFargateProfile",
-                "eks:DeleteCluster",
-                "eks:CreateNodegroup",
-                "eks:CreateFargateProfile",
-                "eks:CreateCluster"
-            ],
-            "Resource": "*"
-        }
-    ]
-}
-----
-
-=== Service Role Permissions
-
-These are permissions that are needed during EKS cluster creation, so Rancher can create a service role on the users' behalf.
-
 [,json]
 ----
 {
   "Version": "2012-10-17",
   "Statement": [
+    {
+      "Sid": "EC2Permissions",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:AuthorizeSecurityGroupEgress",
+        "ec2:AuthorizeSecurityGroupIngress",
+        "ec2:CreateKeyPair",
+        "ec2:CreateLaunchTemplate",
+        "ec2:CreateLaunchTemplateVersion",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateTags",
+        "ec2:DeleteKeyPair",
+        "ec2:DeleteLaunchTemplate",
+        "ec2:DeleteLaunchTemplateVersions",
+        "ec2:DeleteSecurityGroup",
+        "ec2:DeleteTags",
+        "ec2:DescribeAccountAttributes",
+        "ec2:DescribeAvailabilityZones",
+        "ec2:DescribeImages",
+        "ec2:DescribeInternetGateways",
+        "ec2:DescribeInstanceTypes",
+        "ec2:DescribeKeyPairs",
+        "ec2:DescribeLaunchTemplateVersions",
+        "ec2:DescribeLaunchTemplates",
+        "ec2:DescribeRegions",
+        "ec2:DescribeRouteTables",
+        "ec2:DescribeSecurityGroups",
+        "ec2:DescribeSubnets",
+        "ec2:DescribeTags",
+        "ec2:DescribeVpcs",
+        "ec2:RevokeSecurityGroupEgress",
+        "ec2:RevokeSecurityGroupIngress",
+        "ec2:RunInstances"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "CloudFormationPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "cloudformation:CreateStack",
+        "cloudformation:CreateStackSet",
+        "cloudformation:DeleteStack",
+        "cloudformation:DescribeStackResource",
+        "cloudformation:DescribeStackResources",
+        "cloudformation:DescribeStacks",
+        "cloudformation:ListStackResources",
+        "cloudformation:ListStacks"
+      ],
+      "Resource": "*"
+    },
     {
       "Sid": "IAMPermissions",
       "Effect": "Allow",
@@ -250,7 +178,70 @@ These are permissions that are needed during EKS cluster creation, so Rancher ca
         "iam:ListRoles",
         "iam:ListRoleTags",
         "iam:PassRole",
-        "iam:RemoveRoleFromInstanceProfile"
+        "iam:RemoveRoleFromInstanceProfile",
+        "iam:TagRole"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "KMSPermissions",
+      "Effect": "Allow",
+      "Action": "kms:ListKeys",
+      "Resource": "*"
+    },
+    {
+      "Sid": "EKSPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "eks:CreateCluster",
+        "eks:CreateFargateProfile",
+        "eks:CreateNodegroup",
+        "eks:DeleteCluster",
+        "eks:DeleteFargateProfile",
+        "eks:DeleteNodegroup",
+        "eks:DescribeAddon",
+        "eks:DescribeCluster",
+        "eks:DescribeFargateProfile",
+        "eks:DescribeNodegroup",
+        "eks:DescribeUpdate",
+        "eks:ListClusters",
+        "eks:ListFargateProfiles",
+        "eks:ListNodegroups",
+        "eks:ListTagsForResource",
+        "eks:ListUpdates",
+        "eks:TagResource",
+        "eks:UntagResource",
+        "eks:UpdateClusterConfig",
+        "eks:UpdateClusterVersion",
+        "eks:UpdateNodegroupConfig",
+        "eks:UpdateNodegroupVersion"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "VPCPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:AssociateRouteTable",
+        "ec2:AttachInternetGateway",
+        "ec2:CreateInternetGateway",
+        "ec2:CreateRoute",
+        "ec2:CreateRouteTable",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateSubnet",
+        "ec2:CreateVpc",
+        "ec2:DeleteInternetGateway",
+        "ec2:DeleteRoute",
+        "ec2:DeleteRouteTable",
+        "ec2:DeleteSubnet",
+        "ec2:DeleteTags",
+        "ec2:DeleteVpc",
+        "ec2:DescribeVpcs",
+        "ec2:DetachInternetGateway",
+        "ec2:DisassociateRouteTable",
+        "ec2:ModifySubnetAttribute",
+        "ec2:ModifyVpcAttribute",
+        "ec2:ReplaceRoute"
       ],
       "Resource": "*"
     }
@@ -284,84 +275,37 @@ arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
 arn:aws:iam::aws:policy/AmazonEKSServicePolicy
 ----
 
-=== VPC Permissions
+=== EBS CSI Driver addon Permissions
 
-These are permissions that are needed by Rancher to create a Virtual Private Cloud (VPC) and associated resources.
+The following are the required permissions for installing the Amazon EBS CSI Driver add-on.
 
 [,json]
 ----
 {
   "Version": "2012-10-17",
   "Statement": [
     {
-      "Sid": "VPCPermissions",
       "Effect": "Allow",
       "Action": [
-        "ec2:ReplaceRoute",
-        "ec2:ModifyVpcAttribute",
-        "ec2:ModifySubnetAttribute",
-        "ec2:DisassociateRouteTable",
-        "ec2:DetachInternetGateway",
-        "ec2:DescribeVpcs",
-        "ec2:DeleteVpc",
-        "ec2:DeleteTags",
-        "ec2:DeleteSubnet",
-        "ec2:DeleteRouteTable",
-        "ec2:DeleteRoute",
-        "ec2:DeleteInternetGateway",
-        "ec2:CreateVpc",
-        "ec2:CreateSubnet",
-        "ec2:CreateSecurityGroup",
-        "ec2:CreateRouteTable",
-        "ec2:CreateRoute",
-        "ec2:CreateInternetGateway",
-        "ec2:AttachInternetGateway",
-        "ec2:AssociateRouteTable"
+        "eks:AssociateIdentityProviderConfig",
+        "eks:CreateAddon",
+        "eks:DeleteAddon",
+        "eks:DescribeAddonConfiguration",
+        "eks:DescribeAddonVersions",
+        "eks:DescribeIdentityProviderConfig",
+        "eks:ListAddons",
+        "eks:ListIdentityProviderConfigs",
+        "eks:UpdateAddon",
+        "iam:CreateOpenIDConnectProvider",
+        "iam:ListOpenIDConnectProviders",
+        "sts:AssumeRoleWithWebIdentity"
       ],
       "Resource": "*"
     }
   ]
 }
 ----
 
-=== EBS CSI Driver addon Permissions
-
-The following are the required permissions for installing the Amazon EBS CSI Driver add-on.
-
-[,json]
-----
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Action": [
-                "iam:GetRole",
-                "eks:DescribeAddonConfiguration",
-                "eks:UpdateAddon",
-                "eks:ListAddons",
-                "iam:CreateRole",
-                "iam:AttachRolePolicy",
-                "eks:DescribeAddon",
-                "iam:CreateOpenIDConnectProvider",
-                "iam:PassRole",
-                "eks:DescribeIdentityProviderConfig",
-                "eks:DeleteAddon",
-                "iam:ListOpenIDConnectProviders",
-                "iam:ListAttachedRolePolicies",
-                "eks:CreateAddon",
-                "eks:DescribeCluster",
-                "eks:DescribeAddonVersions",
-                "sts:AssumeRoleWithWebIdentity",
-                "eks:AssociateIdentityProviderConfig",
-                "eks:ListIdentityProviderConfigs"
-            ],
-            "Resource": "*"
-        }
-    ]
-}
-----
-
 == Syncing
 
 The EKS provisioner can synchronize the state of an EKS cluster between Rancher and the provider. For an in-depth technical explanation of how this works, see xref:cluster-deployment/hosted-kubernetes/sync-clusters.adoc[Syncing.]

diff --git a/versions/v2.9/modules/zh/pages/cluster-deployment/hosted-kubernetes/eks/eks.adoc b/versions/v2.9/modules/zh/pages/cluster-deployment/hosted-kubernetes/eks/eks.adoc
@@ -85,141 +85,73 @@ AWS 开源博客上的这篇link:https://aws.amazon.com/blogs/opensource/managin
 
 == 最小 EKS 权限
 
-这些是访问 Rancher EKS 驱动程序的全部功能所需的最低权限集。你需要 Rancher 的其他权限才能配置 `Service Role` 和 `VPC` 资源。如果你在创建集群**之前**创建了这些资源，你在配置集群时将可以使用这些资源。
+These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. These permissions allow Rancher to create the Service Role and Virtual Private Cloud (VPC) resources on the users' behalf, if necessary.
 
 |===
 | 资源 | 描述
 
 | 服务角色
 | 提供允许 Kubernetes 代表你管理资源的权限。Rancher 可以使用以下<<_服务角色权限,服务角色权限>>来创建服务角色。
-
-| VPC
-| 提供 EKS 和 Worker 节点使用的隔离网络资源。Rancher 使用以下 <<_vpc_权限,VPC 权限>>创建 VPC 资源。
 |===
 
 资源定位使用 `*` 作为在 Rancher 中创建 EKS 集群之前，无法已知创建的资源的名称（ARN）。
 
-[,json]
-----
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Sid": "EC2Permissions",
-            "Effect": "Allow",
-            "Action": [
-                "ec2:RunInstances",
-                "ec2:RevokeSecurityGroupIngress",
-                "ec2:RevokeSecurityGroupEgress",
-                "ec2:DescribeInstanceTypes",
-                "ec2:DescribeRegions",
-                "ec2:DescribeVpcs",
-                "ec2:DescribeTags",
-                "ec2:DescribeSubnets",
-                "ec2:DescribeSecurityGroups",
-                "ec2:DescribeRouteTables",
-                "ec2:DescribeLaunchTemplateVersions",
-                "ec2:DescribeLaunchTemplates",
-                "ec2:DescribeKeyPairs",
-                "ec2:DescribeInternetGateways",
-                "ec2:DescribeImages",
-                "ec2:DescribeAvailabilityZones",
-                "ec2:DescribeAccountAttributes",
-                "ec2:DeleteTags",
-                "ec2:DeleteLaunchTemplate",
-                "ec2:DeleteSecurityGroup",
-                "ec2:DeleteKeyPair",
-                "ec2:CreateTags",
-                "ec2:CreateSecurityGroup",
-                "ec2:CreateLaunchTemplateVersion",
-                "ec2:CreateLaunchTemplate",
-                "ec2:CreateKeyPair",
-                "ec2:AuthorizeSecurityGroupIngress",
-                "ec2:AuthorizeSecurityGroupEgress"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "CloudFormationPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "cloudformation:ListStacks",
-                "cloudformation:ListStackResources",
-                "cloudformation:DescribeStacks",
-                "cloudformation:DescribeStackResources",
-                "cloudformation:DescribeStackResource",
-                "cloudformation:DeleteStack",
-                "cloudformation:CreateStackSet",
-                "cloudformation:CreateStack"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "IAMPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "iam:PassRole",
-                "iam:ListRoles",
-                "iam:ListRoleTags",
-                "iam:ListInstanceProfilesForRole",
-                "iam:ListInstanceProfiles",
-                "iam:ListAttachedRolePolicies",
-                "iam:GetRole",
-                "iam:GetInstanceProfile",
-                "iam:DetachRolePolicy",
-                "iam:DeleteRole",
-                "iam:CreateRole",
-                "iam:AttachRolePolicy"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "KMSPermissions",
-            "Effect": "Allow",
-            "Action": "kms:ListKeys",
-            "Resource": "*"
-        },
-        {
-            "Sid": "EKSPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "eks:UpdateNodegroupVersion",
-                "eks:UpdateNodegroupConfig",
-                "eks:UpdateClusterVersion",
-                "eks:UpdateClusterConfig",
-                "eks:UntagResource",
-                "eks:TagResource",
-                "eks:ListUpdates",
-                "eks:ListTagsForResource",
-                "eks:ListNodegroups",
-                "eks:ListFargateProfiles",
-                "eks:ListClusters",
-                "eks:DescribeUpdate",
-                "eks:DescribeNodegroup",
-                "eks:DescribeFargateProfile",
-                "eks:DescribeCluster",
-                "eks:DeleteNodegroup",
-                "eks:DeleteFargateProfile",
-                "eks:DeleteCluster",
-                "eks:CreateNodegroup",
-                "eks:CreateFargateProfile",
-                "eks:CreateCluster"
-            ],
-            "Resource": "*"
-        }
-    ]
-}
-----
-
-=== 服务角色权限
-
-这些是 EKS 集群创建期间所需的权限，以便 Rancher 可以代表用户创建服务角色。
-
 [,json]
 ----
 {
   "Version": "2012-10-17",
   "Statement": [
+    {
+      "Sid": "EC2Permissions",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:AuthorizeSecurityGroupEgress",
+        "ec2:AuthorizeSecurityGroupIngress",
+        "ec2:CreateKeyPair",
+        "ec2:CreateLaunchTemplate",
+        "ec2:CreateLaunchTemplateVersion",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateTags",
+        "ec2:DeleteKeyPair",
+        "ec2:DeleteLaunchTemplate",
+        "ec2:DeleteLaunchTemplateVersions",
+        "ec2:DeleteSecurityGroup",
+        "ec2:DeleteTags",
+        "ec2:DescribeAccountAttributes",
+        "ec2:DescribeAvailabilityZones",
+        "ec2:DescribeImages",
+        "ec2:DescribeInternetGateways",
+        "ec2:DescribeInstanceTypes",
+        "ec2:DescribeKeyPairs",
+        "ec2:DescribeLaunchTemplateVersions",
+        "ec2:DescribeLaunchTemplates",
+        "ec2:DescribeRegions",
+        "ec2:DescribeRouteTables",
+        "ec2:DescribeSecurityGroups",
+        "ec2:DescribeSubnets",
+        "ec2:DescribeTags",
+        "ec2:DescribeVpcs",
+        "ec2:RevokeSecurityGroupEgress",
+        "ec2:RevokeSecurityGroupIngress",
+        "ec2:RunInstances"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "CloudFormationPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "cloudformation:CreateStack",
+        "cloudformation:CreateStackSet",
+        "cloudformation:DeleteStack",
+        "cloudformation:DescribeStackResource",
+        "cloudformation:DescribeStackResources",
+        "cloudformation:DescribeStacks",
+        "cloudformation:ListStackResources",
+        "cloudformation:ListStacks"
+      ],
+      "Resource": "*"
+    },
     {
       "Sid": "IAMPermissions",
       "Effect": "Allow",
@@ -240,7 +172,70 @@ AWS 开源博客上的这篇link:https://aws.amazon.com/blogs/opensource/managin
         "iam:ListRoles",
         "iam:ListRoleTags",
         "iam:PassRole",
-        "iam:RemoveRoleFromInstanceProfile"
+        "iam:RemoveRoleFromInstanceProfile",
+        "iam:TagRole"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "KMSPermissions",
+      "Effect": "Allow",
+      "Action": "kms:ListKeys",
+      "Resource": "*"
+    },
+    {
+      "Sid": "EKSPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "eks:CreateCluster",
+        "eks:CreateFargateProfile",
+        "eks:CreateNodegroup",
+        "eks:DeleteCluster",
+        "eks:DeleteFargateProfile",
+        "eks:DeleteNodegroup",
+        "eks:DescribeAddon",
+        "eks:DescribeCluster",
+        "eks:DescribeFargateProfile",
+        "eks:DescribeNodegroup",
+        "eks:DescribeUpdate",
+        "eks:ListClusters",
+        "eks:ListFargateProfiles",
+        "eks:ListNodegroups",
+        "eks:ListTagsForResource",
+        "eks:ListUpdates",
+        "eks:TagResource",
+        "eks:UntagResource",
+        "eks:UpdateClusterConfig",
+        "eks:UpdateClusterVersion",
+        "eks:UpdateNodegroupConfig",
+        "eks:UpdateNodegroupVersion"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "VPCPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:AssociateRouteTable",
+        "ec2:AttachInternetGateway",
+        "ec2:CreateInternetGateway",
+        "ec2:CreateRoute",
+        "ec2:CreateRouteTable",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateSubnet",
+        "ec2:CreateVpc",
+        "ec2:DeleteInternetGateway",
+        "ec2:DeleteRoute",
+        "ec2:DeleteRouteTable",
+        "ec2:DeleteSubnet",
+        "ec2:DeleteTags",
+        "ec2:DeleteVpc",
+        "ec2:DescribeVpcs",
+        "ec2:DetachInternetGateway",
+        "ec2:DisassociateRouteTable",
+        "ec2:ModifySubnetAttribute",
+        "ec2:ModifyVpcAttribute",
+        "ec2:ReplaceRoute"
       ],
       "Resource": "*"
     }
@@ -274,39 +269,30 @@ arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
 arn:aws:iam::aws:policy/AmazonEKSServicePolicy
 ----
 
-=== VPC 权限
+=== EBS CSI Driver addon Permissions
 
-这些是 Rancher 创建虚拟私有云 (VPC) 和相关资源所需的权限。
+The following are the required permissions for installing the Amazon EBS CSI Driver add-on.
 
 [,json]
 ----
 {
   "Version": "2012-10-17",
   "Statement": [
     {
-      "Sid": "VPCPermissions",
       "Effect": "Allow",
       "Action": [
-        "ec2:ReplaceRoute",
-        "ec2:ModifyVpcAttribute",
-        "ec2:ModifySubnetAttribute",
-        "ec2:DisassociateRouteTable",
-        "ec2:DetachInternetGateway",
-        "ec2:DescribeVpcs",
-        "ec2:DeleteVpc",
-        "ec2:DeleteTags",
-        "ec2:DeleteSubnet",
-        "ec2:DeleteRouteTable",
-        "ec2:DeleteRoute",
-        "ec2:DeleteInternetGateway",
-        "ec2:CreateVpc",
-        "ec2:CreateSubnet",
-        "ec2:CreateSecurityGroup",
-        "ec2:CreateRouteTable",
-        "ec2:CreateRoute",
-        "ec2:CreateInternetGateway",
-        "ec2:AttachInternetGateway",
-        "ec2:AssociateRouteTable"
+        "eks:AssociateIdentityProviderConfig",
+        "eks:CreateAddon",
+        "eks:DeleteAddon",
+        "eks:DescribeAddonConfiguration",
+        "eks:DescribeAddonVersions",
+        "eks:DescribeIdentityProviderConfig",
+        "eks:ListAddons",
+        "eks:ListIdentityProviderConfigs",
+        "eks:UpdateAddon",
+        "iam:CreateOpenIDConnectProvider",
+        "iam:ListOpenIDConnectProviders",
+        "sts:AssumeRoleWithWebIdentity"
       ],
       "Resource": "*"
     }