Cluster-api-provider-aws: Missing IAM Rights to create classic load balancer, master waiting to become ready

[dhemeier]

/kind bug

What steps did you take and what happened:
Followed all steps to create a basic cluster on aws. https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/master/docs/getting-started.md#setting-up-the-environment

What did you expect to happen:
The cluster should be up and running

Anything else you would like to add:
The master did not initialized because of a missing IAM Rule. To create the User I used following commands:

export AWS_REGION=eu-central-1
clusterawsadm alpha bootstrap create-stack

The resulting cluster stucks in machine creating, the log output displays the following:

I1129 18:11:14.288527       1 network.go:55] Reconcile network completed successfully
I1129 18:11:14.288588       1 bastion.go:47] Reconciling bastion host
I1129 18:11:14.339195       1 bastion.go:81] Reconcile bastion completed successfully
I1129 18:11:14.339243       1 loadbalancer.go:33] Reconciling load balancers
E1129 18:11:15.062921       1 controller.go:131] Error reconciling cluster object test1; unable to reconcile load balancers: failed to create classic load balancer: &{test1-apiserver  Internet-facing [subnet-XXXXXX] [sg-XXXXXX] [0xc000911b30] 0xc000911b60 map[kubernetes.io/cluster/test1:owned sigs.k8s.io/cluster-api-provider-aws/managed:true sigs.k8s.io/cluster-api-provider-aws/role:apiserver]}: AccessDenied: User: arn:aws:iam::XXXXXX:user/bootstrapper.cluster-api-provider-aws.sigs.k8s.io is not authorized to perform: iam:CreateServiceLinkedRole on resource: arn:aws:iam::XXXXXX:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing

After adding for testing IAMFullAccess to the created user bootstrapper.cluster-api-provider-aws.sigs.k8s.io, the cluster create worked for me.

Environment:

• Cluster-api-provider-aws version: v1.0.0-alpha.3
• Kubernetes version: (use kubectl version): v1.12.2
• OS: MacOS 10.14

[randomvariable]

/lifecycle active

[randomvariable]

/assign

[timothysc]

@chuckha can you please validate.

@vincepri add context on thoughts.

[chuckha]

@randomvariable is this still active?

[randomvariable]

Argh. Yes, sorry, I'll PR that tomorrow

[chuckha]

@randomvariable no worries if you don't have time, but any chance that PR is incoming? If you don't have time in the next few weeks I'd be more than happy to take this one over.

[randomvariable]

This is still happening. The testing is a bit annoying as it requires a completely fresh account each time.

[vincepri]

@randomvariable Can you elaborate on why this is happening on a fresh account? Is there something missing?

[randomvariable]

@vincepri Added an explanation in #489