Containers-roadmap: New EKS Region : Ningxia

[pahud]

Tell us about your request
New region support in Ningxia, China(cn-northwest-1)

Which service(s) is this request for?
Amazon EKS

Please add the support plan in the roadmap. Thanks.

[bnusunny]

+1

[jgleonard]

Is there a timeline associated with this yet?

[micacardillo]

We're ready to jump on testing it as soon as the preview is available.

[johnnyshields]

👍 Same here, eagerly awaiting developer preview

[gaochundong]

still coming soon?

[gyj0825]

At what stage is it currently?

[zhang-zhenqing]

when is EKS ready in aws china? is there a time line?

[groodt]

Any updates on this?

[fanxu]

Any update?

[icyxp]

Any updates on this?

[ranger-huang]

Any updates on this ?

[networkshb]

Any updates on this ?

[zhang-zhenqing]

Any updates on this ?

[groodt]

This must be close now! :) Any news?

[icyxp]

Just Shipped

[mikestef9]

Happy to announce that EKS is now generally available in the AWS Ningxia (cn-northwest-1) region!

• What's new post
• EKS documentation & AMIs

[groodt]

Thanks to you and the team for all the hard work @mikestef9

[groodt]

What's the service Principal name?

An error occurred: Invalid principal in policy: "SERVICE":"eks.amazonaws.cn"

[groodt]

If I try to create a test cluster in Ningxia, with a role that I know exists I get this error.

Role with $existing_role_arn, could not be assumed because it does not exist or the trusted entity is not correct

[mikestef9]

@groodt is the IAM role created in a China region? You can't use a non China IAM role in a China region

[groodt]

Yup, the role is in China.

[groodt]

Our role is in China.

ARN looks as follows:

arn: arn:aws-cn:iam::${accountid}:role/${rolename}

Trust relationship looks as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

The role has the following managed policies attached:

AmazonEKSServicePolicy

[mikestef9]

Hi @groodt would recommend you open a support ticket to further troubleshoot

[groodt]

Found the issue. We have a permission boundary on the role and needed to allow:

iam:ListAttachedRolePolicies

Works now! Apologies for any noise.