Eksctl: IAM Service Accounts error when using attachPolicy

[dewittcx]

What happened?
Recently, eksctl was updated to support IAM for service accounts. I followed the guide https://eksctl.io/usage/iamserviceaccounts/ and am using the cluster.yaml approach.

I receive the following error in CloudFormation during the LogicalId = Policy1 step:
Property PolicyName cannot be empty.

Here's part of the cluser.yaml:
iam:
withOIDC: true
serviceAccounts:

• metadata:
  name: cluster-autoscaler
  namespace: kube-system
  labels: {aws-usage: "cluster-ops"}
  attachPolicy: # inline policy can be defined along with attachPolicyARNs
  Version: "2012-10-17"
  Statement:
  
  
  
  • Effect: Allow
    
    Action:
    
    
    
    
    
    • "autoscaling:DescribeAutoScalingGroups"
    
    
    
    • "autoscaling:DescribeAutoScalingInstances"
    
    
    
    • "autoscaling:DescribeLaunchConfigurations"
    
    
    
    • "autoscaling:DescribeTags"
    
    
    
    • "autoscaling:SetDesiredCapacity"
    
    
    
    • "autoscaling:TerminateInstanceInAutoScalingGroup"
      
      
      Resource: '*'
    
    
    
  
  

What you expected to happen?
I expected no error and to have the cluster and iamserviceaccount to create successfully.

How to reproduce it?
I have attempted to deploy the cluster and iamserviceaccount resources by running the following commands:
eksctl create cluster -f clusters/cluster.yaml
eksctl create iamserviceaccount -f cluster.yaml --profile=xxxxxxxx --approve

Versions
Please paste in the output of these commands:

$ eksctl version
[i]  version.Info{BuiltAt:"", GitCommit:"", GitTag:"0.5.2"}
$ kubectl version
Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.3", GitCommit:"2d3c76f9091b6bec110a5e63777c332469e0cba2", GitTreeState:"clean", BuildDate:"2019-08-19T11:13:54Z", GoVersion:"go1.12.9", Compiler:"gc", Platform:"darwin/amd64"}

[derrickburns]

@errordeveloper This is a blocker.

[sstkwayne]

@derrickburns to unblock myself, I created managed separately with a cloudformation template and used attachPolicyARNs to assign the policy to the role that eksctl creates

```iam:
withOIDC: true
serviceAccounts:

• metadata:
  name: foo-bar-only-reader
  namespace: get-secret-poc
  labels: {aws-usage: "application"}
  attachPolicyARNs:
  
  
  
  • "arn:aws:iam::123456789012:policy/GetFooPolicy"```
  
  

[cPu1]

@dewittcx this has been fixed in 0.5.3: https://github.com/weaveworks/eksctl/releases/tag/0.5.3. Please try it out.

For the record, the stack creation was failing because PolicyName, which is a required field, wasn't being set.