I think it is related to https://github.com/terraform-aws-modules/terraform-aws-eks/pull/902 but adding "ec2:DescribeInternetGateways" , "ec2:DescribeAccountAttributes" helps