EKS IAM policy

iam.json

{
    "Statement": [
        {
            "Action": [
                "eks:UpdateClusterVersion",
                "eks:UpdateClusterConfig",
                "eks:UntagResource",
                "eks:TagResource",
                "eks:ListClusters",
                "eks:DescribeCluster",
                "eks:DeleteCluster",
                "eks:CreateCluster",
                "eks:AssociateEncryptionConfig"
            ],
            "Effect": "Allow",
            "Resource": "arn:*:eks:*:*:cluster/*",
            "Sid": ""
        },
        {
            "Action": [
                "iam:listAttachedRolePolicies",
                "iam:CreateServiceLinkedRole"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:iam::*:role/aws-service-role/*",
            "Sid": ""
        },
        {
            "Action": "iam:PassRole",
            "Effect": "Allow",
            "Resource": "<EKS Cluster Role ARN>",
            "Sid": ""
        },
        {
            "Action": [
                "kms:DescribeKey",
                "kms:CreateGrant"
            ],
            "Effect": "Allow",
            "Resource": "<EKS KMS Key ARN>",
            "Sid": ""
        }
    ],
    "Version": "2012-10-17"
}