Default the EBS CSI driver well-known policy to AmazonEBSCSIDriverPolicyV2 #8902

Description

Both eksctl paths that grant EBS CSI driver permissions attach the broad AWS managed policy AmazonEBSCSIDriverPolicy:

• IRSA service accounts with wellKnownPolicies.ebsCSIController: true (also usable under addons[]): pkg/cfn/builder/iam_helper.go#L67-L71
• Nodegroup instance roles with iam.withAddonPolicies.ebs: true: pkg/cfn/builder/iam_helper.go#L177-L179
• Both use the constant iamPolicyAmazonEBSCSIDriverPolicy = "service-role/AmazonEBSCSIDriverPolicy": pkg/cfn/builder/iam.go#L33

AmazonEBSCSIDriverPolicy allows actions on any EBS volume or snapshot in the account, including ones the driver didn't create. AWS released a scoped-down replacement, AmazonEBSCSIDriverPolicyV2. It limits the driver to resources tagged ebs.csi.aws.com/cluster: true, which the driver already applies to every volume and snapshot it provisions dynamically. It also allows volumes migrated from the in-tree plugin, via kubernetes.io/created-for/pvc/name.

The EKS Best Practices guide recommends attaching the most restrictive managed policy that fits the workload.

Proposed change:

• Point both paths at arn:${AWS::Partition}:iam::aws:policy/AmazonEBSCSIDriverPolicyV2. Unlike the old policy, V2 has no service-role/ path.

Compatibility:

This is a breaking change for statically provisioned or imported volumes and snapshots that don't carry ebs.csi.aws.com/cluster: true. They get UnauthorizedOperation until they're tagged. Dynamically provisioned resources need no changes.

Questions for maintainers before we open a PR:

1. Are you open to defaulting to AmazonEBSCSIDriverPolicyV2?
2. Since this breaks statically provisioned workloads until their resources are tagged, how would you prefer to roll it out (e.g. major version, opt-out flag, deprecation period, release note)?
3. We maintain the EBS CSI driver and are happy to contribute the PR once we agree on the approach.

References:

• Migration guide and FAQ: [Announcement] New Managed Policies Available for the EBS CSI Driver kubernetes-sigs/aws-ebs-csi-driver#2918
• V2 policy document: https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicyV2.html