Danger, Will Robinson!

policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:*",
        "eks:*",
        "ec2:*",
        "autoscaling:*",
        "cloudformation:*"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/user:Project": "eks_proto"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": ["tag:*", "ec2:CreateTags"],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/user:Project": "eks_proto"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeAvailabilityZones",
        "ec2:Create*",
        "ec2:Describe*",
        "autoscaling:Describe*",
        "ec2:AllocateAddress",
        "ssm:GetParameter",
        "eks:Describe*",
        "ec2:DisassociateAddress"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["iam:PassRole"],
      "Resource": [
        "arn:aws:iam:::role/eks-cluster-instanceRole-role-*",
        "arn:aws:iam:::role/eks-cluster-eksRole-role-*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": ["autoscaling:*"],
      "Resource": "arn:aws:autoscaling:::launchConfiguration:*:launchConfigurationName/eks-cluster-nodeLaunchConfiguration-*"
    }
  ]
}