fix: Use dynamic partition data source to determine DNS suffix for Karpenter EC2 pass role permission (#3193)

* fix karpenter iam passrole to ec2 api bug, to support aws cn

* fix: Use dyanmic partition value for DNS suffix

---------

Co-authored-by: Shuiping <[email protected]>
Co-authored-by: Bryant Biggs <[email protected]>

Author: 3 people

modules/karpenter/policy.tf

@@ -195,7 +195,7 @@ data "aws_iam_policy_document" "v033" {
     condition {
       test     = "StringEquals"
       variable = "iam:PassedToService"
-      values   = ["ec2.amazonaws.com"]
+      values   = ["ec2.${local.dns_suffix}"]
     }
   }
 
@@ -584,7 +584,7 @@ data "aws_iam_policy_document" "v1" {
     condition {
       test     = "StringEquals"
       variable = "iam:PassedToService"
-      values   = ["ec2.amazonaws.com"]
+      values   = ["ec2.${local.dns_suffix}"]
     }
   }