fix: Add required S3 PutObjectTagging permission to Velero IRSA policy

[chrisRedwine]

Description

Adds required s3:PutObjectTagging permission to Velero IRSA policy

Motivation and Context

Resolves #518

Breaking Changes

No

How Has This Been Tested?

Probably a bit overkill, but the following steps show not only how to reproduce the behavior, but also how this PR resolves the issue:

• Clone https://github.com/chrisRedwine/velero-mre, which contains the minimal reproducible example for the issue.

• Run tofu init and tofu apply to create and configure the required resources (VPC, EKS, EBS CSI driver, Snapshot Controller, Velero, Pod w/ PVC and data, etc.).

• Wait until everything is set up and the ebs-pvc-pod has run and saved data to the volume.

• Run velero backup create ebs-test-broken --include-namespaces=default --snapshot-move-data.

• See the error in the logs described below, and note that velero backup describe ebs-test-broken shows the backup failed.

• Switch the use_fixed_velero_policy variable in terraform.tfvars to true in the chrisRedwine/velero-mre repo.

• Run tofu apply

• Wait for the 3 velero pods to restart so that they use the fixed IRSA.

• Run velero backup create ebs-test-fixed --include-namespaces=default --snapshot-move-data.

• Notice no errors in the logs, and that velero backup describe ebs-test-fixed shows the backup succeeded.

• (Make sure to clean up with tofu destroy afterwards)

• I have updated at least one of the examples/* to demonstrate and validate my change(s)

• I have tested and validated these changes using one or more of the provided examples/* projects

• I have executed pre-commit run -a on my pull request

[bryantbiggs]

thank you! If you want to add the same change here https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity that would be greatly appreciated!

[antonbabenko]

This PR is included in version 5.44.2 🎉

[chrisRedwine]

thank you! If you want to add the same change here https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity that would be greatly appreciated!

@bryantbiggs Here's the PR forterraform-aws-eks-pod-identity. I also updated and re-ran the pre-commit hooks.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.