Troubleshooting ALB docs expect CreateLoadBalancer AccessDenied, but current policy fails on AddTags

[w7089]

What happened?

In the ALB troubleshooting module, the docs currently show the IAM failure after fixing subnet tags as missing elasticloadbalancing:CreateLoadBalancer:

• website/docs/troubleshooting/alb/alb_fix_1.md
• website/docs/troubleshooting/alb/alb_fix_5.md

In a fresh/current workshop run, the observed error is instead missing elasticloadbalancing:AddTags during CreateLoadBalancer:

Warning  FailedDeployModel  ingress  Failed deploy model due to AccessDenied: User: arn:aws:sts::<account-id>:assumed-role/alb-controller-<suffix>/<session> is not authorized to perform: elasticloadbalancing:AddTags on resource: arn:aws:elasticloadbalancing:us-west-2:<account-id>:loadbalancer/app/k8s-ui-ui-5ddc3ba496/* because no identity-based policy allows the elasticloadbalancing:AddTags action

This appears to come from the intentionally broken policy at manifests/modules/troubleshooting/alb/.workshop/terraform/template/other_issue.json. That policy already allows elasticloadbalancing:CreateLoadBalancer, but it lacks the create-time tagging permission for ALB/NLB creation:

{
  "Action": "elasticloadbalancing:AddTags",
  "Condition": {
    "Null": {
      "aws:RequestTag/elbv2.k8s.aws/cluster": "false"
    },
    "StringEquals": {
      "elasticloadbalancing:CreateAction": [
        "CreateTargetGroup",
        "CreateLoadBalancer"
      ]
    }
  }
}

So the controller passes the CreateLoadBalancer authorization check, then ELB rejects the create-time tags with an AddTags authorization error.

Expected behavior

Either:

1. Update the ALB troubleshooting text/examples to show the current elasticloadbalancing:AddTags failure and explain that it is the dependent create-time tagging permission for CreateLoadBalancer; or
2. Change the intentionally broken policy so it actually lacks elasticloadbalancing:CreateLoadBalancer, matching the current tutorial narrative.

Reproduction notes

On 2026-07-13, after following https://www.eksworkshop.com/docs/troubleshooting/alb/alb_fix_1 and fixing the subnet tags/restarting the controller, the ingress event and CloudTrail CreateLoadBalancer events both reported AccessDenied for elasticloadbalancing:AddTags, not elasticloadbalancing:CreateLoadBalancer.

Attaching the pre-created fixed policy and detaching eksworkshopissue resolved the problem; the ALB then appeared in provisioning state.

Related

A prior older issue mentions missing AddTags in a different workshop path: #564. This issue is specifically about the current ALB troubleshooting module documentation/source mismatch.