[cloudshell-user@ip-10-130-34-127 ~]$ eksctl create iamserviceaccount \
--region ap-southeast-1 \ --name alb-ingress-controller \ --namespace kube-system \ --cluster ekscls \ --attach-policy-arn arn:aws:iam::316890205783:policy/ALBIngressControllerIAMPolicy \ --override-existing-serviceaccounts \> --approveError: operation error IAM: GetOpenIDConnectProvider, https response error StatusCode: 403, RequestID: a259a727-a41c-4385-8a6d-05616b8f4a27, api error AccessDenied: User: arn:aws:iam::316890205783:user/kk_labs_user_739522 is not authorized to perform: iam:GetOpenIDConnectProvider on resource: arn:aws:iam::316890205783:oidc-provider/oidc.eks.ap-southeast-1.amazonaws.com/id/AE253CCDCF3230CAAB4FE0DB110C6676 because no identity-based policy allows the iam:GetOpenIDConnectProvider action