An EKS cluster with managed node groups and an associated OIDC provider fails to provision gp3 EBS volumes when a PVC is requested. kubectl describe pvc shows a StorageClass provisioning failure and EC2:UnauthorizedOperation when attempting to create the EBS volume. How can you fix this?

The error "EC2:UnauthorizedOperation" indicates that the Amazon EBS CSI driver lacks the necessary IAM permissions to create EBS volumes. The correct solution is to create an IAM role with the required permissions (e.g., ec2:CreateVolume, ec2:AttachVolume) and a trust policy allowing the EBS CSI driver's service account to assume this role. This IAM role is then associated with the Amazon EBS CSI driver add-on. Creating a Kubernetes ClusterRole only grants permissions within Kubernetes, not to AWS APIs like EC2. Adding an annotation to the PVC specifies the volume type but doesn't resolve underlying permission issues. Creating a StorageClass is necessary for dynamic provisioning but doesn't address the UnauthorizedOperation error, which is an IAM problem.