See note in Release v0.21.0 (https://github.com/cloudposse/terraform-aws-eks-node-group/releases/tag/0.21.0)
Add flag to optionally not attach AmazonEKS_CNI_Policy to nodegroups @cvittoriasona (#76)
what
worker_role_cni_iam_enabled
bool so nodegroups can have the AmazonEKS_CNI_Policy omitted from IAM Instance Role.
why
worker_role_autoscale_iam_enabled
bool so nodes are configured with least privileges required for EKS to work (AmazonEC2ContainerRegistryReadOnly
and AmazonEKSWorkerNodePolicy
) ref