from what i've been seeing in code samples... using

@pulumi/eks

and having a well-scoped IAM policy seem to be mutually exclusive -- pick one.