const instanceAssumeRolePolicyDocument = aws.iam.getPolicyDocument({
      statements: [
        {
          actions: ['sts:AssumeRole'],
          principals: [
            {
              type: 'Service',
              identifiers: ['<http://ec2.amazonaws.com|ec2.amazonaws.com>'],
            },
          ],
        },
      ],
    })
    const oidcAssumeRolePolicyDocument = pulumi
      .all([clusterOidcProviderUrl, clusterOidcProviderArn])
      .apply(([url, arn]) =>
        aws.iam.getPolicyDocument({
          statements: [
            {
              effect: 'Allow',
              actions: ['sts:AssumeRoleWithWebIdentity'],
              principals: [
                {
                  type: 'Federated',
                  identifiers: [arn],
                },
              ],
              conditions: [
                {
                  test: 'StringEquals',
                  variable: `${url.replace('https://', '')}:aud`,
                  values: [`<http://sts.amazonaws.com|sts.amazonaws.com>`],
                },
              ],
            },
          ],
        })
      )