Specific role and instance profile for EKS worker nodes.

/kind feature

Describe the solution you'd like [A clear and concise description of what you want to happen.]

As a EKS cluster operator, I'd like to have a specific set of roles for my AWS worker nodes use.

Currently the role AWSIAMRoleNodes is a shared role for workers that are for regular clusters and EKS clusters.

  AWSIAMRoleNodes:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
        Version: 2012-10-17
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
      - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
      RoleName: nodes.cluster-api-provider-aws.sigs.k8s.io
    Type: AWS::IAM::Role

My proposal is to create a new Instance Profile and Role specific for nodes that are part of an EKS cluster and remove the ManagedPolicyArns in the role pasted above

This would make the AWSIAMRoleNodes to be the following

  AWSIAMRoleNodes:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
        Version: 2012-10-17
      RoleName: nodes.cluster-api-provider-aws.sigs.k8s.io
    Type: AWS::IAM::Role

and a new role called eks-nodes.cluster-api-provider-aws.sigs.k8s.io which would like this

  AWSIAMRoleEKSNodes:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
        Version: 2012-10-17
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
      - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
      RoleName: eks-nodes.cluster-api-provider-aws.sigs.k8s.io

Along with a new InstanceProfile to use that Role as follows

 AWSIAMInstanceProfileEKSNodes:
   Properties:
     InstanceProfileName: eks-nodes.cluster-api-provider-aws.sigs.k8s.io
     Roles:
     - Ref: AWSIAMRoleEKSNodes
   Type: AWS::IAM::InstanceProfile

I think this will warrant code changes in clusterawsadm as well as the tests to use this newly created role+instance profile https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/eb5da5870f9147624430de1b67e55843991ed7d0/test/e2e/data/eks/cluster-template-eks-machine-deployment-only.yaml#L32

Anything else you would like to add: [Miscellaneous information that will assist in solving the issue.]

Environment:

• Cluster-api-provider-aws version:
• Kubernetes version: (use kubectl version):
• OS (e.g. from /etc/os-release):