docs: Example policy for VPC endpoint needs Allow statement; S3 endpoint should be type 'Gateway'

[alexmbird]

Description

I've been troubleshooting a problem with an EKS cluster running in a VPC created by terraform-aws-vpc. Most of my setup was cribbed from your complete example. Attempts to pull images from ECR in the same region were consistently denied while those in other regions worked fine.

AWS Support managed to identify the problem. It was that ECR endpoints created using the generic_endpoint_policy from the example lack any Allow statement to permit access. Allow statements aren't implicit in IAM policies so this defaulted to denying all requests.

Calls to ECR in the same region therefore failed. Ones to ECR in other regions went out via my NAT gateway instead of using the local endpoint, so confusingly they still worked fine.

The PR fixes the issue by adding the missing Allow statement. AWS support have also advised me S3 endpoints should typically be set as type Gateway, so I've modified the example to do this too.

Motivation and Context

It solves the problem of ECR images failing to pull via VPC endpoints created following the example bundled with terraform-aws-vpc.

Breaking Changes

No

How Has This Been Tested?

Please describe how you tested your changes

• Running on my own environment
• I have executed pre-commit run -a on my pull request