About aws auto unseal account - which permissions are needed?

[aram]

Duplicate post, see: AWS EKS Auto Unseal