AWS EKS Terraform module

Upstream version 21.24.2

8 controls from AWS Well-Architected Framework v10 requirements

Terraform Module Source

awswellarchitected.compliance.tf/terraform-aws-modules/eks/aws

Compliance Inputs Outputs Resources Diff (2)README

104 unique

Name	Type	Default	Description
Enforced · locked by active controls
cloudwatch_log_group_kms_key_idlog_group_encryption_at_rest_enabled	string	null	If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html)
cloudwatch_log_group_retention_in_dayscloudwatch_log_group_retention_period_365	number	365	Number of days to retain log events. Default retention - 90 days
enabled_log_typeseks_cluster_control_plane_audit_logging_enabled	list(string)	[...]	A list of the desired control plane logs to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html)
encryption_configeks_cluster_secrets_encrypted	object({...})	{}	Configuration block with encryption configuration for the cluster
endpoint_public_accesseks_cluster_endpoint_public_access_restricted	bool	false	Indicates whether or not the Amazon EKS public API server endpoint is enabled
Optional
access_entries	map({...})	{}	Map of access entries to add to the cluster
additional_security_group_ids	list(string)	[]	List of additional, externally created security group IDs to attach to the cluster control plane
addons	map({...})	null	Map of cluster addon configurations to enable for the cluster. Addon name can be the map keys or set with `name`
addons_timeouts	object({...})	{}	Create, update, and delete timeout configurations for the cluster addons
attach_encryption_policy	bool	true	Indicates whether or not to attach an additional policy for the cluster IAM role to utilize the encryption key provided
authentication_mode	string	"API_AND_CONFIG_MAP"	The authentication mode for the cluster. Valid values are `CONFIG_MAP`, `API` or `API_AND_CONFIG_MAP`
cloudwatch_log_group_class	string	null	Specified the log class of the log group. Possible values are: `STANDARD` or `INFREQUENT_ACCESS`
cloudwatch_log_group_tags	map(string)	{}	A map of additional tags to add to the cloudwatch log group created
cluster_tags	map(string)	{}	A map of additional tags to add to the cluster
compute_config	object({...})	null	Configuration block for the cluster compute configuration
control_plane_egress_mode	string	null	Egress mode for the EKS control plane. Valid values are `AWS_MANAGED` and `CUSTOMER_ROUTED`
control_plane_scaling_config	object({...})	null	Configuration block for the EKS Provisioned Control Plane scaling tier. Valid values for tier are `standard`, `tier-xl`, `tier-2xl`, `tier-4xl` and `tier-8xl`
control_plane_subnet_ids	list(string)	[]	A list of subnet IDs where the EKS cluster control plane (ENIs) will be provisioned. Used for expanding the pool of subnets used by nodes/node groups without replacing the EKS control plane
create	bool	true	Controls if resources should be created (affects nearly all resources)
create_auto_mode_iam_resources	bool	false	Determines whether to create/attach IAM resources for EKS Auto Mode. Useful for when using only custom node pools and not built-in EKS Auto Mode node pools
create_cloudwatch_log_group	bool	true	Determines whether a log group is created by this module for the cluster logs. If not, AWS will automatically create one if logging is enabled
create_cni_ipv6_iam_policy	bool	false	Determines whether to create an [`AmazonEKS_CNI_IPv6_Policy`](https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html#cni-iam-role-create-ipv6-policy)
create_iam_role	bool	true	Determines whether an IAM role is created for the cluster
create_kms_key	bool	true	Controls if a KMS key for cluster encryption should be created
create_node_iam_role	bool	true	Determines whether an EKS Auto node IAM role is created
create_node_security_group	bool	true	Determines whether to create a security group for the node groups or use the existing `node_security_group_id`
create_primary_security_group_tags	bool	true	Indicates whether or not to tag the cluster's primary security group. This security group is created by the EKS service, not the module, and therefore tagging is handled after cluster creation
create_security_group	bool	true	Determines if a security group is created for the cluster. Note: the EKS service creates a primary security group for the cluster by default
custom_oidc_thumbprints	list(string)	[]	Additional list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificate(s)
dataplane_wait_duration	string	"30s"	Duration to wait after the EKS cluster has become active before creating the dataplane components (EKS managed node group(s), self-managed node group(s), Fargate profile(s))
deletion_protection	bool	null	Whether to enable deletion protection for the cluster. When enabled, the cluster cannot be deleted unless deletion protection is first disabled
eks_managed_node_groups	map({...})	null	Map of EKS managed node group definitions to create
enable_auto_mode_custom_tags	bool	true	Determines whether to enable permissions for custom tags resources created by EKS Auto Mode
enable_cluster_creator_admin_permissions	bool	false	Indicates whether or not to add the cluster creator (the identity used by Terraform) as an administrator via access entry
enable_irsa	bool	true	Determines whether to create an OpenID Connect Provider for EKS to enable IRSA
enable_kms_key_rotation	bool	true	Specifies whether key rotation is enabled
encryption_policy_description	string	"Cluster encryption policy to allow cluster role to utilize CMK provided"	Description of the cluster encryption policy created
encryption_policy_name	string	null	Name to use on cluster encryption policy created
encryption_policy_path	string	null	Cluster encryption policy path
encryption_policy_tags	map(string)	{}	A map of additional tags to add to the cluster encryption policy created
encryption_policy_use_name_prefix	bool	true	Determines whether cluster encryption policy name (`cluster_encryption_policy_name`) is used as a prefix
endpoint_private_access	bool	true	Indicates whether or not the Amazon EKS private API server endpoint is enabled
endpoint_public_access_cidrs	list(string)	["0.0.0.0/0"]	List of CIDR blocks which can access the Amazon EKS public API server endpoint
fargate_profiles	map({...})	null	Map of Fargate Profile definitions to create
force_update_version	bool	null	Force version update by overriding upgrade-blocking readiness checks when updating a cluster
iam_role_additional_policies	map(string)	{}	Additional policies to be added to the IAM role
iam_role_arn	string	null	Existing IAM role ARN for the cluster. Required if `create_iam_role` is set to `false`
iam_role_description	string	null	Description of the role
iam_role_name	string	null	Name to use on IAM role created
iam_role_path	string	null	The IAM role path
iam_role_permissions_boundary	string	null	ARN of the policy that is used to set the permissions boundary for the IAM role
iam_role_tags	map(string)	{}	A map of additional tags to add to the IAM role created
iam_role_use_name_prefix	bool	true	Determines whether the IAM role name (`iam_role_name`) is used as a prefix
identity_providers	map({...})	null	Map of cluster identity provider configurations to enable for the cluster. Note - this is different/separate from IRSA
include_oidc_root_ca_thumbprint	bool	true	Determines whether to include the root CA thumbprint in the OpenID Connect (OIDC) identity provider's server certificate(s)
ip_family	string	"ipv4"	The IP family used to assign Kubernetes pod and service addresses. Valid values are `ipv4` (default) and `ipv6`. You can only specify an IP family when you create a cluster, changing this value will force a new cluster to be created
kms_key_administrators	list(string)	[]	A list of IAM ARNs for [key administrators](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-administrators). If no value is provided, the current caller identity is used to ensure at least one key admin is available
kms_key_aliases	list(string)	[]	A list of aliases to create. Note - due to the use of `toset()`, values must be static strings and not computed values
kms_key_deletion_window_in_days	number	null	The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key. If you specify a value, it must be between `7` and `30`, inclusive. If you do not specify a value, it defaults to `30`
kms_key_description	string	null	The description of the key as viewed in AWS console
kms_key_enable_default_policy	bool	true	Specifies whether to enable the default key policy
kms_key_override_policy_documents	list(string)	[]	List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank `sid`s will override statements with the same `sid`
kms_key_owners	list(string)	[]	A list of IAM ARNs for those who will have full key permissions (`kms:*`)
kms_key_rotation_period_in_days	number	null	Custom period of time between each key rotation date. If you specify a value, it must be between `90` and `2560`, inclusive. If you do not specify a value, it defaults to `365`
kms_key_service_users	list(string)	[]	A list of IAM ARNs for [key service users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-service-integration)
kms_key_source_policy_documents	list(string)	[]	List of IAM policy documents that are merged together into the exported document. Statements must have unique `sid`s
kms_key_users	list(string)	[]	A list of IAM ARNs for [key users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-users)
kubernetes_version	string	null	Kubernetes `<major>.<minor>` version to use for the EKS cluster (i.e.: `1.33`)
name	string	""	Name of the EKS cluster
node_iam_role_additional_policies	map(string)	{}	Additional policies to be added to the EKS Auto node IAM role
node_iam_role_description	string	null	Description of the EKS Auto node IAM role
node_iam_role_name	string	null	Name to use on the EKS Auto node IAM role created
node_iam_role_path	string	null	The EKS Auto node IAM role path
node_iam_role_permissions_boundary	string	null	ARN of the policy that is used to set the permissions boundary for the EKS Auto node IAM role
node_iam_role_tags	map(string)	{}	A map of additional tags to add to the EKS Auto node IAM role created
node_iam_role_use_name_prefix	bool	true	Determines whether the EKS Auto node IAM role name (`node_iam_role_name`) is used as a prefix
node_security_group_additional_rules	map({...})	{}	List of additional security group rules to add to the node security group created. Set `source_cluster_security_group = true` inside rules to set the `cluster_security_group` as source
node_security_group_description	string	"EKS node shared security group"	Description of the node security group created
node_security_group_enable_recommended_rules	bool	true	Determines whether to enable recommended security group rules for the node security group created. This includes node-to-node TCP ingress on ephemeral ports and allows all egress traffic
node_security_group_id	string	""	ID of an existing security group to attach to the node groups created
node_security_group_name	string	null	Name to use on node security group created
node_security_group_tags	map(string)	{}	A map of additional tags to add to the node security group created
node_security_group_use_name_prefix	bool	true	Determines whether node security group name (`node_security_group_name`) is used as a prefix
openid_connect_audiences	list(string)	[]	List of OpenID Connect audience client IDs to add to the IRSA provider
outpost_config	object({...})	null	Configuration for the AWS Outpost to provision the cluster on
prefix_separator	string	"-"	The separator to use between the prefix and the generated timestamp for resource names
putin_khuylo	bool	true	Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!
region	string	null	Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration
remote_network_config	object({...})	null	Configuration block for the cluster remote network configuration
security_group_additional_rules	map({...})	{}	List of additional security group rules to add to the cluster security group created. Set `source_node_security_group = true` inside rules to set the `node_security_group` as source
security_group_description	string	"EKS cluster security group"	Description of the cluster security group created
security_group_id	string	""	Existing security group ID to be attached to the cluster
security_group_name	string	null	Name to use on cluster security group created
security_group_tags	map(string)	{}	A map of additional tags to add to the cluster security group created
security_group_use_name_prefix	bool	true	Determines whether cluster security group name (`cluster_security_group_name`) is used as a prefix
self_managed_node_groups	map({...})	null	Map of self-managed node group definitions to create
service_ipv4_cidr	string	null	The CIDR block to assign Kubernetes service IP addresses from. If you don't specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks
service_ipv6_cidr	string	null	The CIDR block to assign Kubernetes pod and service IP addresses from if `ipv6` was specified when the cluster was created. Kubernetes assigns service addresses from the unique local address range (fc00::/7) because you can't specify a custom IPv6 CIDR block when you create the cluster
subnet_ids	list(string)	[]	A list of subnet IDs where the nodes/node groups will be provisioned. If `control_plane_subnet_ids` is not provided, the EKS cluster control plane (ENIs) will be provisioned in these subnets
tags	map(string)	{}	A map of tags to add to all resources
timeouts	object({...})	null	Create, update, and delete timeout configurations for the cluster
upgrade_policy	object({...})	null	Configuration block for the cluster upgrade policy
vpc_id	string	null	ID of the VPC where the cluster security group will be provisioned
zonal_shift_config	object({...})	null	Configuration block for the cluster zonal shift