Create EKS Cluster with VPC using Terraform | Real-Time Terraform Modules Implementation

1. Why Do We Need This? (Problem Statement & Status Quo)

In modern cloud infrastructure engineering, provisioning a production-grade Kubernetes cluster manually through the AWS Management Console is tedious, error-prone, and impossible to reproduce reliably.

• The Challenge: Creating a secure Amazon EKS (Elastic Kubernetes Service) cluster requires a robust underlying Virtual Private Cloud (VPC), public and private subnets across multiple availability zones, internet gateways, route tables, strict security groups, and an autoscaling group of worker nodes. Doing this by hand leads to configuration drifts and security gaps.
• The Solution: Automating the entire architecture using Terraform and pre-built, community-vetted Terraform Modules. This ensures repeatability, maintainability, and enterprise-grade infrastructure consistency.

2. Core Mental Model & Architectural Analogy

Real-Life Analogy: The Modular Construction Kit

Imagine building a modern corporate office building.

• Instead of cutting every timber, pouring custom concrete foundations from scratch, and wiring electrical grids manually, engineers use pre-fabricated modular units (standardized rooms, pre-wired panels) designed by expert architects.
• You simply specify where the modules go, hook them together with standard plumbing/wiring specifications, and customize the access controls (security guards/badges).
• Terraform Modules act precisely like these pre-fabricated building blocks. Rather than writing thousands of lines of low-level resource scripts for a VPC and EKS cluster, you invoke standard modules from the registry and pass variables to customize them.

3. High-Level Architecture Flow

The complete deployment pipeline executes locally or inside a virtual machine, authenticating with AWS to provision the cloud infrastructure:

4. Step-by-Step Prerequisites & Setup Workflow

Before writing or applying Terraform configurations, you must set up your local environment and authenticate with AWS.

Step 1: Install AWS CLI

Download and install the AWS Command Line Interface depending on your operating system (Linux/macOS/Windows). Verify the installation:

aws --version

Step 2: Install Terraform

Download HashiCorp Terraform from the official developer portal for your respective OS and verify:

terraform version

Step 3: Configure AWS Credentials

Run the configuration command to store your security credentials locally:

aws configure

• AWS Access Key ID: Provided by your AWS IAM console (Security credentials -> Access keys).
• AWS Secret Access Key: The corresponding secret string.
• Default region name: e.g., us-east-1 or us-west-2.
• Default output format: json.

Note: Under the hood, aws configure saves these keys in secure local credential files. Terraform automatically reads these credentials to authenticate API requests against your AWS account.

5. Structuring Terraform Files: Monolithic vs. Modular

Writing an entire infrastructure stack inside a single main.tf file is an anti-pattern. It impairs readability and makes debugging difficult when security groups or route tables fail.

Enterprise File Breakdown

6. Deep Dive: Writing the Terraform Code

A. Provider and Version Setup (versions.tf)

Terraform requires providers to interface with cloud APIs. We define the AWS provider and establish a random string generator to ensure unique EKS cluster naming.

terraform {
  required_version = ">= 1.0.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.0"
    }
  }
}

provider "aws" {
  region = var.aws_region
}

resource "random_string" "suffix" {
  length  = 8
  special = false
  upper   = false
}

locals {
  cluster_name = "abi-eks-${random_string.suffix.result}"
}

B. VPC Module Configuration (vpc.tf)

Instead of defining custom subnets, gateways, and route tables line by line, we leverage the official HashiCorp Terraform AWS VPC module (v5.7.0).

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.7.0"

  name = "abi-vpc"
  cidr = var.vpc_cidr

  azs             = ["us-west-2a", "us-west-2b", "us-west-2c"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]

  enable_nat_gateway   = true
  single_nat_gateway   = true
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Environment = "production"
    Terraform   = "true"
  }
}

C. EKS Cluster Module Configuration (eks.tf)

The EKS module provisions the Kubernetes control plane and creates an AWS Managed Node Group backed by an Autoscaling Group (ASG).

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 20.0"

  cluster_name    = local.cluster_name
  cluster_version = var.cluster_version

  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets

  cluster_endpoint_public_access = true

  eks_managed_node_groups = {
    default = {
      min_size     = 2
      max_size     = 6
      desired_size = 2

      instance_types = ["t3.medium"]
      ami_type       = "AL2_x86_64"
    }
  }

  tags = {
    Environment = "production"
    Terraform   = "true"
  }
}

D. Outputs (outputs.tf)

Outputs allow us to retrieve critical connection attributes immediately after terraform apply completes without opening the AWS Console.

output "cluster_id" {
  description = "The ID of the EKS cluster"
  value       = module.eks.cluster_id
}

output "cluster_endpoint" {
  description = "Endpoint for EKS control plane"
  value       = module.eks.cluster_endpoint
}

output "cluster_name" {
  description = "The generated name of the EKS cluster"
  value       = local.cluster_name
}

7. Comparative Analysis: Infrastructure Provisioning Strategies

8. Step-by-Step Execution Workflow

Execute the project via your terminal inside the project directory:

1. Initialize Terraform

Downloads required providers (AWS) and fetches community modules into a hidden .terraform/ directory.

terraform init

2. Preview the Execution Plan

Generates an execution graph showing exactly which resources will be added (~55 resources to add), modified, or destroyed.

terraform plan

3. Apply the Configuration

Provision the resources in AWS. (Use --auto-approve to skip the interactive prompt if confident).

terraform apply --auto-approve

9. Post-Execution: AWS Permissions & Kubernetes Access

Even after successful creation, the IAM user/role that ran Terraform does not automatically possess administrative data-plane access inside the Kubernetes cluster until explicit RBAC or access entries are granted.

Granting EKS Cluster Access via AWS Console

1. Navigate to the Amazon EKS console and click on your cluster (abi-eks-xxxxxxxx).
2. Go to the Access tab.
3. Click Create access entry.
4. Select your IAM Principal ARN (e.g., your root user or IAM admin role).
5. Assign the policy: AmazonEKSClusterAdminPolicy.
6. Click Create.

Once granted, refresh the Compute tab in the AWS console to see your running worker nodes, or configure your local kubectl client:

aws eks update-kubeconfig --region us-west-2 --name abi-eks-xxxxxxxx
kubectl get nodes

10. Real-World Practical Pitfalls & Debugging

• AWS Cost Accumulation: Running EKS control planes and multi-AZ EC2 worker nodes (t3.medium) incurs continuous billing charges outside the free tier. Always run terraform destroy when finished testing.
• Missing IAM Permissions: If kubectl get nodes returns a Forbidden error or the Compute tab is blank despite successful Terraform completion, ensure you have created an Access Entry in the EKS console with AmazonEKSClusterAdminPolicy.
• Module Version Compatibility: Always pin community module versions (e.g., version = "5.7.0") in production to prevent breaking changes when upstream maintainers release major updates.

11. Summary and Key Takeaways

• Modular Architecture: Breaking infrastructure into dedicated files (vpc.tf, eks.tf, outputs.tf) vastly improves readability and maintainability.
• Community Modules: Utilizing official HashiCorp AWS modules for VPC and EKS saves hundreds of lines of complex boilerplate code.
• Random String Suffixes: Combining random_string with local variables guarantees globally unique AWS resource names (such as EKS clusters).
• Autoscaling Worker Nodes: EKS managed node groups automatically orchestrate EC2 instances within defined boundaries (min_size = 2, max_size = 6).
• Post-Deploy RBAC: Provisioning an EKS cluster via Terraform creates the infrastructure, but explicit IAM access entries are required to view Kubernetes data-plane resources.
• Cleanup Discipline: Always execute terraform destroy after testing to avoid unexpected cloud infrastructure costs.