{"id":51231326,"url":"https://github.com/native-cube/terraform-aws-eks-auto","last_synced_at":"2026-06-28T16:31:48.375Z","repository":{"id":367261971,"uuid":"1279151598","full_name":"native-cube/terraform-aws-eks-auto","owner":"native-cube","description":null,"archived":false,"fork":false,"pushed_at":"2026-06-25T07:33:49.000Z","size":45,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-25T09:12:43.655Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/native-cube.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null},"funding":{"github":["marcincuber"],"custom":"https://www.paypal.me/marcincube"}},"created_at":"2026-06-24T12:24:05.000Z","updated_at":"2026-06-25T07:33:30.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/native-cube/terraform-aws-eks-auto","commit_stats":null,"previous_names":["native-cube/terraform-aws-eks-auto"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/native-cube/terraform-aws-eks-auto","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/native-cube%2Fterraform-aws-eks-auto","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/native-cube%2Fterraform-aws-eks-auto/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/native-cube%2Fterraform-aws-eks-auto/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/native-cube%2Fterraform-aws-eks-auto/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/native-cube","download_url":"https://codeload.github.com/native-cube/terraform-aws-eks-auto/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/native-cube%2Fterraform-aws-eks-auto/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34896652,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-28T02:00:05.809Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-28T16:31:48.277Z","updated_at":"2026-06-28T16:31:48.360Z","avatar_url":"https://github.com/native-cube.png","language":"HCL","funding_links":["https://github.com/sponsors/marcincuber","https://www.paypal.me/marcincube"],"categories":[],"sub_categories":[],"readme":"# Terraform AWS EKS Auto Mode Module\n\nTerraform module for creating an Amazon EKS cluster with EKS Auto Mode enabled by default:\n\n- EKS control plane IAM role with EKS Auto Mode policies.\n- Optional module-created EKS Auto Mode node IAM role.\n- EKS Auto Mode managed compute with configurable built-in node pools.\n- EKS Auto Mode load balancing and block storage switches.\n- Rendered Kubernetes manifests for custom Auto Mode NodeClasses, NodePools, StorageClasses, and LoadBalancer Services.\n- Optional EKS Pod Identity associations.\n- Optional EKS access entries and access policy associations.\n- Optional Amazon EKS managed capabilities: Argo CD, ACK, and KRO.\n- Useful connection and composition outputs.\n\nThe module expects you to provide existing subnet IDs. In most deployments these should be private subnets with outbound internet access through NAT.\nThe Kubernetes API endpoint is private by default; enable public endpoint access only when callers outside the VPC need it.\n\n## Usage\n\n```hcl\nmodule \"eks_auto\" {\n  source = \"./eks-auto\"\n\n  name       = \"dev-auto\"\n  subnet_ids = [\"subnet-0123456789abcdef0\", \"subnet-0fedcba9876543210\"]\n\n  tags = {\n    Environment = \"dev\"\n  }\n}\n```\n\nThen configure `kubectl`:\n\n```bash\naws eks update-kubeconfig --name dev-auto\n```\n\n## Examples\n\n- `examples/minimal` - smallest practical EKS Auto Mode module call using defaults for compute, API access, logging, load balancing, and block storage.\n- `examples/capabilities` - EKS Auto Mode with all supported EKS capabilities: Argo CD, ACK, and KRO.\n- `examples/storage` - custom Auto Mode NodeClass, NodePool, and encrypted gp3 StorageClass manifests.\n- `examples/load-balancing` - Pod Identity and an EKS Auto Mode Network Load Balancer Service manifest.\n\n## EKS Auto Mode\n\nBy default, this module sets:\n\n- `endpoint_private_access = true`\n- `endpoint_public_access = false`\n- `bootstrap_self_managed_addons = false`\n- `compute_config.enabled = true`\n- `compute_config.node_pools = [\"general-purpose\", \"system\"]`\n- `elastic_load_balancing_enabled = true`\n- `block_storage_enabled = true`\n- `access_config.authentication_mode = \"API\"`\n\nThe module can create the Auto Mode node IAM role, or callers can pass an existing node role ARN through `compute_config.node_iam_role_arn`.\n\n## Rendered Kubernetes Manifests\n\nThis module does not introduce a Kubernetes provider. Instead, it can render Auto Mode Kubernetes manifests as outputs:\n\n- `auto_mode_node_classes`\n- `auto_mode_node_pools`\n- `auto_mode_storage_classes`\n- `auto_mode_load_balancer_services`\n\nApply the combined YAML after the cluster is reachable:\n\n```bash\nterraform output -raw auto_mode_kubernetes_manifest_yaml | kubectl apply -f -\n```\n\n## Pod Identity\n\nUse `pod_identity_associations` to create AWS-native EKS Pod Identity associations. The module can create one IAM role per association, attach managed policies or inline JSON, and associate it with a Kubernetes service account.\n\n## EKS Capabilities\n\nEnable the `capabilities` map when this module should create Amazon EKS managed capabilities. Supported types are `ARGOCD`, `ACK`, and `KRO`.\n\n```hcl\ncapabilities = {\n  argocd = {\n    type = \"ARGOCD\"\n    argocd = {\n      idc_instance_arn = \"arn:aws:sso:::instance/ssoins-7223a1b234567890\"\n      namespace        = \"argocd\"\n    }\n  }\n\n  ack = {\n    type = \"ACK\"\n  }\n\n  kro = {\n    type = \"KRO\"\n  }\n}\n```\n\nFor `ARGOCD`, configure the nested `argocd` object with IAM Identity Center settings, optional RBAC role mappings, and optional VPC endpoint IDs. Attach managed policies or an inline policy to a capability role only when that capability needs access to supporting AWS services.\nCapability role presets are available through `iam_policy_presets`: `cloudcontrol_read_only`, `eks_read_only`, `resource_tagging`, and `secrets_read_only`.\n\n## Module Documentation\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n## Requirements\n\n| Name | Version |\n| ---- | ------- |\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.5.0 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 6.0 |\n\n## Providers\n\n| Name | Version |\n| ---- | ------- |\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | \u003e= 6.0 |\n\n## Resources\n\n| Name | Type |\n| ---- | ---- |\n| [aws_cloudwatch_log_group.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |\n| [aws_eks_access_entry.auto_mode_node_class](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_access_entry) | resource |\n| [aws_eks_access_entry.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_access_entry) | resource |\n| [aws_eks_access_policy_association.auto_mode_node_class](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_access_policy_association) | resource |\n| [aws_eks_access_policy_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_access_policy_association) | resource |\n| [aws_eks_capability.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_capability) | resource |\n| [aws_eks_cluster.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster) | resource |\n| [aws_eks_pod_identity_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_pod_identity_association) | resource |\n| [aws_iam_role.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role.eks_capability](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role.node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role.pod_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role_policy.eks_capability](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |\n| [aws_iam_role_policy.eks_capability_preset](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |\n| [aws_iam_role_policy.pod_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |\n| [aws_iam_role_policy_attachment.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.eks_capability](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.pod_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n| ---- | ----------- | ---- | ------- | :------: |\n| \u003ca name=\"input_access_config\"\u003e\u003c/a\u003e [access\\_config](#input\\_access\\_config) | Optional EKS access configuration. EKS Auto Mode uses access entries, so authentication mode defaults to API. | \u003cpre\u003eobject({\u003cbr/\u003e    authentication_mode                         = optional(string)\u003cbr/\u003e    bootstrap_cluster_creator_admin_permissions = optional(bool)\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_access_entries\"\u003e\u003c/a\u003e [access\\_entries](#input\\_access\\_entries) | Additional EKS access entries and optional access policy associations to create. | \u003cpre\u003emap(object({\u003cbr/\u003e    kubernetes_groups = optional(set(string), [])\u003cbr/\u003e    policy_associations = optional(map(object({\u003cbr/\u003e      access_scope = object({\u003cbr/\u003e        namespaces = optional(set(string), [])\u003cbr/\u003e        type       = string\u003cbr/\u003e      })\u003cbr/\u003e      policy_arn = string\u003cbr/\u003e    })), {})\u003cbr/\u003e    principal_arn = string\u003cbr/\u003e    type          = optional(string, \"STANDARD\")\u003cbr/\u003e    user_name     = optional(string)\u003cbr/\u003e  }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_auto_mode_load_balancer_services\"\u003e\u003c/a\u003e [auto\\_mode\\_load\\_balancer\\_services](#input\\_auto\\_mode\\_load\\_balancer\\_services) | EKS Auto Mode Network Load Balancer Service manifests to render as YAML, keyed by Kubernetes metadata.name. | \u003cpre\u003emap(object({\u003cbr/\u003e    annotations                 = optional(map(string), {})\u003cbr/\u003e    external_traffic_policy     = optional(string)\u003cbr/\u003e    ip_families                 = optional(list(string), [])\u003cbr/\u003e    ip_family_policy            = optional(string)\u003cbr/\u003e    labels                      = optional(map(string), {})\u003cbr/\u003e    load_balancer_class         = optional(string, \"eks.amazonaws.com/nlb\")\u003cbr/\u003e    load_balancer_source_ranges = optional(list(string), [])\u003cbr/\u003e    namespace                   = optional(string, \"default\")\u003cbr/\u003e    ports                       = list(any)\u003cbr/\u003e    selector                    = map(string)\u003cbr/\u003e    session_affinity            = optional(string)\u003cbr/\u003e  }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_auto_mode_node_classes\"\u003e\u003c/a\u003e [auto\\_mode\\_node\\_classes](#input\\_auto\\_mode\\_node\\_classes) | Custom EKS Auto Mode NodeClass manifests to render as YAML, keyed by Kubernetes metadata.name. The module does not apply these manifests because it intentionally avoids adding a Kubernetes provider. | \u003cpre\u003emap(object({\u003cbr/\u003e    annotations         = optional(map(string), {})\u003cbr/\u003e    create_access_entry = optional(bool, true)\u003cbr/\u003e    labels              = optional(map(string), {})\u003cbr/\u003e    node_role_arn       = optional(string)\u003cbr/\u003e    spec                = any\u003cbr/\u003e  }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_auto_mode_node_pools\"\u003e\u003c/a\u003e [auto\\_mode\\_node\\_pools](#input\\_auto\\_mode\\_node\\_pools) | Custom EKS Auto Mode NodePool manifests to render as YAML, keyed by Kubernetes metadata.name. The module does not apply these manifests because it intentionally avoids adding a Kubernetes provider. | \u003cpre\u003emap(object({\u003cbr/\u003e    annotations = optional(map(string), {})\u003cbr/\u003e    labels      = optional(map(string), {})\u003cbr/\u003e    spec        = any\u003cbr/\u003e  }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_auto_mode_storage_classes\"\u003e\u003c/a\u003e [auto\\_mode\\_storage\\_classes](#input\\_auto\\_mode\\_storage\\_classes) | EKS Auto Mode EBS StorageClass manifests to render as YAML, keyed by Kubernetes metadata.name. | \u003cpre\u003emap(object({\u003cbr/\u003e    allow_volume_expansion = optional(bool, true)\u003cbr/\u003e    allowed_topologies     = optional(list(any), [])\u003cbr/\u003e    annotations            = optional(map(string), {})\u003cbr/\u003e    labels                 = optional(map(string), {})\u003cbr/\u003e    mount_options          = optional(list(string), [])\u003cbr/\u003e    parameters             = optional(map(string), {})\u003cbr/\u003e    reclaim_policy         = optional(string, \"Delete\")\u003cbr/\u003e    volume_binding_mode    = optional(string, \"WaitForFirstConsumer\")\u003cbr/\u003e  }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_block_storage_enabled\"\u003e\u003c/a\u003e [block\\_storage\\_enabled](#input\\_block\\_storage\\_enabled) | Whether to enable EKS Auto Mode block storage support. | `bool` | `true` | no |\n| \u003ca name=\"input_bootstrap_self_managed_addons\"\u003e\u003c/a\u003e [bootstrap\\_self\\_managed\\_addons](#input\\_bootstrap\\_self\\_managed\\_addons) | Whether EKS bootstraps the default self-managed networking add-ons. Keep false for EKS Auto Mode. | `bool` | `false` | no |\n| \u003ca name=\"input_capabilities\"\u003e\u003c/a\u003e [capabilities](#input\\_capabilities) | Amazon EKS managed capabilities to create, keyed by a stable local name. Supported types are ARGOCD, ACK, and KRO. The module can create a capability IAM role per entry, or use an externally managed role ARN. | \u003cpre\u003emap(object({\u003cbr/\u003e    capability_name           = optional(string)\u003cbr/\u003e    create_iam_role           = optional(bool, true)\u003cbr/\u003e    delete_propagation_policy = optional(string, \"RETAIN\")\u003cbr/\u003e    iam_policy_arns           = optional(set(string), [])\u003cbr/\u003e    iam_policy_presets        = optional(set(string), [])\u003cbr/\u003e    iam_role_arn              = optional(string)\u003cbr/\u003e    iam_role_name             = optional(string)\u003cbr/\u003e    inline_policy_json        = optional(string)\u003cbr/\u003e    type                      = string\u003cbr/\u003e    argocd = optional(object({\u003cbr/\u003e      idc_instance_arn        = optional(string)\u003cbr/\u003e      idc_region              = optional(string)\u003cbr/\u003e      namespace               = optional(string)\u003cbr/\u003e      network_access_vpce_ids = optional(set(string), [])\u003cbr/\u003e      rbac_role_mappings = optional(list(object({\u003cbr/\u003e        role = string\u003cbr/\u003e        identities = list(object({\u003cbr/\u003e          id   = string\u003cbr/\u003e          type = string\u003cbr/\u003e        }))\u003cbr/\u003e      })), [])\u003cbr/\u003e    }))\u003cbr/\u003e  }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_cloudwatch_log_group_kms_key_id\"\u003e\u003c/a\u003e [cloudwatch\\_log\\_group\\_kms\\_key\\_id](#input\\_cloudwatch\\_log\\_group\\_kms\\_key\\_id) | Optional KMS key ID or ARN for encrypting the EKS control plane CloudWatch log group. | `string` | `null` | no |\n| \u003ca name=\"input_cloudwatch_log_retention_days\"\u003e\u003c/a\u003e [cloudwatch\\_log\\_retention\\_days](#input\\_cloudwatch\\_log\\_retention\\_days) | Retention in days for the EKS control plane CloudWatch log group. | `number` | `30` | no |\n| \u003ca name=\"input_cluster_encryption_config\"\u003e\u003c/a\u003e [cluster\\_encryption\\_config](#input\\_cluster\\_encryption\\_config) | Optional EKS encryption configuration for Kubernetes secrets using an existing KMS key. | \u003cpre\u003eobject({\u003cbr/\u003e    provider_key_arn = string\u003cbr/\u003e    resources        = optional(set(string), [\"secrets\"])\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_cluster_name\"\u003e\u003c/a\u003e [cluster\\_name](#input\\_cluster\\_name) | Optional EKS cluster name. When null, name is used as the cluster name. | `string` | `null` | no |\n| \u003ca name=\"input_cluster_security_group_ids\"\u003e\u003c/a\u003e [cluster\\_security\\_group\\_ids](#input\\_cluster\\_security\\_group\\_ids) | Additional security group IDs to associate with the EKS control plane. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_compute_config\"\u003e\u003c/a\u003e [compute\\_config](#input\\_compute\\_config) | EKS Auto Mode compute configuration. When enabled, the module can create the Auto Mode node IAM role and pass it to the cluster. | \u003cpre\u003eobject({\u003cbr/\u003e    create_node_iam_role = optional(bool, true)\u003cbr/\u003e    enabled              = optional(bool, true)\u003cbr/\u003e    node_iam_policy_arns = optional(set(string), [])\u003cbr/\u003e    node_iam_role_arn    = optional(string)\u003cbr/\u003e    node_iam_role_name   = optional(string)\u003cbr/\u003e    node_pools           = optional(set(string), [\"general-purpose\", \"system\"])\u003cbr/\u003e  })\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_control_plane_scaling_tier\"\u003e\u003c/a\u003e [control\\_plane\\_scaling\\_tier](#input\\_control\\_plane\\_scaling\\_tier) | Optional EKS control plane scaling tier. Leave null to use the AWS/provider default. | `string` | `null` | no |\n| \u003ca name=\"input_deletion_protection\"\u003e\u003c/a\u003e [deletion\\_protection](#input\\_deletion\\_protection) | Whether to enable deletion protection for the EKS cluster. Leave null to use the AWS/provider default. | `bool` | `null` | no |\n| \u003ca name=\"input_elastic_load_balancing_enabled\"\u003e\u003c/a\u003e [elastic\\_load\\_balancing\\_enabled](#input\\_elastic\\_load\\_balancing\\_enabled) | Whether to enable EKS Auto Mode load balancing support. | `bool` | `true` | no |\n| \u003ca name=\"input_enabled_cluster_log_types\"\u003e\u003c/a\u003e [enabled\\_cluster\\_log\\_types](#input\\_enabled\\_cluster\\_log\\_types) | EKS control plane log types to enable. | `list(string)` | \u003cpre\u003e[\u003cbr/\u003e  \"api\",\u003cbr/\u003e  \"audit\",\u003cbr/\u003e  \"authenticator\"\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_endpoint_private_access\"\u003e\u003c/a\u003e [endpoint\\_private\\_access](#input\\_endpoint\\_private\\_access) | Whether the Kubernetes API server endpoint is reachable from within the VPC. | `bool` | `true` | no |\n| \u003ca name=\"input_endpoint_public_access\"\u003e\u003c/a\u003e [endpoint\\_public\\_access](#input\\_endpoint\\_public\\_access) | Whether the Kubernetes API server endpoint is reachable from the public internet. | `bool` | `false` | no |\n| \u003ca name=\"input_force_update_version\"\u003e\u003c/a\u003e [force\\_update\\_version](#input\\_force\\_update\\_version) | Whether to force version updates when EKS cannot drain pods. | `bool` | `null` | no |\n| \u003ca name=\"input_ip_family\"\u003e\u003c/a\u003e [ip\\_family](#input\\_ip\\_family) | Optional Kubernetes service IP family. Valid values are ipv4 or ipv6. | `string` | `null` | no |\n| \u003ca name=\"input_kubernetes_version\"\u003e\u003c/a\u003e [kubernetes\\_version](#input\\_kubernetes\\_version) | Kubernetes version for the EKS cluster. Leave null to use the current AWS default. | `string` | `null` | no |\n| \u003ca name=\"input_name\"\u003e\u003c/a\u003e [name](#input\\_name) | Name prefix for module-created resources. Used as the EKS cluster name when cluster\\_name is null. | `string` | n/a | yes |\n| \u003ca name=\"input_pod_identity_associations\"\u003e\u003c/a\u003e [pod\\_identity\\_associations](#input\\_pod\\_identity\\_associations) | EKS Pod Identity associations to create for Kubernetes service accounts. The module can create the IAM role per association, or use an externally managed role ARN. | \u003cpre\u003emap(object({\u003cbr/\u003e    create_iam_role      = optional(bool, true)\u003cbr/\u003e    disable_session_tags = optional(bool)\u003cbr/\u003e    iam_policy_arns      = optional(set(string), [])\u003cbr/\u003e    iam_role_arn         = optional(string)\u003cbr/\u003e    iam_role_name        = optional(string)\u003cbr/\u003e    inline_policy_json   = optional(string)\u003cbr/\u003e    namespace            = string\u003cbr/\u003e    service_account      = string\u003cbr/\u003e    tags                 = optional(map(string), {})\u003cbr/\u003e    target_role_arn      = optional(string)\u003cbr/\u003e  }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_public_access_cidrs\"\u003e\u003c/a\u003e [public\\_access\\_cidrs](#input\\_public\\_access\\_cidrs) | CIDR blocks that can access the public Kubernetes API endpoint when endpoint\\_public\\_access is true. Leave empty when the public endpoint is disabled. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_service_ipv4_cidr\"\u003e\u003c/a\u003e [service\\_ipv4\\_cidr](#input\\_service\\_ipv4\\_cidr) | Optional Kubernetes service IPv4 CIDR. Set only when you need a non-default service CIDR. | `string` | `null` | no |\n| \u003ca name=\"input_subnet_ids\"\u003e\u003c/a\u003e [subnet\\_ids](#input\\_subnet\\_ids) | Subnet IDs for the EKS control plane and EKS Auto Mode managed compute. Use at least two subnets in different Availability Zones. | `list(string)` | n/a | yes |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | Tags to apply to created resources. | `map(string)` | `{}` | no |\n| \u003ca name=\"input_upgrade_policy_support_type\"\u003e\u003c/a\u003e [upgrade\\_policy\\_support\\_type](#input\\_upgrade\\_policy\\_support\\_type) | Optional Kubernetes version support policy. Valid values are STANDARD and EXTENDED. | `string` | `null` | no |\n\n## Outputs\n\n| Name | Description |\n| ---- | ----------- |\n| \u003ca name=\"output_access_entry_arns\"\u003e\u003c/a\u003e [access\\_entry\\_arns](#output\\_access\\_entry\\_arns) | EKS access entry ARNs by access entry key. |\n| \u003ca name=\"output_argocd_idc_managed_application_arns\"\u003e\u003c/a\u003e [argocd\\_idc\\_managed\\_application\\_arns](#output\\_argocd\\_idc\\_managed\\_application\\_arns) | IAM Identity Center managed application ARNs by ARGOCD capability key. |\n| \u003ca name=\"output_argocd_server_urls\"\u003e\u003c/a\u003e [argocd\\_server\\_urls](#output\\_argocd\\_server\\_urls) | Managed Argo CD server URLs by ARGOCD capability key. |\n| \u003ca name=\"output_auto_mode_kubernetes_manifest_yaml\"\u003e\u003c/a\u003e [auto\\_mode\\_kubernetes\\_manifest\\_yaml](#output\\_auto\\_mode\\_kubernetes\\_manifest\\_yaml) | All rendered EKS Auto Mode Kubernetes manifests joined into a single multi-document YAML string. |\n| \u003ca name=\"output_auto_mode_kubernetes_manifests\"\u003e\u003c/a\u003e [auto\\_mode\\_kubernetes\\_manifests](#output\\_auto\\_mode\\_kubernetes\\_manifests) | All rendered EKS Auto Mode Kubernetes YAML manifests by kind/name. |\n| \u003ca name=\"output_auto_mode_load_balancer_service_manifests\"\u003e\u003c/a\u003e [auto\\_mode\\_load\\_balancer\\_service\\_manifests](#output\\_auto\\_mode\\_load\\_balancer\\_service\\_manifests) | Rendered EKS Auto Mode LoadBalancer Service YAML manifests by name. |\n| \u003ca name=\"output_auto_mode_node_class_access_entry_arns\"\u003e\u003c/a\u003e [auto\\_mode\\_node\\_class\\_access\\_entry\\_arns](#output\\_auto\\_mode\\_node\\_class\\_access\\_entry\\_arns) | EKS access entry ARNs created for custom Auto Mode NodeClass IAM roles. |\n| \u003ca name=\"output_auto_mode_node_class_manifests\"\u003e\u003c/a\u003e [auto\\_mode\\_node\\_class\\_manifests](#output\\_auto\\_mode\\_node\\_class\\_manifests) | Rendered EKS Auto Mode NodeClass YAML manifests by name. |\n| \u003ca name=\"output_auto_mode_node_iam_role_arn\"\u003e\u003c/a\u003e [auto\\_mode\\_node\\_iam\\_role\\_arn](#output\\_auto\\_mode\\_node\\_iam\\_role\\_arn) | IAM role ARN used by EKS Auto Mode managed compute when compute is enabled. |\n| \u003ca name=\"output_auto_mode_node_iam_role_name\"\u003e\u003c/a\u003e [auto\\_mode\\_node\\_iam\\_role\\_name](#output\\_auto\\_mode\\_node\\_iam\\_role\\_name) | IAM role name used by EKS Auto Mode managed compute when compute is enabled. |\n| \u003ca name=\"output_auto_mode_node_pool_manifests\"\u003e\u003c/a\u003e [auto\\_mode\\_node\\_pool\\_manifests](#output\\_auto\\_mode\\_node\\_pool\\_manifests) | Rendered EKS Auto Mode NodePool YAML manifests by name. |\n| \u003ca name=\"output_auto_mode_storage_class_manifests\"\u003e\u003c/a\u003e [auto\\_mode\\_storage\\_class\\_manifests](#output\\_auto\\_mode\\_storage\\_class\\_manifests) | Rendered EKS Auto Mode StorageClass YAML manifests by name. |\n| \u003ca name=\"output_capability_arns\"\u003e\u003c/a\u003e [capability\\_arns](#output\\_capability\\_arns) | Amazon EKS capability ARNs by capability key. |\n| \u003ca name=\"output_capability_iam_policy_preset_names\"\u003e\u003c/a\u003e [capability\\_iam\\_policy\\_preset\\_names](#output\\_capability\\_iam\\_policy\\_preset\\_names) | Capability IAM policy preset names attached by capability key. |\n| \u003ca name=\"output_capability_iam_role_arns\"\u003e\u003c/a\u003e [capability\\_iam\\_role\\_arns](#output\\_capability\\_iam\\_role\\_arns) | IAM role ARNs used by Amazon EKS capabilities by capability key. |\n| \u003ca name=\"output_capability_iam_role_names\"\u003e\u003c/a\u003e [capability\\_iam\\_role\\_names](#output\\_capability\\_iam\\_role\\_names) | IAM role names used by Amazon EKS capabilities by capability key. |\n| \u003ca name=\"output_capability_names\"\u003e\u003c/a\u003e [capability\\_names](#output\\_capability\\_names) | Amazon EKS capability names by capability key. |\n| \u003ca name=\"output_capability_versions\"\u003e\u003c/a\u003e [capability\\_versions](#output\\_capability\\_versions) | Amazon EKS capability software versions by capability key. |\n| \u003ca name=\"output_cluster_arn\"\u003e\u003c/a\u003e [cluster\\_arn](#output\\_cluster\\_arn) | EKS cluster ARN. |\n| \u003ca name=\"output_cluster_certificate_authority_data\"\u003e\u003c/a\u003e [cluster\\_certificate\\_authority\\_data](#output\\_cluster\\_certificate\\_authority\\_data) | Base64-encoded cluster certificate authority data. |\n| \u003ca name=\"output_cluster_created_at\"\u003e\u003c/a\u003e [cluster\\_created\\_at](#output\\_cluster\\_created\\_at) | Timestamp when the EKS cluster was created. |\n| \u003ca name=\"output_cluster_endpoint\"\u003e\u003c/a\u003e [cluster\\_endpoint](#output\\_cluster\\_endpoint) | Kubernetes API server endpoint. |\n| \u003ca name=\"output_cluster_iam_role_arn\"\u003e\u003c/a\u003e [cluster\\_iam\\_role\\_arn](#output\\_cluster\\_iam\\_role\\_arn) | IAM role ARN used by the EKS control plane. |\n| \u003ca name=\"output_cluster_log_group_name\"\u003e\u003c/a\u003e [cluster\\_log\\_group\\_name](#output\\_cluster\\_log\\_group\\_name) | CloudWatch log group for EKS control plane logs, if cluster logs are enabled. |\n| \u003ca name=\"output_cluster_name\"\u003e\u003c/a\u003e [cluster\\_name](#output\\_cluster\\_name) | EKS cluster name. |\n| \u003ca name=\"output_cluster_oidc_issuer_url\"\u003e\u003c/a\u003e [cluster\\_oidc\\_issuer\\_url](#output\\_cluster\\_oidc\\_issuer\\_url) | OIDC issuer URL for the EKS cluster. |\n| \u003ca name=\"output_cluster_platform_version\"\u003e\u003c/a\u003e [cluster\\_platform\\_version](#output\\_cluster\\_platform\\_version) | EKS platform version. |\n| \u003ca name=\"output_cluster_security_group_id\"\u003e\u003c/a\u003e [cluster\\_security\\_group\\_id](#output\\_cluster\\_security\\_group\\_id) | Security group created by EKS for the cluster. |\n| \u003ca name=\"output_cluster_status\"\u003e\u003c/a\u003e [cluster\\_status](#output\\_cluster\\_status) | EKS cluster status. |\n| \u003ca name=\"output_cluster_tags_all\"\u003e\u003c/a\u003e [cluster\\_tags\\_all](#output\\_cluster\\_tags\\_all) | All tags applied to the EKS cluster, including provider default tags. |\n| \u003ca name=\"output_cluster_version\"\u003e\u003c/a\u003e [cluster\\_version](#output\\_cluster\\_version) | Kubernetes version running on the EKS cluster. |\n| \u003ca name=\"output_pod_identity_association_arns\"\u003e\u003c/a\u003e [pod\\_identity\\_association\\_arns](#output\\_pod\\_identity\\_association\\_arns) | EKS Pod Identity association ARNs by association key. |\n| \u003ca name=\"output_pod_identity_association_ids\"\u003e\u003c/a\u003e [pod\\_identity\\_association\\_ids](#output\\_pod\\_identity\\_association\\_ids) | EKS Pod Identity association IDs by association key. |\n| \u003ca name=\"output_pod_identity_external_ids\"\u003e\u003c/a\u003e [pod\\_identity\\_external\\_ids](#output\\_pod\\_identity\\_external\\_ids) | External IDs generated for EKS Pod Identity associations by association key. |\n| \u003ca name=\"output_pod_identity_iam_role_arns\"\u003e\u003c/a\u003e [pod\\_identity\\_iam\\_role\\_arns](#output\\_pod\\_identity\\_iam\\_role\\_arns) | IAM role ARNs used by EKS Pod Identity associations by association key. |\n| \u003ca name=\"output_pod_identity_iam_role_names\"\u003e\u003c/a\u003e [pod\\_identity\\_iam\\_role\\_names](#output\\_pod\\_identity\\_iam\\_role\\_names) | IAM role names used by EKS Pod Identity associations by association key. |\n| \u003ca name=\"output_update_kubeconfig_command\"\u003e\u003c/a\u003e [update\\_kubeconfig\\_command](#output\\_update\\_kubeconfig\\_command) | AWS CLI command to configure kubectl for this cluster. |\n\u003c!-- END_TF_DOCS --\u003e\n\n## Git Hooks\n\nEnable the repository hooks after cloning or initializing Git:\n\n```bash\ngit config core.hooksPath .githooks\n```\n\nThe pre-commit hook checks Terraform formatting and verifies that generated Terraform docs in this README are up to date.\n\nRegenerate the README module documentation manually with:\n\n```bash\nscripts/terraform-docs.sh\n```\n\n## Tests\n\nNative Terraform tests live in `tests/` and use mocked AWS provider resources, so they can run without AWS credentials or creating infrastructure:\n\n```bash\nterraform test\n```\n\nPull requests run the same tests through `.github/workflows/terraform-pr.yml`, along with formatting, generated-docs, validation, and example checks.\n\n## Local Development\n\nUse the Makefile for common local checks:\n\n```bash\nmake fmt\nmake docs\nmake check\n```\n\n## Notes\n\n- The module does not create VPC, subnet, route table, NAT gateway, or security baseline resources.\n- The public Kubernetes API endpoint is disabled by default. If you enable it, use narrow `public_access_cidrs`.\n- EKS Auto Mode manages compute from the selected built-in node pools; this module does not create managed node groups.\n- Kubernetes manifests are rendered as Terraform outputs and are not applied by this module.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnative-cube%2Fterraform-aws-eks-auto","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnative-cube%2Fterraform-aws-eks-auto","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnative-cube%2Fterraform-aws-eks-auto/lists"}