AWS EKS VPC + Terraform

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
  default_tags {
    tags = {
      Terraform   = "true"
      Environment = "prod"
    }
  }
}

variable "eks_cluster_name" {
  type    = string
  default = "my-eks-prod"
}

variable "vpc_name" {
  type    = string
  default = "my-vpc-prod"
}

variable "pod_identity_namespace" {
  type    = string
  default = "project-n"
}

variable "pod_identity_service_account" {
  type    = string
  default = "sample-sa"
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "6.6.1"

  name = var.vpc_name
  cidr = "10.0.0.0/16"

  # Span all 3 AZs for high availability.
  azs             = ["us-east-1a", "us-east-1b", "us-east-1c"]
  private_subnets = ["10.0.0.0/20", "10.0.16.0/20", "10.0.32.0/20"]  # nodes
  public_subnets  = ["10.0.48.0/24", "10.0.49.0/24", "10.0.50.0/24"] # ALB + NAT

  # HA egress: one NAT per AZ so one AZ failure can't cut off the others.
  enable_nat_gateway     = true
  single_nat_gateway     = false
  one_nat_gateway_per_az = true
  enable_dns_hostnames   = true   # required for the private endpoint + CNI
  enable_dns_support     = true

  # Subnet discovery: the LB controller + Auto Mode find subnets by these tags.
  public_subnet_tags = {
    "kubernetes.io/role/elb"                        = 1   # internet-facing LBs
    "kubernetes.io/cluster/${var.eks_cluster_name}" = "owned"
  }
  private_subnet_tags = {
    "kubernetes.io/role/internal-elb"               = 1   # internal LBs + nodes
    "kubernetes.io/cluster/${var.eks_cluster_name}" = "owned"
  }
}

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "21.23.0"

  vpc_id                   = module.vpc.vpc_id
  subnet_ids               = module.vpc.private_subnets   # nodes (no public IP)
  control_plane_subnet_ids = module.vpc.private_subnets   # control-plane ENIs

  name                = var.eks_cluster_name
  authentication_mode = "API"
  kubernetes_version  = "1.36"

  enabled_log_types = ["api", "audit", "authenticator",
                       "controllerManager", "scheduler"]

  endpoint_public_access                   = true
  endpoint_private_access                  = true
  enable_cluster_creator_admin_permissions = true

  create_auto_mode_iam_resources = true
  compute_config = {
    enabled    = true
    node_pools = ["general-purpose", "system"]
  }
}

# Trust: let the Pod Identity principal assume this role.
# sts:TagSession is required so EKS can attach session tags.
data "aws_iam_policy_document" "pod_identity_trust" {
  statement {
    effect    = "Allow"
    actions   = ["sts:AssumeRole", "sts:TagSession"]
    principals {
      type        = "Service"
      identifiers = ["pods.eks.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "app" {
  name               = "${var.eks_cluster_name}-app-pod-identity"
  assume_role_policy = data.aws_iam_policy_document.pod_identity_trust.json
}

# Bind the role to a namespace + service account in the cluster.
resource "aws_eks_pod_identity_association" "app" {
  cluster_name    = module.eks.cluster_name
  namespace       = var.pod_identity_namespace        # project-n
  service_account = var.pod_identity_service_account  # sample-sa
  role_arn        = aws_iam_role.app.arn
}

terraform init && terraform apply

# Write a dedicated kubeconfig instead of merging into ~/.kube/config.
aws eks update-kubeconfig --name my-eks-prod --region us-east-1 \
  --kubeconfig ./kubeconfig.yaml
export KUBECONFIG=./kubeconfig.yaml

# Nodes are named by instance id; -L surfaces the AZ label.
kubectl get nodes -L topology.kubernetes.io/zone
kubectl get nodepools          # general-purpose + system, READY, NODES from 0

# Confirm the subnets are tagged for this cluster:
aws ec2 describe-subnets \
  --filters "Name=tag:kubernetes.io/cluster/my-eks-prod,Values=owned" \
  --query 'Subnets[].{az:AvailabilityZone,cidr:CidrBlock}' --output table