How to Set Up a Kubernetes Cluster with Terraform on AWS

export AWS_ACCESS_KEY_ID="AKIA..."
export AWS_SECRET_ACCESS_KEY="wJalrX..."
export AWS_DEFAULT_REGION="us-east-1"

Verify your setup:

aws sts get-caller-identity
# -> { "Account": "123456789012", "UserId": "AIDA...", "Arn": "arn:aws:iam::123456789012:user/your-user" }

Step 2 — Create the Terraform Project Structure

Create a clean directory and initialize the project:

mkdir -p ~/projects/eks-terraform && cd ~/projects/eks-terraform
touch main.tf variables.tf outputs.tf terraform.tfvars

Your layout will look like this:

eks-terraform/
├── main.tf              # Core infrastructure (VPC, EKS, node groups)
├── variables.tf          # Input variables
├── terraform.tfvars      # Variable values (keep out of version control)
└── outputs.tf            # Useful output values (kubeconfig, cluster name)

Step 3 — Declare Providers and Backend

Open `main.tf` in your editor and add the provider configuration:

terraform {
  required_version = ">= 1.5"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 2.23"
    }
  }

  # Optional: state stored locally. Replace with S3 backend for teams.
  backend "local" {
    path = "terraform.tfstate"
  }
}

provider "aws" {
  region = var.aws_region
}

In `variables.tf`:

variable "aws_region" {
  description = "AWS region to deploy resources"
  type        = string
  default     = "us-east-1"
}

variable "cluster_name" {
  description = "Name of the EKS cluster"
  type        = string
  default     = "nova-tech-eks"
}

variable "cluster_version" {
  description = "Kubernetes version for the cluster"
  type        = string
  default     = "1.30"
}

variable "instance_types" {
  description = "EC2 instance types for node group"
  type        = list(string)
  default     = ["t3.medium"]
}

variable "desired_node_count" {
  description = "Desired number of worker nodes"
  type        = number
  default     = 2
}

variable "min_node_count" {
  type    = number
  default = 1
}

variable "max_node_count" {
  type    = number
  default = 4
}

In `terraform.tfvars`:

aws_region      = "us-east-1"
cluster_name    = "nova-tech-eks"
cluster_version = "1.30"
instance_types  = ["t3.medium"]

Step 4 — Create a Custom VPC for EKS

EKS requires a well-configured VPC. We’ll use the official AWS VPC Terraform module. Add this to `main.tf`:

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.8.1"

  name = "${var.cluster_name}-vpc"
  cidr = "10.0.0.0/16"

  azs             = ["us-east-1a", "us-east-1b", "us-east-1c"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]

  enable_nat_gateway           = true
  enable_vpn_gateway           = false
  enable_dns_hostnames         = true
  enable_dns_support           = true
  single_nat_gateway           = false
  one_nat_gateway_per_az       = false

  public_subnet_tags = {
    "kubernetes.io/role/elb" = "1"
  }

  private_subnet_tags = {
    "kubernetes.io/role/internal-elb" = "1"
  }

  tags = {
    Environment = "dev"
    Project     = var.cluster_name
  }
}

**Why this matters:** EKS automatically provisions Load Balancers in public subnets and internal load balancers in private subnets. The tags above tell EKS which subnets to use.

Step 5 — Provision the EKS Cluster (Control Plane)

Still in `main.tf`, add the EKS module:

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "20.8.5"

  cluster_name    = var.cluster_name
  cluster_version = var.cluster_version

  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets

  cluster_endpoint_public_access  = true
  cluster_endpoint_private_access = false

  # Control plane security group: allow all traffic from VPC
  cluster_security_group_additional_rules = {
    ingress_self = {
      description = "Allow ingress from cluster itself"
      protocol    = "-1"
      from_port   = 0
      to_port     = 0
      type        = "ingress"
      cidr_blocks = ["10.0.0.0/16"]
    }
  }

  # Enable EKS-managed add-ons
  cluster_addons = {
    coredns = {
      most_recent = true
    }
    kube-proxy = {
      most_recent = true
    }
    vpc-cni = {
      most_recent = true
    }
  }
}

Step 6 — Add Managed Node Groups

Worker nodes run your actual container workloads. Attach them to the EKS module block:

Append inside the `module “eks” { }` block:

  eks_managed_node_groups = {
    main = {
      desired_size = var.desired_node_count
      min_size     = var.min_node_count
      max_size     = var.max_node_count

      instance_types = var.instance_types

      # Use a custom AMI with a sensible disk size
      block_device_mappings = {
        xvda = {
          device_name = "/dev/xvda"
          ebs = {
            volume_size           = 40
            volume_type           = "gp3"
            encrypted             = true
            delete_on_termination = true
          }
        }
      }

      tags = {
        "kubernetes.io/cluster/${var.cluster_name}" = "owned"
      }
    }
  }

The full EKS module now looks like this (skeleton):

module "eks" {
  source                   = "terraform-aws-modules/eks/aws"
  version                  = "20.8.5"
  cluster_name             = var.cluster_name
  cluster_version          = var.cluster_version
  vpc_id                   = module.vpc.vpc_id
  subnet_ids               = module.vpc.private_subnets
  cluster_endpoint_public_access = true
  cluster_addons           = { ... }
  eks_managed_node_groups  = { main = { ... } }
}

Step 7 — Configure Data Sources and Outputs

In `outputs.tf`, add values you’ll need after provisioning:

output "cluster_endpoint" {
  description = "Endpoint for your EKS Kubernetes API"
  value       = module.eks.cluster_endpoint
}

output "cluster_name" {
  description = "EKS cluster name"
  value       = module.eks.cluster_name
}

output "cluster_certificate_authority_data" {
  description = "Base64-encoded certificate data required to communicate with the cluster"
  value       = module.eks.cluster_certificate_authority_data
}

output "region" {
  description = "AWS region"
  value       = var.aws_region
}

Also add a data source in `main.tf` to fetch the caller identity (used by the Kubernetes provider):

data "aws_caller_identity" "current" {}

Step 8 — Deploy the Infrastructure

Now the exciting part — apply the Terraform plan:

cd ~/projects/eks-terraform

terraform init
# -> Initializing modules...
# -> Terraform has been successfully initialized!

terraform plan
# Review the output — you should see ~80+ resources to be created

If everything looks good:

terraform apply -auto-approve

This will take 15–25 minutes (EKS control plane provisioning is the bottleneck). Grab a coffee. Terraform will show progress as resources are created:

module.vpc.aws_vpc.this: Creating...
module.vpc.aws_subnet.private[0]: Creation complete...
...
module.eks.module.eks_cluster.aws_eks_cluster.this: Still creating... [10m elapsed]
...
Apply complete! Resources: 84 added, 0 changed, 0 destroyed.

aws eks update-kubeconfig \
  --region $(terraform output -raw region) \
  --name $(terraform output -raw cluster_name)

Added new context arn:aws:eks:us-east-1:123456789012:cluster/nova-tech-eks to /home/user/.kube/config

kubectl cluster-info
# -> Kubernetes control plane is running at https://...
# -> CoreDNS is running at https://...

kubectl get nodes
# -> NAME                          STATUS   ROLES    AGE   VERSION
# -> ip-10-0-1-xx.ec2.internal    Ready    <none>   5m    v1.30.0-eks-...
# -> ip-10-0-2-xx.ec2.internal    Ready    <none>   5m    v1.30.0-eks-...

kubectl create deployment nginx-test \
  --image=nginx:alpine \
  --replicas=3

kubectl expose deployment nginx-test \
  --type=LoadBalancer \
  --port=80 \
  --target-port=80

kubectl get pods -w
# -> nginx-test-xxxxx-xxxxx   1/1   Running
# -> nginx-test-xxxxx-xxxxx   1/1   Running
# -> nginx-test-xxxxx-xxxxx   1/1   Running

kubectl get svc nginx-test
# -> NAME         TYPE           EXTERNAL-IP     PORT(S)
# -> nginx-test   LoadBalancer   a1234-....elb.amazonaws.com   80:31234/TCP

curl http://a1234-....elb.amazonaws.com
# -> Welcome to nginx!

kubectl delete deployment nginx-test
kubectl delete svc nginx-test

terraform destroy -auto-approve

Destroy complete! Resources: 84 destroyed.

aws iam list-attached-user-policies --user-name YOUR_USER

# Check node status
kubectl describe node <node-name>

# Check node group events
aws eks describe-nodegroup \
  --cluster-name nova-tech-eks \
  --nodegroup-name main

# Re-generate kubeconfig
aws eks update-kubeconfig --region us-east-1 --name nova-tech-eks

# Verify public endpoint
aws eks describe-cluster --name nova-tech-eks \
  --query "cluster.resourcesVpcConfig.endpointPublicAccess"
# -> true

aws configure
# OR
export AWS_ACCESS_KEY_ID="..."
export AWS_SECRET_ACCESS_KEY="..."

aws ec2 describe-availability-zones --region us-east-1