How to Create EKS Cluster Using Terraform + IAM Roles for Service Accounts & EKS Cluster Autoscaler
Source: YouTube · Anton Putra · published Dec 27, 2021 · 16:16
This tutorial demonstrates how to provision an Amazon EKS cluster using Terraform, covering VPC creation, IAM role setup, OIDC authentication, and application deployment with load balancers and auto-scaling. 0:00-0:05
Key Takeaways:
• The infrastructure requires an AWS provider, a VPC with internet gateways and NAT gateways, and four subnets (two public, two private) to support the cluster. 0:39-1:34
• IAM roles are attached to the EKS cluster and node groups with specific policies (AmazonEKSClusterPolicy, AmazonEKSWorkerNodePolicy) to grant necessary API access. 4:25-5:52
• An OpenID Connect (OIDC) provider is configured to enable IAM Roles for Service Accounts (IRSA), allowing Kubernetes pods to assume specific IAM roles for fine-grained AWS permissions. 7:20-7:44
• A sample application is deployed and exposed using Kubernetes LoadBalancer resources, with annotations for network load balancers and private connectivity options. 10:41-11:13
• Cluster autoscaling is implemented using the OIDC provider and RBAC policies, configured with tags to automatically scale node groups based on pending pod demand. 13:00-13:36
The tutorial provides a comprehensive foundation for building scalable, secure EKS clusters with proper networking, access controls, and auto-scaling capabilities using infrastructure as code.
Sources:
- 0:00-0:05 Video intro and objectives.
- 0:39-1:34 VPC and network configuration details.
- 4:25-5:52 IAM roles for cluster and nodes.
- [7:20-7:44](https://www.youtube.com/watc
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cloud Security. Commonly maps to: Security Architecture and Engineering, Communication and Network Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
In this video, we will create an EKS cluster
using Terraform. You can use your existing VPC or create a
new one from scratch following this tutorial. When the cluster is provisioned, we will also
create OpenID connect provider using Terraform to be able to assign IAM roles to Kubernetes
service accounts. To autoscale the EKS cluster based on the
load, we will create an IAM role and use it with the autoscaller service account. I'll show you how to deploy a sample app and
expose it to the internet using the public load balancer. In case you want to keep your application
endpoint private, we will create another Kubernetes service of type load balancer and use annotations
to make it private. You can find the source code and commands
in my github repository. Let's start with terraform. First, w…