Learn how to – How To Deploy EKS Cluster on AWS using Terraform

Learn how to – How To Deploy EKS Cluster on AWS using Terraform.

Elastic Kubernetes Service is a managed Kubernetes service on Amazon Web Service. You can provision provides Cloud Native Computing (CNCF) applications on AWS using EKS.

Terraform on the other hand is an Infrastructure as Code(IaC) automation tool used for automation of deployments on cloud environments. You can use Terraform to manage the entire lifecycle of your cloud infrastructure. This ranges from applications, containers, and even virtual machines.

Deploying an EKS cluster on AWS can be made very easy by the use of Terraform. This is as opposed to the other methods of deployment available such CloudFormation or configuring the cluster directly on the AWS console.

In this guide, we shall cover how to setup a fully configured EKS cluster on AWS using Terraform. Follow the highlighted steps below to deploy your EKS cluster in a few minutes using Terraform.

How To Deploy EKS Cluster Using Terraform

Before we can deploy our EKS cluster on AWS, below are the requirements. Make sure you have all the items highlighted below.

1. AWS account
2. AWS user account with IAM SystemAdministrator permissions.
3. AWS CLI
4. Kubectl

Step 1. Setup AWS Account

AWS provides a free package for 12 months which includes some of the basic services. Sign up for an AWS account for free and provide your billing details. The free package however doesn’t provide EKS service for free. You will be charged for this service.

Step 2. Create AWS Policy

You can now proceed to the AWS web console after successfully creating your account. To create a user with IAM permissions to the EKS cluster, we will need to create an AWS policy that grants permissions to the said user once created.

On AWS console, go to IAM >Policies>Create Policy. Choose the JSON option then add the details below:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "autoscaling:AttachInstances",
                "autoscaling:CreateAutoScalingGroup",
                "autoscaling:CreateLaunchConfiguration",
                "autoscaling:CreateOrUpdateTags",
                "autoscaling:DeleteAutoScalingGroup",
                "autoscaling:DeleteLaunchConfiguration",
                "autoscaling:DeleteTags",
                "autoscaling:Describe*",
                "autoscaling:DetachInstances",
                "autoscaling:SetDesiredCapacity",
                "autoscaling:UpdateAutoScalingGroup",
                "autoscaling:SuspendProcesses",
                "ec2:AllocateAddress",
                "ec2:AssignPrivateIpAddresses",
                "ec2:Associate*",
                "ec2:AttachInternetGateway",
                "ec2:AttachNetworkInterface",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:CreateDefaultSubnet",
                "ec2:CreateDhcpOptions",
                "ec2:CreateEgressOnlyInternetGateway",
                "ec2:CreateInternetGateway",
                "ec2:CreateNatGateway",
                "ec2:CreateNetworkInterface",
                "ec2:CreateRoute",
                "ec2:CreateRouteTable",
                "ec2:CreateSecurityGroup",
                "ec2:CreateSubnet",
                "ec2:CreateTags",
                "ec2:CreateVolume",
                "ec2:CreateVpc",
                "ec2:CreateVpcEndpoint",
                "ec2:DeleteDhcpOptions",
                "ec2:DeleteEgressOnlyInternetGateway",
                "ec2:DeleteInternetGateway",
                "ec2:DeleteNatGateway",
                "ec2:DeleteNetworkInterface",
                "ec2:DeleteRoute",
                "ec2:DeleteRouteTable",
                "ec2:DeleteSecurityGroup",
                "ec2:DeleteSubnet",
                "ec2:DeleteTags",
                "ec2:DeleteVolume",
                "ec2:DeleteVpc",
                "ec2:DeleteVpnGateway",
                "ec2:Describe*",
                "ec2:DetachInternetGateway",
                "ec2:DetachNetworkInterface",
                "ec2:DetachVolume",
                "ec2:Disassociate*",
                "ec2:ModifySubnetAttribute",
                "ec2:ModifyVpcAttribute",
                "ec2:ModifyVpcEndpoint",
                "ec2:ReleaseAddress",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:UpdateSecurityGroupRuleDescriptionsEgress",
                "ec2:UpdateSecurityGroupRuleDescriptionsIngress",
                "ec2:CreateLaunchTemplate",
                "ec2:CreateLaunchTemplateVersion",
                "ec2:DeleteLaunchTemplate",
                "ec2:DeleteLaunchTemplateVersions",
                "ec2:DescribeLaunchTemplates",
                "ec2:DescribeLaunchTemplateVersions",
                "ec2:GetLaunchTemplateData",
                "ec2:ModifyLaunchTemplate",
                "ec2:RunInstances",
                "eks:CreateCluster",
                "eks:DeleteCluster",
                "eks:DescribeCluster",
                "eks:ListClusters",
                "eks:UpdateClusterConfig",
                "eks:UpdateClusterVersion",
                "eks:DescribeUpdate",
                "eks:TagResource",
                "eks:UntagResource",
                "eks:ListTagsForResource",
                "eks:CreateFargateProfile",
                "eks:DeleteFargateProfile",
                "eks:DescribeFargateProfile",
                "eks:ListFargateProfiles",
                "eks:CreateNodegroup",
                "eks:DeleteNodegroup",
                "eks:DescribeNodegroup",
                "eks:ListNodegroups",
                "eks:UpdateNodegroupConfig",
                "eks:UpdateNodegroupVersion",
                "iam:AddRoleToInstanceProfile",
                "iam:AttachRolePolicy",
                "iam:CreateInstanceProfile",
                "iam:CreateOpenIDConnectProvider",
                "iam:CreateServiceLinkedRole",
                "iam:CreatePolicy",
                "iam:CreatePolicyVersion",
                "iam:CreateRole",
                "iam:DeleteInstanceProfile",
                "iam:DeleteOpenIDConnectProvider",
                "iam:DeletePolicy",
                "iam:DeletePolicyVersion",
                "iam:DeleteRole",
                "iam:DeleteRolePolicy",
                "iam:DeleteServiceLinkedRole",
                "iam:DetachRolePolicy",
                "iam:GetInstanceProfile",
                "iam:GetOpenIDConnectProvider",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "iam:List*",
                "iam:PassRole",
                "iam:PutRolePolicy",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:TagOpenIDConnectProvider",
                "iam:TagRole",
                "iam:UntagRole",
                "iam:UpdateAssumeRolePolicy",
                "logs:CreateLogGroup",
                "logs:DescribeLogGroups",
                "logs:DeleteLogGroup",
                "logs:ListTagsLogGroup",
                "logs:PutRetentionPolicy",
                "kms:CreateAlias",
                "kms:CreateGrant",
                "kms:CreateKey",
                "kms:DeleteAlias",
                "kms:DescribeKey",
                "kms:GetKeyPolicy",
                "kms:GetKeyRotationStatus",
                "kms:ListAliases",
                "kms:ListResourceTags",
                "kms:ScheduleKeyDeletion"
            ],
            "Resource": "*"
        }
    ]
}

The above IAM policy gives the following permissions to the user:

1. EC2 for instance creation
2. EC2 autoscaling for worker node autoscaling
3. EKS cluster privileges
4. Cloud watch privileges for log analytics
5. IAM and KMS privileges to create policies and roles for the EKS users.

Make sure that there are no errors before you can proceed.

Click “Next” and head over to the “Review policy” section. Provide a name for the policy. You can also review and confirm the permissions being passed to the policy.

Step 3. Create AWS User

To add the user, navigate to IAM > Users > Add users.

Provide a username then check the “Programmatic access” and “AWS Management Console access” options. You can choose to use a custom password on an autogenerated one. It is advisable that the user resets the password on the first login attempt.

Proceed to the Permissions tab by pressing the “Next: Permissions” button. Here, you will be required to map the policy we created in the previous step to the user and also add administrator rights if you wish to. Select “Attach existing policies directly” then search for the policy we created in the previous step.

Proceed to the next tab where you will review the user details and permissions before you can finish the user setup.

Click on “Create user” to create the user. Download the .csv file that will contain information about the user’s Access Key ID and the secret. These details are important as we shall be using them in the next step.

The login URL for the user will also be shown on this page.

Step 4. Configure AWS CLI

AWS CLI is the binary that allows users to manage their AWS cloud infrastructure through the command line.

Download the latest version of AWS CLI version 2.

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"

Extract the downloaded package:

unzip awscliv2.zip

Install AWS CLI with sudo privileges.

sudo ./aws/install

Check and confirm that you have installed AWS CLI

$ aws --version
aws-cli/2.7.29 Python/3.9.11 Linux/4.18.0-372.9.1.el8.x86_64 exe/x86_64.rocky.8 prompt/off

Configure the user credentials and setup the default region for AWS CLI.

$ aws configure
AWS Access Key ID [None]: <your-AWS-USER-ACCESS-ID>
AWS Secret Access Key [None]: <YOUR-SECRET-KEY>
Default region name [None]: eu-west-1
Default output format [None]: json

The above details for Acess Key ID and the Secret Access Key are available on the .csv file we downloaded in the previous step. Log in to AWS web console and obtain the default region code where you wish to deploy your cluster as shown below:

To verify if your credentials have been successfully set, run the command below:

aws sts get-caller-identity

You should get an output similar to this below:

{
    "UserId": "AIKAYMPUUSVTMRUXXXXX",
    "Account": "57657XXXXXX",
    "Arn": "arn:aws:iam::57657XXXXXX:user/eks-admin"
}

Step 5. Install Kubectl tool on your bastion

Kubectl is the Kubernetes command-line tool that allows you to manage your Kubernetes cluster through the command-line.

Download the latest release of Kubectl:

curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"

Install Kubectl on Linux

sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl

Check and confirm the version of the installed Kubectl

$ kubectl version --client
Client Version: version.Info{Major:"1", Minor:"25", GitVersion:"v1.25.0", GitCommit:"a866cbe2e5bbaa01cfd5e969aa3e033f3282a8a2", GitTreeState:"clean", BuildDate:"2022-08-23T17:44:59Z", GoVersion:"go1.19", Compiler:"gc", Platform:"linux/amd64"}
Kustomize Version: v4.5.7

Check out installation guides for other Operating Systems on the Kubernetes website.

Step 6. Install Terraform Automation tool

Follow the guide below to install Terraform on your Linux server.

• How To Install Terraform on Linux

For a quick guide, follow the steps below.

Download the latest version of Terraform from GitHub.

TER_VER=`curl -s https://api.github.com/repos/hashicorp/terraform/releases/latest | grep tag_name | cut -d: -f2 | tr -d "