<p>Check the IAM role permission to create these Cluster in AWS by Terraform</p>

CC BY-SA 4.0
2024-08-29T12:34:47.937Z
2024-08-29T12:34:47.937Z
playwithcode
<pre><code># Configuring AWS provider
provider &quot;aws&quot; {
  region     = var.region
  access_key = var.AWS_ACCESS_KEY_ID
  secret_key = var.AWS_SECRET_ACCESS_KEY
}

# Storing the state in the S3 bucket
terraform {
  backend &quot;s3&quot; {
    bucket  = &quot;venturenox&quot;
    key     = &quot;eks-cluster/terraform.tfstate&quot;
    region  = &quot;eu-north-1&quot;
    encrypt = true
  }
}

# Create VPC
resource &quot;aws_vpc&quot; &quot;default&quot; {
  cidr_block = var.vpc_cidr
}

# Create Subnets
data &quot;aws_availability_zones&quot; &quot;available&quot; {}

resource &quot;aws_subnet&quot; &quot;subnet&quot; {
  count             = 2
  vpc_id            = aws_vpc.default.id
  cidr_block        = cidrsubnet(var.vpc_cidr, 8, count.index)
  availability_zone = element(data.aws_availability_zones.available.names, count.index)
}

# Create IAM Role for EKS Cluster
resource &quot;aws_iam_role&quot; &quot;eks_cluster_role&quot; {
  name = &quot;my-eks-cluster-role&quot;
  assume_role_policy = jsonencode({
    Version = &quot;2012-10-17&quot;,
    Statement = [
      {
        Action = &quot;sts:AssumeRole&quot;,
        Effect = &quot;Allow&quot;,
        Principal = {
          Service = &quot;eks.amazonaws.com&quot;
        }
      }
    ]
  })
}

# Attach Policies to IAM Role
resource &quot;aws_iam_role_policy_attachment&quot; &quot;eks_cluster_policy&quot; {
  role       = aws_iam_role.eks_cluster_role.name
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSClusterPolicy&quot;
}

resource &quot;aws_iam_role_policy_attachment&quot; &quot;eks_vpc_policy&quot; {
  role       = aws_iam_role.eks_cluster_role.name
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSVPCResourceController&quot;
}

# Create EKS Cluster
resource &quot;aws_eks_cluster&quot; &quot;eks&quot; {
  name     = var.cluster_name
  role_arn = aws_iam_role.eks_cluster_role.arn

  vpc_config {
    subnet_ids = aws_subnet.subnet[*].id
  }
}

# Create IAM Role for EKS Node Group
resource &quot;aws_iam_role&quot; &quot;eks_node_group_role&quot; {
  name = &quot;my-eks-node-group-role&quot;
  assume_role_policy = jsonencode({
    Version = &quot;2012-10-17&quot;,
    Statement = [
      {
        Action = &quot;sts:AssumeRole&quot;,
        Effect = &quot;Allow&quot;,
        Principal = {
          Service = &quot;ec2.amazonaws.com&quot;
        }
      }
    ]
  })
}

# Attach Policies to Node Group IAM Role
resource &quot;aws_iam_role_policy_attachment&quot; &quot;eks_worker_node_policy&quot; {
  role       = aws_iam_role.eks_node_group_role.name
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy&quot;
}

resource &quot;aws_iam_role_policy_attachment&quot; &quot;eks_cni_policy&quot; {
  role       = aws_iam_role.eks_node_group_role.name
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy&quot;
}

resource &quot;aws_iam_role_policy_attachment&quot; &quot;eks_ec2_container_policy&quot; {
  role       = aws_iam_role.eks_node_group_role.name
  policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly&quot;
}

# Create EKS Node Group
resource &quot;aws_eks_node_group&quot; &quot;node_group&quot; {
  cluster_name    = aws_eks_cluster.eks.name
  node_group_name = var.node_group_name
  node_role_arn   = aws_iam_role.eks_node_group_role.arn
  subnet_ids      = aws_subnet.subnet[*].id

  scaling_config {
    desired_size = 1
    max_size     = 2
    min_size     = 1
  }

  instance_types = [&quot;t3.micro&quot;]

  remote_access {
    ec2_ssh_key = var.ssh_key
  }
}

# Define Outputs
output &quot;vpc_id&quot; {
  value = aws_vpc.default.id
  sensitive = true
}

output &quot;subnet_ids&quot; {
  value = aws_subnet.subnet[*].id
}

output &quot;eks_cluster_name&quot; {
  value = aws_eks_cluster.eks.name
}
</code></pre>

<terraform><eks>
waiting for EKS Node Group (mzml-eks-cluster:eks-node-group) create: unexpected state 'CREATE_FAILED', wanted target 'ACTIVE'
Muhammad Muzammal
# waiting for EKS Node Group (mzml-eks-cluster:eks-node-group) create: unexpected state 'CREATE_FAILED', wanted target 'ACTIVE'

(Asked by: username_0 on 2024-08-29)

# Configuring AWS provider
provider "aws" {
  region     = var.region
  access_key = var.AWS_ACCESS_KEY_ID
  secret_key = var.AWS_SECRET_ACCESS_KEY
}

# Storing the state in the S3 bucket
terraform {
  backend "s3" {
    bucket  = "venturenox"
    key     = "eks-cluster/terraform.tfstate"
    region  = "eu-north-1"
    encrypt = true
  }
}

# Create VPC
resource "aws_vpc" "default" {
  cidr_block = var.vpc_cidr
}

# Create Subnets
data "aws_availability_zones" "available" {}

resource "aws_subnet" "subnet" {
  count             = 2
  vpc_id            = aws_vpc.default.id
  cidr_block        = cidrsubnet(var.vpc_cidr, 8, count.index)
  availability_zone = element(data.aws_availability_zones.available.names, count.index)
}

# Create IAM Role for EKS Cluster
resource "aws_iam_role" "eks_cluster_role" {
  name = "my-eks-cluster-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Action = "sts:AssumeRole",
        Effect = "Allow",
        Principal = {
          Service = "eks.amazonaws.com"
        }
      }
    ]
  })
}

# Attach Policies to IAM Role
resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
  role       = aws_iam_role.eks_cluster_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
}

resource "aws_iam_role_policy_attachment" "eks_vpc_policy" {
  role       = aws_iam_role.eks_cluster_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController"
}

# Create EKS Cluster
resource "aws_eks_cluster" "eks" {
  name     = var.cluster_name
  role_arn = aws_iam_role.eks_cluster_role.arn

  vpc_config {
    subnet_ids = aws_subnet.subnet[*].id
  }
}

# Create IAM Role for EKS Node Group
resource "aws_iam_role" "eks_node_group_role" {
  name = "my-eks-node-group-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Action = "sts:AssumeRole",
        Effect = "Allow",
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      }
    ]
  })
}

# Attach Policies to Node Group IAM Role
resource "aws_iam_role_policy_attachment" "eks_worker_node_policy" {
  role       = aws_iam_role.eks_node_group_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
}

resource "aws_iam_role_policy_attachment" "eks_cni_policy" {
  role       = aws_iam_role.eks_node_group_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
}

resource "aws_iam_role_policy_attachment" "eks_ec2_container_policy" {
  role       = aws_iam_role.eks_node_group_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
}

# Create EKS Node Group
resource "aws_eks_node_group" "node_group" {
  cluster_name    = aws_eks_cluster.eks.name
  node_group_name = var.node_group_name
  node_role_arn   = aws_iam_role.eks_node_group_role.arn
  subnet_ids      = aws_subnet.subnet[*].id

  scaling_config {
    desired_size = 1
    max_size     = 2
    min_size     = 1
  }

  instance_types = ["t3.micro"]

  remote_access {
    ec2_ssh_key = var.ssh_key
  }
}

# Define Outputs
output "vpc_id" {
  value = aws_vpc.default.id
  sensitive = true
}

output "subnet_ids" {
  value = aws_subnet.subnet[*].id
}

output "eks_cluster_name" {
  value = aws_eks_cluster.eks.name
}

**Tags:** terraform, eks


---

## 1 answers

### Answer by username_1 on 2024-08-29. Score: 0

Check the IAM role permission to create these Cluster in AWS by Terraform


---

