Amazon EKS Cluster Creation via AWS CLI

Amazon EKS Cluster Creation via AWS CLI

This guide walks through creating an Amazon EKS cluster using AWS CLI, including IAM role setup, cluster creation, kubeconfig update, and verification.

Prerequisites for Creating an Amazon EKS Cluster

Before you create an Amazon EKS cluster, ensure that the following prerequisites are met.

VPC and Subnets

You must have an existing VPC and subnets that meet Amazon EKS requirements. For production clusters, review the VPC and subnet requirements carefully. If you don’t have a VPC and subnets, you can create them using an Amazon EKS-provided AWS CloudFormation template.

kubectl Installed

Ensure the kubectl command line tool is installed on your device or AWS CloudShell. The version can be the same as or up to one minor version earlier or later than the Kubernetes version of your cluster.

To install or upgrade kubectl, see Set up kubectl and eksctl.

AWS CLI Installed

Install AWS CLI version 2.12.3 or later, or version 1.27.160 or later, on your device or AWS CloudShell. To check your current version:

aws --version | cut -d / -f2 | cut -d ' ' -f1

Package managers such as yum, apt-get, or Homebrew may be behind the latest version. To install the latest version, see the AWS CLI User Guide. The AWS CLI version in CloudShell may also be outdated; update it if necessary.

IAM Principal Permissions

You need an IAM principal with permissions to create and describe an Amazon EKS cluster. For more details, see Create a local Kubernetes cluster on an Outpost and List or describe all clusters.

Step 1: Create Cluster IAM Role

First step is to create an IAM role for your EKS cluster but If you already have a cluster IAM role or are using eksctl, you can skip this step. By default, eksctl creates a role for you.
Amazon EKS also creates a service-linked role (AWSServiceRoleForAmazonEKS). Ensure your IAM identity has iam:CreateServiceLinkedRole permission.

The cluster IAM role allows EKS to manage AWS resources on your behalf. It must have the AmazonEKSClusterPolicy attached to function properly.
Create a file trust-policy.json and run below command to create the role:

The trust policy (trust-policy.json) should allow EKS to assume the role. Example content:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

To create a cluster IAM role, run the following command, replacing placeholders with your values (role name and account ID).

aws iam create-role --role-name my-cluster-role --assume-role-policy-document file://trust-policy.json

After creating the role, attach the AmazonEKSClusterPolicy to it:

aws iam attach-role-policy --role-name my-cluster-role --policy-arn arn:aws:iam::aws:policy/AmazonEKSClusterPolicy

Step 2: Create Cluster

Run the following command, replacing placeholders with your values (region, cluster name, version, account ID, role, subnet IDs, and optional security groups).

• Ensure subnets meet EKS requirements.
• Amazon EKS creates a cluster security group automatically.
• Optional flags: --no-bootstrap-self-managed-addons, --kubernetes-network-config serviceIpv4Cidr=<cidr-block>, ipFamily=ipv6.

aws eks create-cluster --region region-code --name my-cluster --kubernetes-version 1.35 \
   --role-arn arn:aws:iam::111122223333:role/myAmazonEKSClusterRole \
   --resources-vpc-config subnetIds=subnet-ExampleID1,subnet-ExampleID2,securityGroupIds=sg-ExampleID1

This command initiates the cluster creation process, which can take several minutes. It provisions the control plane and sets up necessary AWS resources.
By default, EKS installs multiple networking add-ons during cluster creation. This includes the Amazon VPC CNI, CoreDNS, and kube-proxy.
If you’d like to disable the installation of these default networking add-ons, use the parameter below. This may be used for alternate CNIs, such as Cilium.

Check cluster status until ACTIVE before proceeding.

aws eks describe-cluster --region region-code --name my-cluster --query "cluster.status"

Step 3: Update kubeconfig

eksctl users can skip this step. For AWS CLI, update kubeconfig to enable kubectl communication.

aws eks update-kubeconfig --region region-code --name my-cluster

This command adds a new context to your kubeconfig file, allowing you to interact with the EKS cluster using kubectl.

Confirm communication with kubectl:

kubectl get svc

Expected output includes the Kubernetes service with ClusterIP.

Step 4: Cluster Setup

At this point, your cluster is ready. You can proceed to configure node groups, Fargate profiles, or Auto Mode depending on your workload requirements.