Production-Ready Amazon EKS with Terraform — No Community Modules (2026 Edition)

CloudOpsBlog.com

12 min read

·

Oct 10, 2026

--

1

Listen

Share

A private, encrypted, IRSA-enabled EKS cluster built from raw AWS resources: the full code, 10 deployment steps, and the 5 gotchas that break most first deployments.

Updated October 2026: Now covers Amazon Linux 2023 nodes (AL2 EKS AMIs are gone for Kubernetes 1.33+), EKS Pod Identity vs IRSA, EKS Auto Mode vs self-managed, the EBS CSI permission gotcha, extended-support pricing, and how to reach a private API endpoint.

Press enter or click to view image in full size

TL;DR

• What you get: a private-by-default EKS cluster built with only native aws_* Terraform resources, with no terraform-aws-modules/eks.
• Security: private API endpoint, KMS envelope encryption for Secrets, IMDSv2 enforced on nodes, IRSA, EKS Access Entries (no aws-auth), and all 5 control-plane log types sent to CloudWatch.
• Compute: a tainted On-Demand system node group plus an elastic Spot general node group.
• Time to deploy: about 15–25 minutes.
• Code: github.com/GogineniManojkumar/cloudops/Terraform/EKS

Why I Didn’t Use the Community EKS Module

In my previous article, I built a production-grade AWS VPC with Terraform: public/private subnets, NAT Gateways, VPC…