You must create a cluster role that has the permission to access EKS resources.

Copy the following contents to a file named eks-cluster-role-trust-policy.json.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Create an AWS Identity and Access Management (IAM) role with this policy document.

aws iam create-role \
  --role-name xrd-eks-cluster-role \
  --assume-role-policy-document "file://eks-cluster-role-trust-policy.json"

Make a note of the role Amazon Resource Names (ARN), <cluster-role-arn>.

Attach the EKS managed IAM policy to the role.

aws iam attach-role-policy \
  --policy-arn arn:aws:iam::aws:policy/AmazonEKSClusterPolicy \
  --role-name xrd-eks-cluster-role

You must create a role for the EKS worker nodes to connect to the EKS cluster.

Copy the following contents to the file named eks-node-role-trust-policy.json:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Note	2012-10-17 is the latest trust policy version. The Statement allows any EC2 resource to assume the worker node role and therefore obtain the associated permissions, which enable a node to join to an EKS cluster.

Create the IAM role using the following command:

aws iam create-role \
  --role-name xrd-eks-node-role \
  --assume-role-policy-document "file://eks-node-role-trust-policy.json"

Make a note of the node role ARN, <node-role-arn>.

Attach the required IAM policies to the role. For example,

aws iam attach-role-policy \
  --policy-arn arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy \
  --role-name xrd-eks-node-role
aws iam attach-role-policy \
  --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly \
  --role-name xrd-eks-node-role
aws iam attach-role-policy \
  --policy-arn arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy \
  --role-name xrd-eks-node-role

An instance profile is required to apply the Worker node role to EC2 instances.

To create an instance profile, use the following command:

aws iam create-instance-profile --instance-profile-name xrd-eks-node-profile

Make a note of the profile ARN, <node-profile-arn>.

Add the role to the new profile using the following command:

aws iam add-role-to-instance-profile \
  --instance-profile-name xrd-eks-node-profile \
  --role-name xrd-eks-node-role

Use the following command to create an EKS cluster:

aws eks create-cluster \
  --name xrd-cluster \
  --role-arn <cluster-role-arn> \
  --resources-vpc-config "subnetIds=<private-subnet-1>,<private-subnet-2>,securityGroupIds=<sg-id>,endpointPublicAccess=true,endpointPrivateAccess=true" \
  --kubernetes-version <k8s-version>

This command execution completes quickly, but the Control plane takes around 20-30 minutes to come up completely in AWS. If you want the AWS CLI tool to monitor and wait for the cluster to become active, use the following command:

aws eks wait cluster-active --name xrd-cluster

To check the status of the cluster manually, run the following command:

aws eks describe-cluster --name xrd-cluster

In the output, the "status" will be CREATING until the cluster comes up completely, and then the status changes to ACTIVE.

Note

This sample configuration sets up an EKS cluster with both public and private endpoints. The EKS cluster control plane can now receive traffic from the internet. You can restrict the IP range allowed to access the public endpoint using the publicAccessCirds configuration item, or you can remove the public endpoint entirely by setting the endpointPublicAccess item to false. For more details, see Amazon EKS cluster Endpoint Access Control.