The CloudPosse Terraform module for an EKS Managed Node Group provides a repeatable, infrastructure-as-code method for provisioning worker capacity for an Amazon EKS cluster. It is designed to work alongside the CloudPosse EKS Cluster module and the broader reference architecture that integrates with Karpenter and EKS addons. The module creates a managed node group for an EKS cluster and assumes the cluster already exists, though both can be created in the same Terraform configuration.

Overview of CloudPosse EKS Modules

Cloud Posse maintains a library of Terraform modules for AWS that follow component-based design principles. The EKS cluster module provisions a fully configured AWS EKS Elastic Kubernetes Service cluster engineered to integrate smoothly with Karpenter and EKS addons, forming a critical part of Cloud Posse's reference architecture.

The module provisions the following resources:
- EKS cluster of master nodes that can be used together with the terraform-aws-eks-node-group and terraform-aws-eks-fargate-profile modules to create a full-blown EKS/Kubernetes cluster. You can also use the terraform-aws-eks-workers module to provision worker nodes for the cluster, but it is now rare for that to be a better choice than to use terraform-aws-eks-node-group

The node group module complements this by provisioning the worker tier. Instantiate it multiple times to create EKS Managed Node Groups with specific settings such as GPUs, EC2 instance types, or autoscale parameters.

Terraform AWS EKS Cluster Module

Terraform module to provision an EKS cluster on AWS.

This Terraform module provisions a fully configured AWS EKS Elastic Kubernetes Service cluster. It's engineered to integrate smoothly with Karpenter and EKS addons, forming a critical part of Cloud Posse's reference architecture. Ideal for teams looking to deploy scalable and manageable Kubernetes clusters on AWS with minimal fuss.

The module is built around a set of upstream dependencies.

• capability_label 0.25.0 cloudposse/label/null IAM roles for capabilities that don't provide their own
• label 0.25.0 cloudposse/label/null n/a
• this 0.25.0 cloudposse/label/null n/a

Resources used by this module include:

• awscloudwatchlog_group.default
• awseksaccess_entry.linux
• awseksaccess_entry.map
• awseksaccess_entry.standard
• awseksaccess_entry.windows
• awseksaccesspolicyassociation.list
• awseksaccesspolicyassociation.map
• awseksaddon.cluster
• awsekscapability.default
• awsekscluster.default
• awsiamopenidconnectprovider.default
• awsiampolicy.clusterelbservice_role
• awsiamrole.capability
• awsiamrole.default
• awsiamrolepolicyattachment.amazonekscluster_policy
• awsiamrolepolicyattachment.amazoneksservice_policy
• awsiamrolepolicyattachment.auto_mode
• awsiamrolepolicyattachment.clusterelbservice_role
• awskmsalias.cluster
• awskmskey.cluster
• awsvpcsecuritygroupingressrule.customingress_rules
• awsvpcsecuritygroupingressrule.managedingresscidrblocks
• awsvpcsecuritygroupingressrule.managedingresssecuritygroups

Data sources used by this module are referenced in the module documentation.

Terraform AWS EKS Node Group Module

Terraform module to provision an EKS Managed Node Group for Elastic Kubernetes Service.

IMPORTANT: When SSH access is enabled without specifying a source security group, this module provisions EKS Node Group nodes that are globally accessible by SSH (22) port. Normally, AWS recommends that no security group allows unrestricted ingress access to port 22 .

Introduction
This module creates an EKS Managed Node Group for an EKS cluster.
It assumes you have already created an EKS cluster, but you can create the cluster and the node group in the same Terraform configuration. See our full-featured root module (a.k.a. component) eks/cluster for an example of how to do that.

Launch Templates
This module always uses a launch template to create the node group. You can create your own launch template and pass in its ID, or else this module will create one for you.

The AWS default for EKS is that if the launch template is updated, the existing nodes will not be affected. Only new instances added to the node group would get the changes specified in the new launch template

The module is intended to be instantiated multiple times within a single configuration to model different workload profiles. Parameters such as instancetypes, subnetids, minsize, maxsize, clustername, createbeforedestroy, and kubernetesversion can be set per instance.

Managed Node Groups in Amazon EKS

Amazon EKS managed node groups create and manage Amazon EC2 instances for you.

Every managed node is provisioned as part of an Amazon EC2 Auto Scaling group that's managed for you by Amazon EKS.

It automatically reacts to detected problems and replaces nodes when possible. This helps overall availability of the cluster with minimal manual intervention. For more information, see Detect node health issues and enable automatic node repair.

You can add a managed node group to new or existing clusters using the Amazon EKS console, eksctl, AWS CLI, AWS API, or infrastructure as code tools including AWS CloudFormation. Nodes launched as part of a managed node group are automatically tagged for auto-discovery by the Kubernetes Cluster Autoscaler

There are no additional costs to use Amazon EKS managed node groups, you only pay for the AWS resources you provision. These include Amazon EC2 instances, Amazon EBS volumes, Amazon EKS cluster hours, and any other AWS infrastructure. There are no minimum fees and no upfront commitments.

To get started with a new Amazon EKS cluster and managed node group, see Get started with Amazon EKS – AWS Management Console and AWS CLI.
To add a managed node group to an existing cluster, see Create a managed node group for your cluster.

Managed node groups concepts
-
Amazon EKS managed node groups create and manage Amazon EC2 instances for you.
-
Every managed node is provisioned as part of an Amazon EC2 Auto Scaling group that's managed for you by Amazon EKS

Integration with CloudPosse Components

A typical composition uses dynamic subnets, an EKS cluster, and one or more node groups.

```hcl
module "eks_cluster" {
source = "cloudposse/eks-cluster/aws"

Cloud Posse recommends pinning every module to a specific version

version = "4.x.x"

vpcid = module.vpc.vpcid
subnetids = module.subnets.publicsubnetids
kubernetesversion = var.kubernetesversion
oidcproviderenabled = true
context = module.label.context
}
module "eksnode_group" {
source = "cloudposse/eks-node-group/aws"

Cloud Posse recommends pinning every module to a specific version

version = "3.x.x"

instancetypes = [var.instancetype]
subnetids = module.subnets.publicsubnetids
minsize = var.minsize
maxsize = var.maxsize
clustername = module.ekscluster.eksclusterid
createbeforedestroy = true
kubernetesversion = var.kubernetesversion == null || var.kubernetesversion == ""
}
```

The eks_cluster module outputs values that downstream modules consume. Representative outputs include:

These outputs support referencing the cluster and its node group roles from addons, Karpenter, and IAM policies.

Launch Template Behavior and Updates

The node group module always uses a launch template to create the node group. You can create your own launch template and pass in its ID, or else this module will create one for you.

The AWS default for EKS is that if the launch template is updated, the existing nodes will not be affected. Only new instances added to the node group would get the changes specified in the new launch template

This behavior is important for safe rollouts. Changes to instance types, AMI, security groups, or user data require a managed node group update or replacement to reach existing nodes. The createbeforedestroy flag can be used to minimize downtime during node group scaling events.

Versioning and Release Notes

The module follows semantic versioning. Cloud Posse recommends pinning every module to a specific version.

Release history includes:

• v3.4.0
  Reintroduce Cluster Autoscaler label and taint tags Jan Costandius (@tionichm) (#221)
  

  what - Uncomment Kubernetes label and taint tags

Pinning to version = "3.x.x" or an explicit 3.4.0 ensures reproducible builds across teams.

Security Considerations

SSH access defaults are explicitly called out. When SSH access is enabled without specifying a source security group, this module provisions EKS Node Group nodes that are globally accessible by SSH (22) port. Normally, AWS recommends that no security group allows unrestricted ingress access to port 22 .

Best practice is to supply a source security group or restrict CIDR blocks to known administrative ranges. The module also creates IAM roles for the node group with policies for cluster access, ELB service role, and auto mode attachments.

Conclusion

The CloudPosse terraform-aws-eks-node-group module provides a focused, repeatable implementation of Amazon EKS managed node groups with Terraform. It pairs with the terraform-aws-eks-cluster module to deliver a complete control plane and worker tier using launch templates, managed Auto Scaling groups, and IAM roles that are automatically tagged for Cluster Autoscaler discovery.

The design emphasizes safety through launch template isolation, where updates do not retroactively modify existing nodes, and through explicit security guidance around SSH exposure. Integration examples show how the cluster and node group modules compose with dynamic subnets and VPC modules, with outputs such as eksclusterversion, eksmanagednodeworkersrolearns, eksnodegrouparns, eksnodegroupcount, eksnodegroupids, and eksnodegrouprolenames enabling downstream wiring.

For production use, pin module versions, define distinct node groups per workload profile, and restrict node group security groups before enabling SSH. Combined with the EKS cluster module's resource set including awsekscluster.default, awsiamopenidconnectprovider.default, awskmskey.cluster, and related access entries and policy associations, the components deliver a scalable, manageable Kubernetes footprint on AWS with minimal manual intervention and no additional managed node group fees beyond underlying AWS resources.

Sources

1. docs.cloudposse.com/modules/library/aws/eks-cluster
2. cloudposse.github.io/terraform-aws-components/modules/eks
3. docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html
4. github.com/cloudposse/terraform-aws-eks-node-group/releases
5. github.com/cloudposse/terraform-aws-eks-node-group
6. docs.cloudposse.com/modules/library/aws/eks-node-group