EKS Managed Node Groups with Terraform: Production Configuration and Lifecycle Management

Introduction

Running Kubernetes on AWS means running EKS. When you want worker nodes managed by AWS with patching, updates, and graceful draining during upgrades, managed node groups are the way to go. They handle the EC2 lifecycle so you can focus on workloads instead of babysitting instances. Terraform provides two primary patterns for provisioning EKS Managed Node Groups: the integrated eksmanagednode_groups configuration within the terraform-aws-eks module and standalone modules that provision a node group for an existing cluster. Both patterns rely on AWS-managed compute capacity where AWS handles the lifecycle of the underlying EC2 instances while providing integration with EKS cluster operations like scaling, updates, and node registration.

Overview of EKS Managed Node Groups

EKS Managed Node Groups provide AWS-managed compute capacity for EKS clusters, where AWS handles the lifecycle of the underlying EC2 instances while providing integration with EKS cluster operations like scaling, updates, and node registration.

Amazon EKS managed node groups automate the provisioning and lifecycle management of nodes for Amazon EKS Kubernetes clusters. With Amazon EKS managed node groups, you don’t need to separately provision or register the Amazon EC2 instances that provide compute capacity to run your Kubernetes applications. You can create, automatically update, or terminate nodes for your cluster with a single operation. Node updates and terminations automatically drain nodes to ensure that your applications stay available.

Every managed node is provisioned as part of an Amazon EC2 Auto Scaling group that’s managed for you by Amazon EKS. Every resource including the instances and Auto Scaling groups runs within your AWS account. Each node group runs across multiple Availability Zones that you define.

Managed node groups can also optionally leverage node auto repair, which continuously monitors the health of nodes. It automatically reacts to detected problems and replaces nodes when possible. This helps overall availability of the cluster with minimal manual intervention.

EKS Managed Node Groups are created through the main EKS module by defining eksmanagednode_groups configurations. For information about self-managed node groups using Auto Scaling Groups, see Self-Managed Node Groups. For serverless compute using AWS Fargate, see Fargate Profiles. For user data and bootstrap configuration, see User Data Configuration.

Terraform Module Architecture

The terraform-aws-eks module implements managed node groups as a separate sub-module that creates the necessary AWS resources and integrates with the cluster.

Main Module Integration

Sources: node_groups.tf263-385

The EKS Managed Node Group sub-module creates several interconnected AWS resources to provide managed compute capacity for the EKS cluster.

Node Group Resource Configuration

The primary awseksnode_group resource is defined in modules/eks-managed-node-group/main.tf447-545

Key configuration includes:

• min_size
• max_size
• desired_size
  for autoscaling behavior
• instance_types
• capacity_type
• ON_DEMAND/SPOT
• ami_type
• update_config
• noderepairconfig

EKS Managed Node Groups can use custom launch templates to provide advanced EC2 configuration beyond what the managed service provides by default.

Launch Template Creation Logic

The module creates a launch template when createlaunchtemplate = true and usecustomlaunch_template = true.

This design allows each node group to be implemented as a separate sub-module that creates the necessary AWS resources and integrates with the cluster. The pattern supports multiple node groups with different instance types, capacity types, and autoscale parameters within the same cluster.

Launch Template and Node Provisioning

This module always uses a launch template to create the node group. You can create your own launch template and pass in its ID, or else this module will create one for you.

The AWS default for EKS is that if the launch template is updated, the existing nodes will not be affected. Only new instances added to the node group would get the changes specified in the new launch template.

Using a launch template enables advanced EC2 configuration beyond what the managed service provides by default. Configuration can include instance metadata options, detailed monitoring, and custom user data for bootstrap.

The module creates an EKS Managed Node Group for an EKS cluster. It assumes you have already created an EKS cluster, but you can create the cluster and the node group in the same Terraform configuration. See our full-featured root module eks/cluster for an example of how to do that.

Important security note for SSH access:

When SSH access is enabled without specifying a source security group, this module provisions EKS Node Group nodes that are globally accessible by SSH 22 port. Normally, AWS recommends that no security group allows unrestricted ingress access to port 22.

Terraform Foundation Standalone Module

Terraform module to provision an EKS Managed Node Group for Elastic Kubernetes Service.

Instantiate it multiple times to create EKS Managed Node Groups with specific settings such as GPUs, EC2 instance types, or autoscale parameters.

The module creates an EKS Managed Node Group for an EKS cluster. It assumes you have already created an EKS cluster, but you can create the cluster and the node group in the same Terraform configuration.

Provider requirements for the standalone module are:

Configuration options enable the Kubernetes cluster auto-scaler to find the auto-scaling group:

clusterautoscalerenabled = var.autoscalingpoliciesenabled

context = module.label.context

Ensure the cluster is fully created before trying to add the node group:

moduledependson = [module.ekscluster.kubernetesconfigmapid]

The module exposes outputs for integration and observability:

Related projects for larger architectures include:

• terraform-aws-eks-cluster - Terraform module to provision an EKS cluster on AWS
• terraform-aws-eks-workers - Terraform module to provision an AWS AutoScaling Group, IAM Role, and Security Group for EKS Workers
• terraform-aws-ec2-autoscale-group - Terraform module to provision Auto Scaling Group and Launch Template on AWS

Production Deployment Patterns

This guide walks through building a production-ready EKS cluster with managed node groups in Terraform. We will cover the VPC, IAM roles, the cluster itself, node groups with different instance types, and launch template customization.

Prerequisites

You need the AWS provider configured and a VPC with subnets ready. If you are starting from scratch, we will build the VPC as part of this setup.

hcl terraform { required_version = ">= 1.5.0" required_providers { aws = { source = "hashicorp/aws" version = "~> 5.0" } } } provider "aws" { region = "us-east-1" }

Building the VPC

EKS needs subnets across at least two availability zones

The VPC foundation supports the EKS control plane and the managed node groups. Node groups run across multiple Availability Zones that you define. Using at least two availability zones provides resilience for the node group Auto Scaling groups managed by AWS.

A production configuration typically defines eksmanagednode_groups with distinct settings per workload profile:

• General purpose workloads using ON_DEMAND capacity type with balanced instance types
• Cost optimized workloads using SPOT capacity type with specific instance type constraints
• GPU workloads with specialized AMI type and instance types

Each node group is created through the main EKS module by defining eksmanagednodegroups configurations. The configuration controls autoscaling behavior via minsize, maxsize, and desiredsize, instancetypes, capacitytype, amitype, updateconfig, and noderepairconfig.

Windows Node Group Prerequisites

Windows managed node-groups have a few pre-requisites.

• Your cluster must contain at least one linux based worker node
• Your EKS Cluster must have the AmazonEKSVPCResourceController and AmazonEKSClusterPolicy policies attached
• Your cluster must have a config-map called amazon-vpc-cni with the following content

yaml apiVersion: v1 kind: ConfigMap metadata: name: amazon-vpc-cni namespace: kube-system data: enable-windows-ipam: "true"

• Windows nodes will automatically be tainted
  kubernetestaints = [{
  key = "WINDOWS"
  value = "true"
  effect = "NOSCHEDULE"
  }]

• Any pods that target Windows will need to have the following attributes set in their manifest
  nodeSelector:
  kubernetes.io/os: windows
  kubernetes.io/arch: amd64

These constraints ensure networking and CNI compatibility for Windows worker nodes in a managed node group.

Outputs and Integration Points

Managed node groups integrate with the broader EKS architecture through outputs and IAM roles.

Outputs provide visibility into the created resources:

• eksnodegroup_arn
• eksnodegroup_id
• eksnodegrouplaunchtemplate_id
• eksnodegrouplaunchtemplate_name
• eksnodegrouprolearn
• eksnodegrouprolename
• eksnodegroup_status

The eksnodegrouprolearn and eksnodegrouprolename outputs allow downstream modules to reference the worker node IAM role for permissions boundary enforcement.

The eksnodegroup_resources output contains list of objects with information about underlying resources of the EKS Node Group, enabling audits of Auto Scaling groups and EC2 instances managed by AWS.

Conclusion

EKS Managed Node Groups with Terraform provide a durable way to provision AWS-managed compute capacity with declarative configuration. The terraform-aws-eks module integration allows definition of eksmanagednodegroups directly alongside the cluster, with each node group implemented as a sub-module that creates interconnected AWS resources. Key configuration levers include minsize, maxsize, desiredsize for autoscaling behavior, instancetypes, capacitytype for ONDEMAND or SPOT, amitype, updateconfig, and noderepair_config.

Launch template management is central to customization. The module creates a launch template when createlaunchtemplate is true and usecustomlaunch_template is true, and the AWS default behavior means launch template updates only affect new instances added to the node group.

The standalone Terraform Foundation module offers an alternative for provisioning EKS Managed Node Groups for an existing cluster, with support for multiple instantiations with specific settings such as GPUs, EC2 instance types, or autoscale parameters. Security considerations remain critical, particularly around SSH access where unrestricted ingress to port 22 is discouraged.

Production deployments require VPC subnets across at least two availability zones, IAM roles for worker nodes, and optional node auto repair for health monitoring. Windows node groups require additional prerequisites including a linux worker node, specific policies attached to the cluster, and VPC CNI configuration.

Together these patterns allow you to build a production-ready EKS cluster with managed node groups in Terraform while delegating EC2 lifecycle management to AWS.

Sources

1. terraform-aws-eks DeepWiki
2. Terraform Foundation terraform-aws-eks-node-group
3. Oneuptime Create EKS Cluster Managed Node Groups Terraform
4. AWS EKS User Guide Managed Node Groups