Skip to content

Fully Private Amazon EKS Cluster

This pattern demonstrates an Amazon EKS cluster that does not have internet access. The private cluster must pull images from a container registry that is within in your VPC, and also must have endpoint private access enabled. This is required for nodes to register with the cluster endpoint.

Please see this document for more details on configuring fully private EKS Clusters.

For fully Private EKS clusters requires the following VPC endpoints to be created to communicate with AWS services. This example solution will provide these endpoints if you choose to create VPC. If you are using an existing VPC then you may need to ensure these endpoints are created.

com.amazonaws.region.aps-workspaces       - If using AWS Managed Prometheus Workspace
com.amazonaws.region.ssm                  - Secrets Management
com.amazonaws.region.logs                  For CloudWatch Logs
com.amazonaws.region.sts                   If using AWS Fargate or IAM roles for service accounts
com.amazonaws.region.elasticloadbalancing  If using Application Load Balancers
com.amazonaws.region.autoscaling           If using Cluster Autoscaler


See here for the prerequisites and steps to deploy this pattern.


  1. Test by listing Nodes in in the cluster:

    kubectl get nodes
    NAME                                        STATUS   ROLES    AGE     VERSION    Ready    <none>   8m34s   v1.26.2-eks-a59e1f0   Ready    <none>   8m36s   v1.26.2-eks-a59e1f0    Ready    <none>   8m35s   v1.26.2-eks-a59e1f0
  2. Test by listing all the Pods running currently. All the Pods should reach a status of Running after approximately 60 seconds:

    kubectl get pods -A
    NAMESPACE     NAME                       READY   STATUS    RESTARTS   AGE
    kube-system   aws-node-j2n9x             1/1     Running   0          7m42s
    kube-system   aws-node-m1jlf             1/1     Running   0          7m45s
    kube-system   aws-node-q458h             1/1     Running   0          7m49s
    kube-system   coredns-6c45d94f67-495rr   1/1     Running   0          14m
    kube-system   coredns-6c45d94f67-5c8tc   1/1     Running   0          14m
    kube-system   kube-proxy-47wfh           1/1     Running   0          8m32s
    kube-system   kube-proxy-f6chz           1/1     Running   0          8m30s
    kube-system   kube-proxy-x2fkc           1/1     Running   0          8m31s


terraform destroy -target="module.eks_blueprints_addons" -auto-approve
terraform destroy -target="module.eks" -auto-approve
terraform destroy -auto-approve

See here for more details on cleaning up the resources created.