Set by controls 2

Active controls fix these values.

• cloudwatch_log_group_kms_key_idstring, set to nullIf a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html)
• cloudwatch_log_group_retention_in_daysnumber, set to 365Number of days to retain log events. Default retention - 90 days

Optional 106

• access_entriesmap({...}), default {}Map of access entries to add to the cluster
• additional_security_group_idslist(string), default []List of additional, externally created security group IDs to attach to the cluster control plane
• addonsmap({...}), default nullMap of cluster addon configurations to enable for the cluster. Addon name can be the map keys or set with name
• addons_timeoutsobject({...}), default {}Create, update, and delete timeout configurations for the cluster addons
• attach_encryption_policybool, default trueIndicates whether or not to attach an additional policy for the cluster IAM role to utilize the encryption key provided
• authentication_modestring, default "API_AND_CONFIG_MAP"The authentication mode for the cluster. Valid values are CONFIG_MAP, API or API_AND_CONFIG_MAP
• cloudwatch_log_group_classstring, default nullSpecified the log class of the log group. Possible values are: STANDARD or INFREQUENT_ACCESS
• cloudwatch_log_group_tagsmap(string), default {}A map of additional tags to add to the cloudwatch log group created
• cluster_tagsmap(string), default {}A map of additional tags to add to the cluster
• compute_configobject({...}), default nullConfiguration block for the cluster compute configuration
• control_plane_egress_modestring, default nullEgress mode for the EKS control plane. Valid values are AWS_MANAGED and CUSTOMER_ROUTED
• control_plane_scaling_configobject({...}), default nullConfiguration block for the EKS Provisioned Control Plane scaling tier. Valid values for tier are standard, tier-xl, tier-2xl, tier-4xl and tier-8xl
• control_plane_subnet_idslist(string), default []A list of subnet IDs where the EKS cluster control plane (ENIs) will be provisioned. Used for expanding the pool of subnets used by nodes/node groups without replacing the EKS control plane
• createbool, default trueControls if resources should be created (affects nearly all resources)
• create_auto_mode_iam_resourcesbool, default falseDetermines whether to create/attach IAM resources for EKS Auto Mode. Useful for when using only custom node pools and not built-in EKS Auto Mode node pools
• create_cloudwatch_log_groupbool, default trueDetermines whether a log group is created by this module for the cluster logs. If not, AWS will automatically create one if logging is enabled
• create_cni_ipv6_iam_policybool, default falseDetermines whether to create an [AmazonEKS_CNI_IPv6_Policy](https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html#cni-iam-role-create-ipv6-policy)
• create_iam_rolebool, default trueDetermines whether an IAM role is created for the cluster
• create_kms_keybool, default trueControls if a KMS key for cluster encryption should be created
• create_node_iam_rolebool, default trueDetermines whether an EKS Auto node IAM role is created
• create_node_security_groupbool, default trueDetermines whether to create a security group for the node groups or use the existing node_security_group_id
• create_primary_security_group_tagsbool, default trueIndicates whether or not to tag the cluster's primary security group. This security group is created by the EKS service, not the module, and therefore tagging is handled after cluster creation
• create_security_groupbool, default trueDetermines if a security group is created for the cluster. Note: the EKS service creates a primary security group for the cluster by default
• custom_oidc_thumbprintslist(string), default []Additional list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificate(s)
• dataplane_wait_durationstring, default "30s"Duration to wait after the EKS cluster has become active before creating the dataplane components (EKS managed node group(s), self-managed node group(s), Fargate profile(s))
• deletion_protectionbool, default nullWhether to enable deletion protection for the cluster. When enabled, the cluster cannot be deleted unless deletion protection is first disabled
• eks_managed_node_groupsmap({...}), default nullMap of EKS managed node group definitions to create
• enable_auto_mode_block_storage_policy_v2bool, default falseDetermines whether to use the v2 AmazonEKSBlockStoragePolicy instead of the legacy v1 policy for the EKS Auto Mode cluster IAM role. Defaults to false (uses v1).
• enable_auto_mode_custom_tagsbool, default trueDetermines whether to enable permissions for custom tags resources created by EKS Auto Mode
• enable_cluster_creator_admin_permissionsbool, default falseIndicates whether or not to add the cluster creator (the identity used by Terraform) as an administrator via access entry
• enable_irsabool, default trueDetermines whether to create an OpenID Connect Provider for EKS to enable IRSA
• enable_kms_key_rotationbool, default trueSpecifies whether key rotation is enabled
• enabled_log_typeslist(string), default [...]A list of the desired control plane logs to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html)
• encryption_configobject({...}), default {}Configuration block with encryption configuration for the cluster
• encryption_policy_descriptionstring, default "Cluster encryption policy to allow cluster role to utilize CMK provided"Description of the cluster encryption policy created
• encryption_policy_namestring, default nullName to use on cluster encryption policy created
• encryption_policy_pathstring, default nullCluster encryption policy path
• encryption_policy_tagsmap(string), default {}A map of additional tags to add to the cluster encryption policy created
• encryption_policy_use_name_prefixbool, default trueDetermines whether cluster encryption policy name (cluster_encryption_policy_name) is used as a prefix
• endpoint_private_accessbool, default trueIndicates whether or not the Amazon EKS private API server endpoint is enabled
• endpoint_public_accessbool, default falseIndicates whether or not the Amazon EKS public API server endpoint is enabled
• endpoint_public_access_cidrslist(string), default ["0.0.0.0/0"]List of CIDR blocks which can access the Amazon EKS public API server endpoint
• fargate_profilesmap({...}), default nullMap of Fargate Profile definitions to create
• force_update_versionbool, default nullForce version update by overriding upgrade-blocking readiness checks when updating a cluster
• iam_role_additional_policiesmap(string), default {}Additional policies to be added to the IAM role
• iam_role_arnstring, default nullExisting IAM role ARN for the cluster. Required if create_iam_role is set to false
• iam_role_descriptionstring, default nullDescription of the role
• iam_role_namestring, default nullName to use on IAM role created
• iam_role_pathstring, default nullThe IAM role path
• iam_role_permissions_boundarystring, default nullARN of the policy that is used to set the permissions boundary for the IAM role
• iam_role_tagsmap(string), default {}A map of additional tags to add to the IAM role created
• iam_role_use_name_prefixbool, default trueDetermines whether the IAM role name (iam_role_name) is used as a prefix
• identity_providersmap({...}), default nullMap of cluster identity provider configurations to enable for the cluster. Note - this is different/separate from IRSA
• include_oidc_root_ca_thumbprintbool, default trueDetermines whether to include the root CA thumbprint in the OpenID Connect (OIDC) identity provider's server certificate(s)
• ip_familystring, default "ipv4"The IP family used to assign Kubernetes pod and service addresses. Valid values are ipv4 (default) and ipv6. You can only specify an IP family when you create a cluster, changing this value will force a new cluster to be created
• kms_key_administratorslist(string), default []A list of IAM ARNs for [key administrators](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-administrators). If no value is provided, the current caller identity is used to ensure at least one key admin is available
• kms_key_aliaseslist(string), default []A list of aliases to create. Note - due to the use of toset(), values must be static strings and not computed values
• kms_key_deletion_window_in_daysnumber, default nullThe waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key. If you specify a value, it must be between 7 and 30, inclusive. If you do not specify a value, it defaults to 30
• kms_key_descriptionstring, default nullThe description of the key as viewed in AWS console
• kms_key_enable_default_policybool, default trueSpecifies whether to enable the default key policy
• kms_key_override_policy_documentslist(string), default []List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank sids will override statements with the same sid
• kms_key_ownerslist(string), default []A list of IAM ARNs for those who will have full key permissions (kms:*)
• kms_key_rotation_period_in_daysnumber, default nullCustom period of time between each key rotation date. If you specify a value, it must be between 90 and 2560, inclusive. If you do not specify a value, it defaults to 365
• kms_key_service_userslist(string), default []A list of IAM ARNs for [key service users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-service-integration)
• kms_key_source_policy_documentslist(string), default []List of IAM policy documents that are merged together into the exported document. Statements must have unique sids
• kms_key_userslist(string), default []A list of IAM ARNs for [key users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-users)
• kube_api_server_configobject({...}), default nullConfiguration block for customizing the Kubernetes API server
• kube_controller_manager_configobject({...}), default nullConfiguration block for customizing the Kubernetes controller manager
• kube_scheduler_configobject({...}), default nullConfiguration block for the cluster scheduler configuration. Valid values for scoring_strategy.type are LeastAllocated and MostAllocated. Resource weight must be between 1 and 100
• kubernetes_versionstring, default nullKubernetes <major>.<minor> version to use for the EKS cluster (i.e.: 1.33)
• namestring, default ""Name of the EKS cluster
• node_iam_role_additional_policiesmap(string), default {}Additional policies to be added to the EKS Auto node IAM role
• node_iam_role_descriptionstring, default nullDescription of the EKS Auto node IAM role
• node_iam_role_namestring, default nullName to use on the EKS Auto node IAM role created
• node_iam_role_pathstring, default nullThe EKS Auto node IAM role path
• node_iam_role_permissions_boundarystring, default nullARN of the policy that is used to set the permissions boundary for the EKS Auto node IAM role
• node_iam_role_tagsmap(string), default {}A map of additional tags to add to the EKS Auto node IAM role created
• node_iam_role_use_name_prefixbool, default trueDetermines whether the EKS Auto node IAM role name (node_iam_role_name) is used as a prefix
• node_security_group_additional_rulesmap({...}), default {}List of additional security group rules to add to the node security group created. Set source_cluster_security_group = true inside rules to set the cluster_security_group as source
• node_security_group_descriptionstring, default "EKS node shared security group"Description of the node security group created
• node_security_group_enable_recommended_rulesbool, default trueDetermines whether to enable recommended security group rules for the node security group created. This includes node-to-node TCP ingress on ephemeral ports and allows all egress traffic
• node_security_group_idstring, default ""ID of an existing security group to attach to the node groups created
• node_security_group_namestring, default nullName to use on node security group created
• node_security_group_tagsmap(string), default {}A map of additional tags to add to the node security group created
• node_security_group_use_name_prefixbool, default trueDetermines whether node security group name (node_security_group_name) is used as a prefix
• openid_connect_audienceslist(string), default []List of OpenID Connect audience client IDs to add to the IRSA provider
• outpost_configobject({...}), default nullConfiguration for the AWS Outpost to provision the cluster on
• prefix_separatorstring, default "-"The separator to use between the prefix and the generated timestamp for resource names
• putin_khuylobool, default trueDo you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!
• regionstring, default nullRegion where the resource(s) will be managed. Defaults to the Region set in the provider configuration
• remote_network_configobject({...}), default nullConfiguration block for the cluster remote network configuration
• security_group_additional_rulesmap({...}), default {}List of additional security group rules to add to the cluster security group created. Set source_node_security_group = true inside rules to set the node_security_group as source
• security_group_descriptionstring, default "EKS cluster security group"Description of the cluster security group created
• security_group_idstring, default ""Existing security group ID to be attached to the cluster
• security_group_namestring, default nullName to use on cluster security group created
• security_group_tagsmap(string), default {}A map of additional tags to add to the cluster security group created
• security_group_use_name_prefixbool, default trueDetermines whether cluster security group name (cluster_security_group_name) is used as a prefix
• self_managed_node_groupsmap({...}), default nullMap of self-managed node group definitions to create
• service_ipv4_cidrstring, default nullThe CIDR block to assign Kubernetes service IP addresses from. If you don't specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks
• service_ipv6_cidrstring, default nullThe CIDR block to assign Kubernetes pod and service IP addresses from if ipv6 was specified when the cluster was created. Kubernetes assigns service addresses from the unique local address range (fc00::/7) because you can't specify a custom IPv6 CIDR block when you create the cluster
• subnet_idslist(string), default []A list of subnet IDs where the nodes/node groups will be provisioned. If control_plane_subnet_ids is not provided, the EKS cluster control plane (ENIs) will be provisioned in these subnets
• tagsmap(string), default {}A map of tags to add to all resources
• timeoutsobject({...}), default nullCreate, update, and delete timeout configurations for the cluster
• upgrade_policyobject({...}), default nullConfiguration block for the cluster upgrade policy
• vpc_idstring, default nullID of the VPC where the cluster security group will be provisioned
• zonal_shift_configobject({...}), default nullConfiguration block for the cluster zonal shift