Kubernetes Cluster
AWS architecture template · EKS control plane with VPC, IAM role, private endpoint, and CloudWatch logging
Kubernetes Cluster is a free AWS architecture template built with CloudWatch, EKS and IAM. Open it in TheArchitect to edit the diagram, estimate monthly cost, and export the CloudFormation or Terraform that deploys it.
AWS services in this template
- CloudWatch
- EKS
- IAM
Deployment notes
Deploy-ready
- Creates the EKS control plane with a generated IAM role and managed VPC subnet references. Node groups and workload services should be added next.
Generated CloudFormation — 31 resources
| Logical ID | Resource type |
|---|---|
| ArchitectdemoVPC10100016vpc | AWS::EC2::VPC |
| ArchitectdemoVPC10100016vpcedgewebsgSecurityGroup | AWS::EC2::SecurityGroup |
| ArchitectdemoVPC10100016vpcappruntimesgSecurityGroup | AWS::EC2::SecurityGroup |
| ArchitectdemoVPC10100016vpcappruntimesgSecurityGroupIngressRule | AWS::EC2::SecurityGroupIngress |
| ArchitectdemoVPC10100016vpcworkersgSecurityGroup | AWS::EC2::SecurityGroup |
| ArchitectdemoVPC10100016vpcdatastoresgSecurityGroup | AWS::EC2::SecurityGroup |
| ArchitectdemoVPC10100016vpcdatastoresgSecurityGroupIngressRule | AWS::EC2::SecurityGroupIngress |
| ArchitectdemoVPC10100016vpccontrolplanesgSecurityGroup | AWS::EC2::SecurityGroup |
| ArchitectdemoVPC10100016vpcPublicSubnet1 | AWS::EC2::Subnet |
| ArchitectdemoVPC10100016vpcPublicSubnet2 | AWS::EC2::Subnet |
| ArchitectdemoVPC10100016vpcPrivateSubnet1 | AWS::EC2::Subnet |
| ArchitectdemoVPC10100016vpcPrivateSubnet2 | AWS::EC2::Subnet |
| ArchitectdemoVPC10100016vpcPrivateSubnet3 | AWS::EC2::Subnet |
| ArchitectdemoVPC10100016vpcPrivateSubnet4 | AWS::EC2::Subnet |
| ArchitectdemoVPC10100016vpcInternetGateway | AWS::EC2::InternetGateway |
| ArchitectdemoVPC10100016vpcGatewayAttachment | AWS::EC2::VPCGatewayAttachment |
| ArchitectdemoVPC10100016vpcPublicRouteTable | AWS::EC2::RouteTable |
| ArchitectdemoVPC10100016vpcPublicRoute | AWS::EC2::Route |
| ArchitectdemoVPC10100016vpcPublicSubnet1RTA | AWS::EC2::SubnetRouteTableAssociation |
| ArchitectdemoVPC10100016vpcPublicSubnet2RTA | AWS::EC2::SubnetRouteTableAssociation |
| ArchitectdemoVPC10100016vpcNatEIP | AWS::EC2::EIP |
| ArchitectdemoVPC10100016vpcNatGateway | AWS::EC2::NatGateway |
| ArchitectdemoVPC10100016vpcPrivateRouteTable | AWS::EC2::RouteTable |
| ArchitectdemoVPC10100016vpcPrivateRoute | AWS::EC2::Route |
| ArchitectdemoVPC10100016vpcPrivateSubnet1RTA | AWS::EC2::SubnetRouteTableAssociation |
| ArchitectdemoVPC10100016vpcPrivateSubnet2RTA | AWS::EC2::SubnetRouteTableAssociation |
| ArchitectdemoVPC10100016vpcPrivateSubnet3RTA | AWS::EC2::SubnetRouteTableAssociation |
| ArchitectdemoVPC10100016vpcPrivateSubnet4RTA | AWS::EC2::SubnetRouteTableAssociation |
| EKSClusterRoleiam | AWS::IAM::Role |
| EKSControlPlaneeks | AWS::EKS::Cluster |
| ControlPlaneAlarmcloudwatch | AWS::CloudWatch::Alarm |
View the full CloudFormation template
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "Generated by TheArchitect — https://www.thecloudarchitect.dev",
"Metadata": {
"TheArchitect": {
"Edges": [
{
"From": "EKSClusterRoleiam",
"To": "EKSControlPlaneeks",
"Label": "cluster role"
}
]
}
},
"Resources": {
"ArchitectdemoVPC10100016vpc": {
"Type": "AWS::EC2::VPC",
"Properties": {
"CidrBlock": "10.10.0.0/16",
"EnableDnsHostnames": true,
"EnableDnsSupport": true,
"Tags": [
{
"Key": "Name",
"Value": "architect-demo-eks-vpc"
}
]
}
},
"ArchitectdemoVPC10100016vpcedgewebsgSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupName": "edge-web-sg",
"GroupDescription": "Allow HTTPS from the internet to public load balancers",
"VpcId": {
"Ref": "ArchitectdemoVPC10100016vpc"
},
"Tags": [
{
"Key": "Name",
"Value": "edge-web-sg"
}
],
"SecurityGroupIngress": [
{
"IpProtocol": "tcp",
"FromPort": 443,
"ToPort": 443,
"CidrIp": "0.0.0.0/0"
}
],
"SecurityGroupEgress": [
{
"IpProtocol": "-1",
"CidrIp": "0.0.0.0/0"
}
]
}
},
"ArchitectdemoVPC10100016vpcappruntimesgSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupName": "app-runtime-sg",
"GroupDescription": "Allow application traffic from the edge tier",
"VpcId": {
"Ref": "ArchitectdemoVPC10100016vpc"
},
"Tags": [
{
"Key": "Name",
"Value": "app-runtime-sg"
}
],
"SecurityGroupEgress": [
{
"IpProtocol": "-1",
"CidrIp": "0.0.0.0/0"
}
]
}
},
"ArchitectdemoVPC10100016vpcappruntimesgSecurityGroupIngressRule": {
"Type": "AWS::EC2::SecurityGroupIngress",
"Properties": {
"GroupId": {
"Ref": "ArchitectdemoVPC10100016vpcappruntimesgSecurityGroup"
},
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80,
"SourceSecurityGroupId": {
"Ref": "ArchitectdemoVPC10100016vpcedgewebsgSecurityGroup"
}
}
},
"ArchitectdemoVPC10100016vpcworkersgSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupName": "worker-sg",
"GroupDescription": "Private worker runtime egress only",
"VpcId": {
"Ref": "ArchitectdemoVPC10100016vpc"
},
"Tags": [
{
"Key": "Name",
"Value": "worker-sg"
}
],
"SecurityGroupEgress": [
{
"IpProtocol": "-1",
"CidrIp": "0.0.0.0/0"
}
]
}
},
"ArchitectdemoVPC10100016vpcdatastoresgSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupName": "data-store-sg",
"GroupDescription": "Allow PostgreSQL from application runtimes",
"VpcId": {
"Ref": "ArchitectdemoVPC10100016vpc"
},
"Tags": [
{
"Key": "Name",
"Value": "data-store-sg"
}
],
"SecurityGroupEgress": [
{
"IpProtocol": "-1",
"CidrIp": "0.0.0.0/0"
}
]
}
},
"ArchitectdemoVPC10100016vpcdatastoresgSecurityGroupIngressRule": {
"Type": "AWS::EC2::SecurityGroupIngress",
"Properties": {
"GroupId": {
"Ref": "ArchitectdemoVPC10100016vpcdatastoresgSecurityGroup"
},
"IpProtocol": "tcp",
"FromPort": 5432,
"ToPort": 5432,
"SourceSecurityGroupId": {
"Ref": "ArchitectdemoVPC10100016vpcappruntimesgSecurityGroup"
}
}
},
"ArchitectdemoVPC10100016vpccontrolplanesgSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupName": "control-plane-sg",
"GroupDescription": "Private EKS control plane attachment group",
"VpcId": {
"Ref": "ArchitectdemoVPC10100016vpc"
},
"Tags": [
{
"Key": "Name",
"Value": "control-plane-sg"
}
],
"SecurityGroupEgress": [
{
"IpProtocol": "-1",
"CidrIp": "0.0.0.0/0"
}
]
}
},
"ArchitectdemoVPC10100016vpcPublicSubnet1": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "ArchitectdemoVPC10100016vpc"
},
"CidrBlock": "10.10.1.0/24",
"AvailabilityZone": "us-east-1a",
"MapPublicIpOnLaunch": true,
"Tags": [
{
"Key": "Name",
"Value": "public-edge-a"
}
]
}
},
"ArchitectdemoVPC10100016vpcPublicSubnet2": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "ArchitectdemoVPC10100016vpc"
},
"CidrBlock": "10.10.2.0/24",
"AvailabilityZone": "us-east-1b",
"MapPublicIpOnLaunch": true,
"Tags": [
{
"Key": "Name",
"Value": "public-edge-b"
}
]
}
},
"ArchitectdemoVPC10100016vpcPrivateSubnet1": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "ArchitectdemoVPC10100016vpc"
},
"CidrBlock": "10.10.11.0/24",
"AvailabilityZone": "us-east-1a",
"MapPublicIpOnLaunch": false,
"Tags": [
{
"Key": "Name",
"Value": "private-app-a"
}
]
}
},
"ArchitectdemoVPC10100016vpcPrivateSubnet2": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "ArchitectdemoVPC10100016vpc"
},
"CidrBlock": "10.10.12.0/24",
"AvailabilityZone": "us-east-1b",
"MapPublicIpOnLaunch": false,
"Tags": [
{
"Key": "Name",
"Value": "private-app-b"
}
]
}
},
"ArchitectdemoVPC10100016vpcPrivateSubnet3": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "ArchitectdemoVPC10100016vpc"
},
"CidrBlock": "10.10.21.0/24",
"AvailabilityZone": "us-east-1a",
"MapPublicIpOnLaunch": false,
"Tags": [
{
"Key": "Name",
"Value": "private-data-a"
}
]
}
},
"ArchitectdemoVPC10100016vpcPrivateSubnet4": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "ArchitectdemoVPC10100016vpc"
},
"CidrBlock": "10.10.22.0/24",
"AvailabilityZone": "us-east-1b",
"MapPublicIpOnLaunch": false,
"Tags": [
{
"Key": "Name",
"Value": "private-data-b"
}
]
}
},
"ArchitectdemoVPC10100016vpcInternetGateway": {
"Type": "AWS::EC2::InternetGateway",
"Properties": {
"Tags": [
{
"Key": "Name",
"Value": "architect-demo-eks-vpc-igw"
}
]
}
},
"ArchitectdemoVPC10100016vpcGatewayAttachment": {
"Type": "AWS::EC2::VPCGatewayAttachment",
"Properties": {
"VpcId": {
"Ref": "ArchitectdemoVPC10100016vpc"
},
"InternetGatewayId": {
"Ref": "ArchitectdemoVPC10100016vpcInternetGateway"
}
}
},
"ArchitectdemoVPC10100016vpcPublicRouteTable": {
"Type": "AWS::EC2::RouteTable",
"Properties": {
"VpcId": {
"Ref": "ArchitectdemoVPC10100016vpc"
},
"Tags": [
{
"Key": "Name",
"Value": "architect-demo-eks-vpc-public-rt"
}
]
}
},
"ArchitectdemoVPC10100016vpcPublicRoute": {
"Type": "AWS::EC2::Route",
"DependsOn": [
"ArchitectdemoVPC10100016vpcGatewayAttachment"
],
"Properties": {
"RouteTableId": {
"Ref": "ArchitectdemoVPC10100016vpcPublicRouteTable"
},
"DestinationCidrBlock": "0.0.0.0/0",
"GatewayId": {
"Ref": "ArchitectdemoVPC10100016vpcInternetGateway"
}
}
},
"ArchitectdemoVPC10100016vpcPublicSubnet1RTA": {
"Type": "AWS::EC2::SubnetRouteTableAssociation",
"Properties": {
"SubnetId": {
"Ref": "ArchitectdemoVPC10100016vpcPublicSubnet1"
},
"RouteTableId": {
"Ref": "ArchitectdemoVPC10100016vpcPublicRouteTable"
}
}
},
"ArchitectdemoVPC10100016vpcPublicSubnet2RTA": {
"Type": "AWS::EC2::SubnetRouteTableAssociation",
"Properties": {
"SubnetId": {
"Ref": "ArchitectdemoVPC10100016vpcPublicSubnet2"
},
"RouteTableId": {
"Ref": "ArchitectdemoVPC10100016vpcPublicRouteTable"
}
}
},
"ArchitectdemoVPC10100016vpcNatEIP": {
"Type": "AWS::EC2::EIP",
"DependsOn": [
"ArchitectdemoVPC10100016vpcGatewayAttachment"
],
"Properties": {
"Domain": "vpc"
}
},
"ArchitectdemoVPC10100016vpcNatGateway": {
"Type": "AWS::EC2::NatGateway",
"Properties": {
"AllocationId": {
"Fn::GetAtt": [
"ArchitectdemoVPC10100016vpcNatEIP",
"AllocationId"
]
},
"SubnetId": {
"Ref": "ArchitectdemoVPC10100016vpcPublicSubnet1"
},
"Tags": [
{
"Key": "Name",
"Value": "architect-demo-eks-vpc-nat"
}
]
}
},
"ArchitectdemoVPC10100016vpcPrivateRouteTable": {
"Type": "AWS::EC2::RouteTable",
"Properties": {
"VpcId": {
"Ref": "ArchitectdemoVPC10100016vpc"
},
"Tags": [
{
"Key": "Name",
"Value": "architect-demo-eks-vpc-private-rt"
}
]
}
},
"ArchitectdemoVPC10100016vpcPrivateRoute": {
"Type": "AWS::EC2::Route",
"Properties": {
"RouteTableId": {
"Ref": "ArchitectdemoVPC10100016vpcPrivateRouteTable"
},
"DestinationCidrBlock": "0.0.0.0/0",
"NatGatewayId": {
"Ref": "ArchitectdemoVPC10100016vpcNatGateway"
}
}
},
"ArchitectdemoVPC10100016vpcPrivateSubnet1RTA": {
"Type": "AWS::EC2::SubnetRouteTableAssociation",
"Properties": {
"SubnetId": {
"Ref": "ArchitectdemoVPC10100016vpcPrivateSubnet1"
},
"RouteTableId": {
"Ref": "ArchitectdemoVPC10100016vpcPrivateRouteTable"
}
}
},
"ArchitectdemoVPC10100016vpcPrivateSubnet2RTA": {
"Type": "AWS::EC2::SubnetRouteTableAssociation",
"Properties": {
"SubnetId": {
"Ref": "ArchitectdemoVPC10100016vpcPrivateSubnet2"
},
"RouteTableId": {
"Ref": "ArchitectdemoVPC10100016vpcPrivateRouteTable"
}
}
},
"ArchitectdemoVPC10100016vpcPrivateSubnet3RTA": {
"Type": "AWS::EC2::SubnetRouteTableAssociation",
"Properties": {
"SubnetId": {
"Ref": "ArchitectdemoVPC10100016vpcPrivateSubnet3"
},
"RouteTableId": {
"Ref": "ArchitectdemoVPC10100016vpcPrivateRouteTable"
}
}
},
"ArchitectdemoVPC10100016vpcPrivateSubnet4RTA": {
"Type": "AWS::EC2::SubnetRouteTableAssociation",
"Properties": {
"SubnetId": {
"Ref": "ArchitectdemoVPC10100016vpcPrivateSubnet4"
},
"RouteTableId": {
"Ref": "ArchitectdemoVPC10100016vpcPrivateRouteTable"
}
}
},
"EKSClusterRoleiam": {
"Type": "AWS::IAM::Role",
"Properties": {
"RoleName": "architect-demo-eks-cluster-role",
"Description": "EKS cluster role with AmazonEKSClusterPolicy.",
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "eks.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
},
"ManagedPolicyArns": [
"arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
]
}
},
"EKSControlPlaneeks": {
"Type": "AWS::EKS::Cluster",
"DependsOn": [
"EKSClusterRoleiam"
],
"Properties": {
"Name": "architect-demo-eks",
"Version": "1.35",
"Tags": [
{
"Key": "Name",
"Value": "architect-demo-eks"
}
],
"ResourcesVpcConfig": {
"SubnetIds": [
{
"Ref": "ArchitectdemoVPC10100016vpcPublicSubnet1"
},
{
"Ref": "ArchitectdemoVPC10100016vpcPublicSubnet2"
},
{
"Ref": "ArchitectdemoVPC10100016vpcPrivateSubnet1"
},
{
"Ref": "ArchitectdemoVPC10100016vpcPrivateSubnet2"
}
],
"SecurityGroupIds": [
{
"Ref": "ArchitectdemoVPC10100016vpccontrolplanesgSecurityGroup"
}
],
"EndpointPublicAccess": true,
"EndpointPrivateAccess": true
},
"AccessConfig": {
"AuthenticationMode": "API_AND_CONFIG_MAP",
"BootstrapClusterCreatorAdminPermissions": true
},
"Logging": {
"ClusterLogging": {
"EnabledTypes": [
{
"Type": "api"
},
{
"Type": "audit"
},
{
"Type": "authenticator"
},
{
"Type": "controllerManager"
},
{
"Type": "scheduler"
}
]
}
},
"RoleArn": {
"Fn::GetAtt": [
"EKSClusterRoleiam",
"Arn"
]
}
}
},
"ControlPlaneAlarmcloudwatch": {
"Type": "AWS::CloudWatch::Alarm",
"Properties": {
"AlarmName": "architect-demo-eks-api-errors",
"AlarmDescription": "Demo alarm for EKS API server error counts.",
"Namespace": "AWS/EKS",
"MetricName": "cluster_failed_request_count",
"Statistic": "Sum",
"Period": 300,
"EvaluationPeriods": 1,
"Threshold": 5,
"ComparisonOperator": "GreaterThanOrEqualToThreshold",
"TreatMissingData": "notBreaching"
}
}
}
}Generated by TheArchitect from the diagram above. Review values such as names, CIDR ranges and instance sizes before deploying to your account.