Skip to content

Infrastructure & IaC

The EKS Module Accepted the Setting and Never Sent It

Terraform applied cleanly. The cluster reached ACTIVE. Then kubectl returned 401, and it turned out that nobody, including the account that created it, had permission to talk to the thing that had just been created successfully.

The setting that grants that permission was in my configuration. The module took it, validated it, and did not pass it to AWS.

Seventeen Errors, and the Ones That Were Caused by the Fix

Provisioning EKS in a restricted AWS account produced seventeen distinct failures. What made it hard was not the count. It was that several of them only existed because of the fix for the previous one.

Three of the chains are worth walking through, because the pattern they share is the actual lesson: in a constrained environment, the correct move is often to back out rather than push forward.