(aws-eks): (Cluster handler is not well documented on what VPC endpoints it needs to make it work in Isolated Subnets)

[madrian]

Describe the issue

The documentation here states that isolated subnets are not fully supported. However, in my testing, EKS cluster creation can work using CDK in a fully private VPC with only Isolated Subnets and no proxies. I have made a PR in aws-cdk-examples here. This was also based off the discussions in this issue.

Hope to get confirmation of the minimum list of VPC endpoints that are required to make it work and add them in the documentation. What I used in the example are the following:

    List<InterfaceVpcEndpointAwsService> endpoints =
        List.of(
            InterfaceVpcEndpointAwsService.ECR,
            InterfaceVpcEndpointAwsService.ECR_DOCKER,
            InterfaceVpcEndpointAwsService.CLOUDWATCH_MONITORING,
            InterfaceVpcEndpointAwsService.CLOUDWATCH_LOGS,
            InterfaceVpcEndpointAwsService.EVENTBRIDGE,
            InterfaceVpcEndpointAwsService.STS,
            InterfaceVpcEndpointAwsService.SSM,
            InterfaceVpcEndpointAwsService.SSM_MESSAGES,
            InterfaceVpcEndpointAwsService.LAMBDA,
            InterfaceVpcEndpointAwsService.EKS,
            InterfaceVpcEndpointAwsService.EC2,
            InterfaceVpcEndpointAwsService.EC2_MESSAGES,
            InterfaceVpcEndpointAwsService.CLOUDFORMATION,
            InterfaceVpcEndpointAwsService.STEP_FUNCTIONS,
            InterfaceVpcEndpointAwsService.STEP_FUNCTIONS_SYNC);

Links

#12171
aws-samples/aws-cdk-examples#989

[pahud]

Big shout out to the eks private cluster example! Unfortunately we are not able to confirm all the details and the list of required endpoint services and we'll need the example contribution like this to help more people in this space.

Do you think we should update the document on aws-eks module? Would be great if we have a link to your example when it's merged.

[pahud]

resolving with #29201

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.