Skip to main content

aws_eks_clusters resource

[edit on GitHub]

Use the aws_eks_clusters resource to test the configuration of a collection of AWS Elastic Container Service for Kubernetes.


describe aws_eks_clusters do
  its('names.count') { should cmp 10 }


This resource does not expect any parameters.

See also the AWS documentation on EKS Clusters.


arnThe Amazon Resource Name (ARN) of the cluster.
nameThe name of the cluster.
endpointThe endpoint for your Kubernetes API server.
statusThe current status of the cluster.
versionThe Kubernetes server version for the cluster.
certificate_authorityThe certificate-authority-data for your cluster.
subnets_countThe number of subnets associated with your cluster.
subnet_idsThe subnets associated with your cluster.
security_groups_countThe count of security groups associated with your cluster.
security_group_idsThe security groups associated with the cross-account elastic network interfaces that are used to allow communication between your worker nodes and the Kubernetes control plane.
role_arnThe Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf.
vpc_idThe VPC associated with your cluster.
created_atThe Unix epoch timestamp in seconds for when the cluster was created.
creatingBoolean indicating whether or not the state of the cluster is CREATING.
activeBoolean indicating whether or not the state of the cluster is ACTIVE.
failedBoolean indicating whether or not the state of the cluster is FAILED.
deletingBoolean indicating whether or not the state of the cluster is DELETING.
entriesProvides access to the raw results of the query, which can be treated as an array of hashes.


Allow at most 100 EKS Clusters on the account

describe aws_eks_clusters do
  its('entries.count') { should be <= 100}

Ensure a specific Cluster exists, by name

describe aws_eks_clusters do
  its('names') { should include('cluster-1') }

Ensure no Clusters are in a failed state

describe aws_eks_clusters.where( failed: true ) do
    it { should_not exist )


This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our matchers page.


The control will pass if the describe returns at least one result.

Use should_not to test the entity should not exist.

describe aws_eks_clusters.where( <property>: <value>) do
  it { should exist }

describe aws_eks_clusters.where( <property>: <value>) do
  it { should_not exist }

AWS Permissions

Your Principal will need the eks:DescribeCluster action with Effect set to Allow.

You can find detailed documentation at Amazon EKS IAM Policies, Roles, and Permissions The documentation for EKS actions is at Policy Structure

Was this page helpful?


Search Results