From 626b4ef9a7deb5685a7606545fc1124de7df0401 Mon Sep 17 00:00:00 2001
From: Andy Spiers <andy@spiers.co.uk>
Date: Thu, 28 Jan 2021 13:13:34 +0000
Subject: [PATCH 01/21] feat: remove automatic ASG replacement and support for
 name overrides

both of these unexpectedly caused whole ASG replacement when this was not desired
due to each.value being considered dynamic ("known after apply")
---
 modules/worker_groups/README.md        | 14 +++++++++++---
 modules/worker_groups/locals.tf        |  2 --
 modules/worker_groups/random.tf        | 26 --------------------------
 modules/worker_groups/worker_groups.tf | 19 +++++--------------
 4 files changed, 16 insertions(+), 45 deletions(-)
 delete mode 100644 modules/worker_groups/random.tf

diff --git a/modules/worker_groups/README.md b/modules/worker_groups/README.md
index 35f87e5..9f38fb2 100644
--- a/modules/worker_groups/README.md
+++ b/modules/worker_groups/README.md
@@ -7,25 +7,33 @@ This submodule is designed for use by both the parent `eks` module and by the us
 `worker_groups` is a map of maps. Key of first level will be used as unique value for `for_each` resources and in the `aws_autoscaling_group` and `aws_launch_template` name. Inner map can take the below values.
 
 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
-## Providers
+## Requirements
 
 | Name | Version |
 |------|---------|
+| terraform | >= 0.12.9 |
 | aws | >= 2.52.0 |
 | random | >= 2.1 |
 | template | >= 2.1 |
 
+## Providers
+
+| Name | Version |
+|------|---------|
+| aws | >= 2.52.0 |
+| template | >= 2.1 |
+
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:-----:|
+|------|-------------|------|---------|:--------:|
 | attach\_worker\_cni\_policy | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default worker groups IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-worker` DaemonSet pods via another method or workers will not be able to join the cluster. | `bool` | `true` | no |
 | cluster\_name | Name of the parent EKS cluster. | `string` | n/a | yes |
 | cluster\_security\_group\_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the workers | `string` | n/a | yes |
 | create\_eks | Controls if EKS resources should be created (it affects almost all resources). | `bool` | `true` | no |
 | iam\_path | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no |
 | manage\_worker\_iam\_resources | Whether to let the module manage worker IAM resources. If set to false, iam\_instance\_profile\_name must be specified for workers. | `bool` | `true` | no |
-| permissions\_boundary | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | n/a | yes |
+| permissions\_boundary | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | `null` | no |
 | subnets | A list of subnets to place the EKS cluster and workers within. | `list(string)` | n/a | yes |
 | tags | A map of tags to add to all resources. | `map(string)` | n/a | yes |
 | vpc\_id | VPC where the cluster and workers will be deployed. | `string` | n/a | yes |
diff --git a/modules/worker_groups/locals.tf b/modules/worker_groups/locals.tf
index 4a75a51..03b7982 100644
--- a/modules/worker_groups/locals.tf
+++ b/modules/worker_groups/locals.tf
@@ -15,7 +15,6 @@ locals {
   worker_create_security_group = var.worker_create_security_group && var.create_eks
 
   worker_groups_defaults = {
-    name                          = ""                        # Name of the worker group. Literal count.index will never be used but if name is not set, the count.index interpolation will be used.
     tags                          = []                        # A list of map defining extra tags to be applied to the worker group autoscaling group.
     ami_id                        = ""                        # AMI ID for the eks workers. If none is provided, Terraform will search for the latest version of their EKS optimized worker AMI based on platform.
     desired_capacity              = "1"                       # Desired worker capacity in the autoscaling group and changing its value will not affect the autoscaling group's desired capacity because the cluster-autoscaler manages up and down scaling of the nodes. Cluster-autoscaler add nodes when pods are in pending state and remove the nodes when they are not required by modifying the desirec_capacity of the autoscaling group. Although an issue exists in which if the value of the min_size is changed it modifies the value of desired_capacity.
@@ -23,7 +22,6 @@ locals {
     min_size                      = "1"                       # Minimum worker capacity in the autoscaling group. NOTE: Change in this paramater will affect the desired_capacity, like changing its value to 2 will change desired_capacity value to 2 but bringing back it to 1 will not affect the desired_capacity.
     force_delete                  = false                     # Enable forced deletion for the autoscaling group.
     initial_lifecycle_hooks       = []                        # Initital lifecycle hook for the autoscaling group.
-    recreate_on_change            = false                     # Recreate the autoscaling group when the Launch Template or Launch Configuration change.
     default_cooldown              = null                      # The amount of time, in seconds, after a scaling activity completes before another scaling activity can start.
     health_check_grace_period     = null                      # Time in seconds after instance comes into service before checking health.
     instance_type                 = "m4.large"                # Size of the workers instances.
diff --git a/modules/worker_groups/random.tf b/modules/worker_groups/random.tf
deleted file mode 100644
index c0d02e3..0000000
--- a/modules/worker_groups/random.tf
+++ /dev/null
@@ -1,26 +0,0 @@
-resource "random_pet" "worker_groups" {
-  for_each = local.worker_groups_expanded
-
-  separator = "-"
-  length    = 2
-
-  keepers = {
-    ami_id           = coalesce(each.value["ami_id"], each.value["platform"] == "windows" ? local.default_ami_id_windows : local.default_ami_id_linux)
-    root_volume_size = lookup(each.value, "root_volume_size", null)
-    instance_type    = each.value["instance_type"]
-
-    override_instance_types = join("|", compact(
-      lookup(each.value, "override_instance_types", [])
-    ))
-
-    iam_role_id = each.value["iam_role_id"]
-    key_name    = each.value["key_name"]
-
-    source_security_group_ids = join("|", compact(
-      lookup(each.value, "source_security_group_ids", [])
-    ))
-
-    subnet_ids        = join("|", each.value["subnets"])
-    worker_group_name = join("-", [var.cluster_name, each.key])
-  }
-}
diff --git a/modules/worker_groups/worker_groups.tf b/modules/worker_groups/worker_groups.tf
index 2ac2383..b19a0da 100644
--- a/modules/worker_groups/worker_groups.tf
+++ b/modules/worker_groups/worker_groups.tf
@@ -3,16 +3,7 @@
 resource "aws_autoscaling_group" "worker_groups" {
   for_each = local.worker_groups_expanded
 
-  name_prefix = join(
-    "-",
-    compact(
-      [
-        var.cluster_name,
-        coalesce(each.value["name"], each.key),
-        each.value["recreate_on_change"] ? random_pet.worker_groups[each.key].id : ""
-      ]
-    )
-  )
+  name_prefix = "${var.cluster_name}-${each.key}"
 
   desired_capacity          = each.value["desired_capacity"]
   max_size                  = each.value["max_size"]
@@ -91,7 +82,7 @@ resource "aws_autoscaling_group" "worker_groups" {
     [
       {
         "key"                 = "Name"
-        "value"               = "${var.cluster_name}-${coalesce(each.value["name"], each.key)}-eks_asg"
+        "value"               = "${var.cluster_name}-${each.key}-eks_asg"
         "propagate_at_launch" = true
       },
       {
@@ -119,7 +110,7 @@ resource "aws_autoscaling_group" "worker_groups" {
 resource "aws_launch_template" "worker_groups" {
   for_each = local.worker_groups_expanded
 
-  name_prefix = "${var.cluster_name}-${coalesce(each.value["name"], each.key)}"
+  name_prefix = "${var.cluster_name}-${each.key}"
 
   network_interfaces {
     associate_public_ip_address = each.value["public_ip"]
@@ -198,7 +189,7 @@ resource "aws_launch_template" "worker_groups" {
 
       tags = merge(
         {
-          "Name"                                      = "${var.cluster_name}-${coalesce(each.value["name"], each.key)}-eks_asg",
+          "Name"                                      = "${var.cluster_name}-${each.key}-eks_asg",
           "kubernetes.io/cluster/${var.cluster_name}" = "owned",
         },
         var.tags,
@@ -216,7 +207,7 @@ resource "aws_launch_template" "worker_groups" {
 resource "aws_iam_instance_profile" "worker_groups" {
   for_each = var.manage_worker_iam_resources ? local.worker_groups_expanded : {}
 
-  name_prefix = "${var.cluster_name}-${coalesce(each.value["name"], each.key)}"
+  name_prefix = "${var.cluster_name}-${each.key}"
   role        = each.value["iam_role_id"]
   path        = var.iam_path
 }

From d1e8c08529afc3d93b82b751629f2fd2b284d8fd Mon Sep 17 00:00:00 2001
From: Andy Spiers <andy@spiers.co.uk>
Date: Mon, 15 Feb 2021 08:47:55 +0000
Subject: [PATCH 02/21] chore(release): Update changelog for v11.0.0

---
 CHANGELOG.md | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0012504..ab543e7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,11 +2,20 @@
 <a name="unreleased"></a>
 ## [Unreleased]
 
+<a name="v11.0.0"></a>
+## [v11.0.0] - 2021-01-28
+### ✨ Features
+- [626b4ef](https://github.com/devopsmakers/terraform-aws-eks/commit/626b4ef) remove automatic ASG replacement and support for name overrides
+
+
 <a name="v10.2.3"></a>
 ## [v10.2.3] - 2020-05-18
 ### 🐛 Bug Fixes
 - [377e8a5](https://github.com/devopsmakers/terraform-aws-eks/commit/377e8a5) issue with placement groups ([#5](https://github.com/devopsmakers/terraform-aws-eks/issues/5))
 
+### 🔧 Maintenance
+- **release:** [dee493a](https://github.com/devopsmakers/terraform-aws-eks/commit/dee493a) Update changelog for v10.2.3
+
 
 <a name="v10.2.2"></a>
 ## [v10.2.2] - 2020-05-05
@@ -106,7 +115,8 @@
 - [6338f6d](https://github.com/devopsmakers/terraform-aws-eks/commit/6338f6d) Initial commit
 
 
-[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v10.2.3...HEAD
+[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.0.0...HEAD
+[v11.0.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v10.2.3...v11.0.0
 [v10.2.3]: https://github.com/devopsmakers/terraform-aws-eks/compare/v10.2.2...v10.2.3
 [v10.2.2]: https://github.com/devopsmakers/terraform-aws-eks/compare/v10.2.1...v10.2.2
 [v10.2.1]: https://github.com/devopsmakers/terraform-aws-eks/compare/v10.2.0...v10.2.1

From b5d8e49ef61a06b73c0d6e7d1a47f78ae5fc7492 Mon Sep 17 00:00:00 2001
From: Ben Robinson <benr@blrobinson.uk>
Date: Tue, 10 Aug 2021 15:33:07 +0100
Subject: [PATCH 03/21] chore: Bump to allow terraform 1.0.X

---
 .pre-commit-config.yaml          |   2 +-
 modules/control_plane/README.md  | 126 +++++++++++++++++++------------
 modules/control_plane/outputs.tf |  10 +--
 3 files changed, 84 insertions(+), 54 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index dfec4e2..3936c48 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,7 +1,7 @@
 exclude: vendor
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.25.0
+    rev: v1.50.0
     hooks:
       - id: terraform_fmt
       - id: terraform_docs
diff --git a/modules/control_plane/README.md b/modules/control_plane/README.md
index ee3e373..31db13e 100644
--- a/modules/control_plane/README.md
+++ b/modules/control_plane/README.md
@@ -3,65 +3,95 @@
 This submodule is designed for use by both the parent `eks` module and by the user.
 
 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.9 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.52.0 |
+| <a name="requirement_local"></a> [local](#requirement\_local) | >= 1.2 |
+| <a name="requirement_template"></a> [template](#requirement\_template) | >= 2.1 |
+
 ## Providers
 
 | Name | Version |
 |------|---------|
-| aws | >= 2.52.0 |
-| local | >= 1.2 |
-| template | >= 2.1 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 2.52.0 |
+| <a name="provider_local"></a> [local](#provider\_local) | >= 1.2 |
+| <a name="provider_template"></a> [template](#provider\_template) | >= 2.1 |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_cloudwatch_log_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
+| [aws_eks_cluster.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster) | resource |
+| [aws_iam_openid_connect_provider.oidc_provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource |
+| [aws_iam_role.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_iam_role_policy_attachment.cluster_AmazonEKSServicePolicy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_security_group.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
+| [aws_security_group_rule.cluster_egress_internet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
+| [local_file.kubeconfig](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource |
+| [aws_iam_policy_document.cluster_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_role.custom_cluster_iam_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_role) | data source |
+| [template_file.aws_authenticator_env_variables](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
+| [template_file.kubeconfig](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:-----:|
-| cluster\_create\_security\_group | Whether to create a security group for the cluster or attach the cluster to `cluster_security_group_id`. | `bool` | `true` | no |
-| cluster\_create\_timeout | Timeout value when creating the EKS cluster. | `string` | `"30m"` | no |
-| cluster\_delete\_timeout | Timeout value when deleting the EKS cluster. | `string` | `"15m"` | no |
-| cluster\_enabled\_log\_types | A list of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) | `list(string)` | `[]` | no |
-| cluster\_encryption\_key\_arn | KMS Key ARN to encrypt EKS resources with. | `string` | `""` | no |
-| cluster\_encryption\_resources | A list of the EKS resources to encrypt. | `list(string)` | <pre>[<br>  "secrets"<br>]</pre> | no |
-| cluster\_endpoint\_private\_access | Indicates whether or not the Amazon EKS private API server endpoint is enabled. | `bool` | `false` | no |
-| cluster\_endpoint\_public\_access | Indicates whether or not the Amazon EKS public API server endpoint is enabled. | `bool` | `true` | no |
-| cluster\_endpoint\_public\_access\_cidrs | List of CIDR blocks which can access the Amazon EKS public API server endpoint. | `list(string)` | <pre>[<br>  "0.0.0.0/0"<br>]</pre> | no |
-| cluster\_iam\_role\_name | IAM role name for the cluster. Only applicable if manage\_cluster\_iam\_resources is set to false. | `string` | `""` | no |
-| cluster\_log\_kms\_key\_id | If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html) | `string` | `""` | no |
-| cluster\_log\_retention\_in\_days | Number of days to retain log events. Default retention - 90 days. | `number` | `90` | no |
-| cluster\_name | Name of the EKS cluster. Also used as a prefix in names of related resources. | `string` | n/a | yes |
-| cluster\_security\_group\_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the workers | `string` | `""` | no |
-| cluster\_version | Kubernetes version to use for the EKS cluster. | `string` | `"1.15"` | no |
-| config\_output\_path | Where to save the Kubectl config file (if `write_kubeconfig = true`). Assumed to be a directory if the value ends with a forward slash `/`. | `string` | `"./"` | no |
-| create\_eks | Controls if EKS resources should be created (it affects almost all resources) | `bool` | `true` | no |
-| eks\_oidc\_root\_ca\_thumbprint | Thumbprint of Root CA for EKS OIDC, Valid until 2037 | `string` | `"9e99a48a9960b14926bb7f3b02e22da2b0ab7280"` | no |
-| enable\_irsa | Whether to create OpenID Connect Provider for EKS to enable IRSA | `bool` | `false` | no |
-| iam\_path | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no |
-| kubeconfig\_aws\_authenticator\_additional\_args | Any additional arguments to pass to the authenticator such as the role to assume. e.g. ["-r", "MyEksRole"]. | `list(string)` | `[]` | no |
-| kubeconfig\_aws\_authenticator\_command | Command to use to fetch AWS EKS credentials. | `string` | `"aws-iam-authenticator"` | no |
-| kubeconfig\_aws\_authenticator\_command\_args | Default arguments passed to the authenticator command. Defaults to [token -i $cluster\_name]. | `list(string)` | `[]` | no |
-| kubeconfig\_aws\_authenticator\_env\_variables | Environment variables that should be used when executing the authenticator. e.g. { AWS\_PROFILE = "eks"}. | `map(string)` | `{}` | no |
-| kubeconfig\_name | Override the default name used for items kubeconfig. | `string` | `""` | no |
-| manage\_cluster\_iam\_resources | Whether to let the module manage cluster IAM resources. If set to false, cluster\_iam\_role\_name must be specified. | `bool` | `true` | no |
-| permissions\_boundary | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | n/a | yes |
-| subnets | A list of subnets to place the EKS cluster and workers within. | `list(string)` | n/a | yes |
-| tags | A map of tags to add to all resources. | `map(string)` | `{}` | no |
-| vpc\_id | VPC where the cluster and workers will be deployed. | `string` | n/a | yes |
-| write\_kubeconfig | Whether to write a Kubectl config file containing the cluster configuration. Saved to `config_output_path`. | `bool` | `true` | no |
+|------|-------------|------|---------|:--------:|
+| <a name="input_cluster_create_security_group"></a> [cluster\_create\_security\_group](#input\_cluster\_create\_security\_group) | Whether to create a security group for the cluster or attach the cluster to `cluster_security_group_id`. | `bool` | `true` | no |
+| <a name="input_cluster_create_timeout"></a> [cluster\_create\_timeout](#input\_cluster\_create\_timeout) | Timeout value when creating the EKS cluster. | `string` | `"30m"` | no |
+| <a name="input_cluster_delete_timeout"></a> [cluster\_delete\_timeout](#input\_cluster\_delete\_timeout) | Timeout value when deleting the EKS cluster. | `string` | `"15m"` | no |
+| <a name="input_cluster_enabled_log_types"></a> [cluster\_enabled\_log\_types](#input\_cluster\_enabled\_log\_types) | A list of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) | `list(string)` | `[]` | no |
+| <a name="input_cluster_encryption_key_arn"></a> [cluster\_encryption\_key\_arn](#input\_cluster\_encryption\_key\_arn) | KMS Key ARN to encrypt EKS resources with. | `string` | `""` | no |
+| <a name="input_cluster_encryption_resources"></a> [cluster\_encryption\_resources](#input\_cluster\_encryption\_resources) | A list of the EKS resources to encrypt. | `list(string)` | <pre>[<br>  "secrets"<br>]</pre> | no |
+| <a name="input_cluster_endpoint_private_access"></a> [cluster\_endpoint\_private\_access](#input\_cluster\_endpoint\_private\_access) | Indicates whether or not the Amazon EKS private API server endpoint is enabled. | `bool` | `false` | no |
+| <a name="input_cluster_endpoint_public_access"></a> [cluster\_endpoint\_public\_access](#input\_cluster\_endpoint\_public\_access) | Indicates whether or not the Amazon EKS public API server endpoint is enabled. | `bool` | `true` | no |
+| <a name="input_cluster_endpoint_public_access_cidrs"></a> [cluster\_endpoint\_public\_access\_cidrs](#input\_cluster\_endpoint\_public\_access\_cidrs) | List of CIDR blocks which can access the Amazon EKS public API server endpoint. | `list(string)` | <pre>[<br>  "0.0.0.0/0"<br>]</pre> | no |
+| <a name="input_cluster_iam_role_name"></a> [cluster\_iam\_role\_name](#input\_cluster\_iam\_role\_name) | IAM role name for the cluster. Only applicable if manage\_cluster\_iam\_resources is set to false. | `string` | `""` | no |
+| <a name="input_cluster_log_kms_key_id"></a> [cluster\_log\_kms\_key\_id](#input\_cluster\_log\_kms\_key\_id) | If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html) | `string` | `""` | no |
+| <a name="input_cluster_log_retention_in_days"></a> [cluster\_log\_retention\_in\_days](#input\_cluster\_log\_retention\_in\_days) | Number of days to retain log events. Default retention - 90 days. | `number` | `90` | no |
+| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster. Also used as a prefix in names of related resources. | `string` | n/a | yes |
+| <a name="input_cluster_security_group_id"></a> [cluster\_security\_group\_id](#input\_cluster\_security\_group\_id) | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the workers | `string` | `""` | no |
+| <a name="input_cluster_version"></a> [cluster\_version](#input\_cluster\_version) | Kubernetes version to use for the EKS cluster. | `string` | `"1.15"` | no |
+| <a name="input_config_output_path"></a> [config\_output\_path](#input\_config\_output\_path) | Where to save the Kubectl config file (if `write_kubeconfig = true`). Assumed to be a directory if the value ends with a forward slash `/`. | `string` | `"./"` | no |
+| <a name="input_create_eks"></a> [create\_eks](#input\_create\_eks) | Controls if EKS resources should be created (it affects almost all resources) | `bool` | `true` | no |
+| <a name="input_eks_oidc_root_ca_thumbprint"></a> [eks\_oidc\_root\_ca\_thumbprint](#input\_eks\_oidc\_root\_ca\_thumbprint) | Thumbprint of Root CA for EKS OIDC, Valid until 2037 | `string` | `"9e99a48a9960b14926bb7f3b02e22da2b0ab7280"` | no |
+| <a name="input_enable_irsa"></a> [enable\_irsa](#input\_enable\_irsa) | Whether to create OpenID Connect Provider for EKS to enable IRSA | `bool` | `false` | no |
+| <a name="input_iam_path"></a> [iam\_path](#input\_iam\_path) | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no |
+| <a name="input_kubeconfig_aws_authenticator_additional_args"></a> [kubeconfig\_aws\_authenticator\_additional\_args](#input\_kubeconfig\_aws\_authenticator\_additional\_args) | Any additional arguments to pass to the authenticator such as the role to assume. e.g. ["-r", "MyEksRole"]. | `list(string)` | `[]` | no |
+| <a name="input_kubeconfig_aws_authenticator_command"></a> [kubeconfig\_aws\_authenticator\_command](#input\_kubeconfig\_aws\_authenticator\_command) | Command to use to fetch AWS EKS credentials. | `string` | `"aws-iam-authenticator"` | no |
+| <a name="input_kubeconfig_aws_authenticator_command_args"></a> [kubeconfig\_aws\_authenticator\_command\_args](#input\_kubeconfig\_aws\_authenticator\_command\_args) | Default arguments passed to the authenticator command. Defaults to [token -i $cluster\_name]. | `list(string)` | `[]` | no |
+| <a name="input_kubeconfig_aws_authenticator_env_variables"></a> [kubeconfig\_aws\_authenticator\_env\_variables](#input\_kubeconfig\_aws\_authenticator\_env\_variables) | Environment variables that should be used when executing the authenticator. e.g. { AWS\_PROFILE = "eks"}. | `map(string)` | `{}` | no |
+| <a name="input_kubeconfig_name"></a> [kubeconfig\_name](#input\_kubeconfig\_name) | Override the default name used for items kubeconfig. | `string` | `""` | no |
+| <a name="input_manage_cluster_iam_resources"></a> [manage\_cluster\_iam\_resources](#input\_manage\_cluster\_iam\_resources) | Whether to let the module manage cluster IAM resources. If set to false, cluster\_iam\_role\_name must be specified. | `bool` | `true` | no |
+| <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | `null` | no |
+| <a name="input_subnets"></a> [subnets](#input\_subnets) | A list of subnets to place the EKS cluster and workers within. | `list(string)` | n/a | yes |
+| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to all resources. | `map(string)` | `{}` | no |
+| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | VPC where the cluster and workers will be deployed. | `string` | n/a | yes |
+| <a name="input_write_kubeconfig"></a> [write\_kubeconfig](#input\_write\_kubeconfig) | Whether to write a Kubectl config file containing the cluster configuration. Saved to `config_output_path`. | `bool` | `true` | no |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
-| cloudwatch\_log\_group\_name | Name of cloudwatch log group created |
-| cluster\_arn | The Amazon Resource Name (ARN) of the cluster. |
-| cluster\_certificate\_authority\_data | Nested attribute containing certificate-authority-data for your cluster. This is the base64 encoded certificate data required to communicate with your cluster. |
-| cluster\_endpoint | The endpoint for your EKS Kubernetes API. |
-| cluster\_iam\_role\_arn | IAM role ARN of the EKS cluster. |
-| cluster\_id | The name/id of the EKS cluster. |
-| cluster\_oidc\_issuer\_url | The URL on the EKS cluster OIDC Issuer |
-| cluster\_security\_group\_id | Security group ID attached to the EKS cluster. |
-| cluster\_version | The Kubernetes server version for the EKS cluster. |
-| kubeconfig | kubectl config file contents for this EKS cluster. |
-| kubeconfig\_filename | The filename of the generated kubectl config. |
-| oidc\_provider\_arn | The ARN of the OIDC Provider if `enable_irsa = true`. |
-
+| <a name="output_cloudwatch_log_group_name"></a> [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created |
+| <a name="output_cluster_arn"></a> [cluster\_arn](#output\_cluster\_arn) | The Amazon Resource Name (ARN) of the cluster. |
+| <a name="output_cluster_certificate_authority_data"></a> [cluster\_certificate\_authority\_data](#output\_cluster\_certificate\_authority\_data) | Nested attribute containing certificate-authority-data for your cluster. This is the base64 encoded certificate data required to communicate with your cluster. |
+| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | The endpoint for your EKS Kubernetes API. |
+| <a name="output_cluster_iam_role_arn"></a> [cluster\_iam\_role\_arn](#output\_cluster\_iam\_role\_arn) | IAM role ARN of the EKS cluster. |
+| <a name="output_cluster_id"></a> [cluster\_id](#output\_cluster\_id) | The name/id of the EKS cluster. |
+| <a name="output_cluster_oidc_issuer_url"></a> [cluster\_oidc\_issuer\_url](#output\_cluster\_oidc\_issuer\_url) | The URL on the EKS cluster OIDC Issuer |
+| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ID attached to the EKS cluster. |
+| <a name="output_cluster_version"></a> [cluster\_version](#output\_cluster\_version) | The Kubernetes server version for the EKS cluster. |
+| <a name="output_kubeconfig"></a> [kubeconfig](#output\_kubeconfig) | kubectl config file contents for this EKS cluster. |
+| <a name="output_kubeconfig_filename"></a> [kubeconfig\_filename](#output\_kubeconfig\_filename) | The filename of the generated kubectl config. |
+| <a name="output_oidc_provider_arn"></a> [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true`. |
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/modules/control_plane/outputs.tf b/modules/control_plane/outputs.tf
index caa30cc..ac9b40c 100644
--- a/modules/control_plane/outputs.tf
+++ b/modules/control_plane/outputs.tf
@@ -1,26 +1,26 @@
 output "cluster_id" {
   description = "The name/id of the EKS cluster."
-  value       = element(concat(aws_eks_cluster.this.*.id, list("")), 0)
+  value       = element(concat(aws_eks_cluster.this.*.id, [""]), 0)
 }
 
 output "cluster_arn" {
   description = "The Amazon Resource Name (ARN) of the cluster."
-  value       = element(concat(aws_eks_cluster.this.*.arn, list("")), 0)
+  value       = element(concat(aws_eks_cluster.this.*.arn, [""]), 0)
 }
 
 output "cluster_certificate_authority_data" {
   description = "Nested attribute containing certificate-authority-data for your cluster. This is the base64 encoded certificate data required to communicate with your cluster."
-  value       = element(concat(aws_eks_cluster.this[*].certificate_authority[0].data, list("")), 0)
+  value       = element(concat(aws_eks_cluster.this[*].certificate_authority[0].data, [""]), 0)
 }
 
 output "cluster_endpoint" {
   description = "The endpoint for your EKS Kubernetes API."
-  value       = element(concat(aws_eks_cluster.this.*.endpoint, list("")), 0)
+  value       = element(concat(aws_eks_cluster.this.*.endpoint, [""]), 0)
 }
 
 output "cluster_version" {
   description = "The Kubernetes server version for the EKS cluster."
-  value       = element(concat(aws_eks_cluster.this[*].version, list("")), 0)
+  value       = element(concat(aws_eks_cluster.this[*].version, [""]), 0)
 }
 
 output "cluster_security_group_id" {

From 39a322a323390528405d815911d1c19e2b9725f1 Mon Sep 17 00:00:00 2001
From: Ben Robinson <benr@blrobinson.uk>
Date: Wed, 11 Aug 2021 11:00:52 +0100
Subject: [PATCH 04/21] chore(release): Update changelog for v11.0.1

---
 CHANGELOG.md | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ab543e7..c9d1b26 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,11 +2,20 @@
 <a name="unreleased"></a>
 ## [Unreleased]
 
+<a name="v11.0.1"></a>
+## [v11.0.1] - 2021-08-11
+### 🔧 Maintenance
+- [b5d8e49](https://github.com/devopsmakers/terraform-aws-eks/commit/b5d8e49) Bump to allow terraform 1.0.X
+
+
 <a name="v11.0.0"></a>
-## [v11.0.0] - 2021-01-28
+## [v11.0.0] - 2021-02-15
 ### ✨ Features
 - [626b4ef](https://github.com/devopsmakers/terraform-aws-eks/commit/626b4ef) remove automatic ASG replacement and support for name overrides
 
+### 🔧 Maintenance
+- **release:** [d1e8c08](https://github.com/devopsmakers/terraform-aws-eks/commit/d1e8c08) Update changelog for v11.0.0
+
 
 <a name="v10.2.3"></a>
 ## [v10.2.3] - 2020-05-18
@@ -115,7 +124,8 @@
 - [6338f6d](https://github.com/devopsmakers/terraform-aws-eks/commit/6338f6d) Initial commit
 
 
-[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.0.0...HEAD
+[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.0.1...HEAD
+[v11.0.1]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.0.0...v11.0.1
 [v11.0.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v10.2.3...v11.0.0
 [v10.2.3]: https://github.com/devopsmakers/terraform-aws-eks/compare/v10.2.2...v10.2.3
 [v10.2.2]: https://github.com/devopsmakers/terraform-aws-eks/compare/v10.2.1...v10.2.2

From 3b0cef8f8cfe9a27bef5497b924c37a3e785f3b1 Mon Sep 17 00:00:00 2001
From: Ben Robinson <benr@blrobinson.uk>
Date: Mon, 23 May 2022 09:42:53 +0100
Subject: [PATCH 05/21] chore: Use new version of auth (old one no longer works

---
 modules/control_plane/templates/kubeconfig.tpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/control_plane/templates/kubeconfig.tpl b/modules/control_plane/templates/kubeconfig.tpl
index 1696391..77896e1 100644
--- a/modules/control_plane/templates/kubeconfig.tpl
+++ b/modules/control_plane/templates/kubeconfig.tpl
@@ -20,7 +20,7 @@ users:
 - name: ${kubeconfig_name}
   user:
     exec:
-      apiVersion: client.authentication.k8s.io/v1alpha1
+      apiVersion: client.authentication.k8s.io/v1beta1
       command: ${aws_authenticator_command}
       args:
 ${aws_authenticator_command_args}

From cbde2e7d033eeed0fba33d345fe71960ea47348c Mon Sep 17 00:00:00 2001
From: Andy Spiers <andy@spiers.co.uk>
Date: Thu, 26 May 2022 17:33:35 +0100
Subject: [PATCH 06/21] feat: use aws instead of aws-iam-authenticator and
 simplify BOS-1154

---
 modules/control_plane/README.md               |  6 +--
 modules/control_plane/data.tf                 | 39 +++----------------
 .../control_plane/templates/kubeconfig.tpl    | 13 ++++---
 modules/control_plane/variables.tf            | 29 +++-----------
 4 files changed, 19 insertions(+), 68 deletions(-)

diff --git a/modules/control_plane/README.md b/modules/control_plane/README.md
index 31db13e..d29e4df 100644
--- a/modules/control_plane/README.md
+++ b/modules/control_plane/README.md
@@ -39,7 +39,6 @@ No modules.
 | [local_file.kubeconfig](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource |
 | [aws_iam_policy_document.cluster_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_role.custom_cluster_iam_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_role) | data source |
-| [template_file.aws_authenticator_env_variables](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
 | [template_file.kubeconfig](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
 
 ## Inputs
@@ -66,13 +65,10 @@ No modules.
 | <a name="input_eks_oidc_root_ca_thumbprint"></a> [eks\_oidc\_root\_ca\_thumbprint](#input\_eks\_oidc\_root\_ca\_thumbprint) | Thumbprint of Root CA for EKS OIDC, Valid until 2037 | `string` | `"9e99a48a9960b14926bb7f3b02e22da2b0ab7280"` | no |
 | <a name="input_enable_irsa"></a> [enable\_irsa](#input\_enable\_irsa) | Whether to create OpenID Connect Provider for EKS to enable IRSA | `bool` | `false` | no |
 | <a name="input_iam_path"></a> [iam\_path](#input\_iam\_path) | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no |
-| <a name="input_kubeconfig_aws_authenticator_additional_args"></a> [kubeconfig\_aws\_authenticator\_additional\_args](#input\_kubeconfig\_aws\_authenticator\_additional\_args) | Any additional arguments to pass to the authenticator such as the role to assume. e.g. ["-r", "MyEksRole"]. | `list(string)` | `[]` | no |
-| <a name="input_kubeconfig_aws_authenticator_command"></a> [kubeconfig\_aws\_authenticator\_command](#input\_kubeconfig\_aws\_authenticator\_command) | Command to use to fetch AWS EKS credentials. | `string` | `"aws-iam-authenticator"` | no |
-| <a name="input_kubeconfig_aws_authenticator_command_args"></a> [kubeconfig\_aws\_authenticator\_command\_args](#input\_kubeconfig\_aws\_authenticator\_command\_args) | Default arguments passed to the authenticator command. Defaults to [token -i $cluster\_name]. | `list(string)` | `[]` | no |
-| <a name="input_kubeconfig_aws_authenticator_env_variables"></a> [kubeconfig\_aws\_authenticator\_env\_variables](#input\_kubeconfig\_aws\_authenticator\_env\_variables) | Environment variables that should be used when executing the authenticator. e.g. { AWS\_PROFILE = "eks"}. | `map(string)` | `{}` | no |
 | <a name="input_kubeconfig_name"></a> [kubeconfig\_name](#input\_kubeconfig\_name) | Override the default name used for items kubeconfig. | `string` | `""` | no |
 | <a name="input_manage_cluster_iam_resources"></a> [manage\_cluster\_iam\_resources](#input\_manage\_cluster\_iam\_resources) | Whether to let the module manage cluster IAM resources. If set to false, cluster\_iam\_role\_name must be specified. | `bool` | `true` | no |
 | <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | `null` | no |
+| <a name="input_region"></a> [region](#input\_region) | AWS region | `string` | n/a | yes |
 | <a name="input_subnets"></a> [subnets](#input\_subnets) | A list of subnets to place the EKS cluster and workers within. | `list(string)` | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to all resources. | `map(string)` | `{}` | no |
 | <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | VPC where the cluster and workers will be deployed. | `string` | n/a | yes |
diff --git a/modules/control_plane/data.tf b/modules/control_plane/data.tf
index 9ab43a7..8f08441 100644
--- a/modules/control_plane/data.tf
+++ b/modules/control_plane/data.tf
@@ -18,40 +18,11 @@ data "template_file" "kubeconfig" {
   template = file("${path.module}/templates/kubeconfig.tpl")
 
   vars = {
-    kubeconfig_name           = local.kubeconfig_name
-    endpoint                  = aws_eks_cluster.this[0].endpoint
-    cluster_auth_base64       = aws_eks_cluster.this[0].certificate_authority[0].data
-    aws_authenticator_command = var.kubeconfig_aws_authenticator_command
-    aws_authenticator_command_args = length(var.kubeconfig_aws_authenticator_command_args) > 0 ? "        - ${join(
-      "\n        - ",
-      var.kubeconfig_aws_authenticator_command_args,
-      )}" : "        - ${join(
-      "\n        - ",
-      formatlist("\"%s\"", ["token", "-i", aws_eks_cluster.this[0].name]),
-    )}"
-    aws_authenticator_additional_args = length(var.kubeconfig_aws_authenticator_additional_args) > 0 ? "        - ${join(
-      "\n        - ",
-      var.kubeconfig_aws_authenticator_additional_args,
-    )}" : ""
-    aws_authenticator_env_variables = length(var.kubeconfig_aws_authenticator_env_variables) > 0 ? "      env:\n${join(
-      "\n",
-      data.template_file.aws_authenticator_env_variables.*.rendered,
-    )}" : ""
-  }
-}
-
-data "template_file" "aws_authenticator_env_variables" {
-  count = length(var.kubeconfig_aws_authenticator_env_variables)
-
-  template = <<EOF
-        - name: $${key}
-          value: $${value}
-EOF
-
-
-  vars = {
-    value = values(var.kubeconfig_aws_authenticator_env_variables)[count.index]
-    key   = keys(var.kubeconfig_aws_authenticator_env_variables)[count.index]
+    kubeconfig_name     = local.kubeconfig_name
+    endpoint            = aws_eks_cluster.this[0].endpoint
+    cluster_auth_base64 = aws_eks_cluster.this[0].certificate_authority[0].data
+    region              = var.region
+    cluster_name        = var.cluster_name
   }
 }
 
diff --git a/modules/control_plane/templates/kubeconfig.tpl b/modules/control_plane/templates/kubeconfig.tpl
index 77896e1..13f5e84 100644
--- a/modules/control_plane/templates/kubeconfig.tpl
+++ b/modules/control_plane/templates/kubeconfig.tpl
@@ -20,9 +20,12 @@ users:
 - name: ${kubeconfig_name}
   user:
     exec:
-      apiVersion: client.authentication.k8s.io/v1beta1
-      command: ${aws_authenticator_command}
+      apiVersion: client.authentication.k8s.io/v1alpha1
+      command: aws
       args:
-${aws_authenticator_command_args}
-${aws_authenticator_additional_args}
-${aws_authenticator_env_variables}
+      - --region
+      - ${region}
+      - eks
+      - get-token
+      - --cluster-name
+      - ${cluster_name}
diff --git a/modules/control_plane/variables.tf b/modules/control_plane/variables.tf
index c17490c..ae2184d 100644
--- a/modules/control_plane/variables.tf
+++ b/modules/control_plane/variables.tf
@@ -131,30 +131,6 @@ variable "write_kubeconfig" {
   default     = true
 }
 
-variable "kubeconfig_aws_authenticator_command" {
-  description = "Command to use to fetch AWS EKS credentials."
-  type        = string
-  default     = "aws-iam-authenticator"
-}
-
-variable "kubeconfig_aws_authenticator_command_args" {
-  description = "Default arguments passed to the authenticator command. Defaults to [token -i $cluster_name]."
-  type        = list(string)
-  default     = []
-}
-
-variable "kubeconfig_aws_authenticator_additional_args" {
-  description = "Any additional arguments to pass to the authenticator such as the role to assume. e.g. [\"-r\", \"MyEksRole\"]."
-  type        = list(string)
-  default     = []
-}
-
-variable "kubeconfig_aws_authenticator_env_variables" {
-  description = "Environment variables that should be used when executing the authenticator. e.g. { AWS_PROFILE = \"eks\"}."
-  type        = map(string)
-  default     = {}
-}
-
 variable "kubeconfig_name" {
   description = "Override the default name used for items kubeconfig."
   type        = string
@@ -178,3 +154,8 @@ variable "cluster_encryption_resources" {
   description = "A list of the EKS resources to encrypt."
   default     = ["secrets"]
 }
+
+variable "region" {
+  type        = string
+  description = "AWS region"
+}

From 25eec111fd69ce3dc317f4563fbbb29745992fc4 Mon Sep 17 00:00:00 2001
From: Andy Spiers <andy@spiers.co.uk>
Date: Fri, 27 May 2022 14:53:07 +0100
Subject: [PATCH 07/21] chore(release): Update changelog for v11.1.0

---
 CHANGELOG.md | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c9d1b26..9d34153 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,10 +2,20 @@
 <a name="unreleased"></a>
 ## [Unreleased]
 
+<a name="v11.1.0"></a>
+## [v11.1.0] - 2022-05-26
+### ✨ Features
+- [cbde2e7](https://github.com/devopsmakers/terraform-aws-eks/commit/cbde2e7) use aws instead of aws-iam-authenticator and simplify BOS-1154
+
+### 🔧 Maintenance
+- [3b0cef8](https://github.com/devopsmakers/terraform-aws-eks/commit/3b0cef8) Use new version of auth (old one no longer works
+
+
 <a name="v11.0.1"></a>
 ## [v11.0.1] - 2021-08-11
 ### 🔧 Maintenance
 - [b5d8e49](https://github.com/devopsmakers/terraform-aws-eks/commit/b5d8e49) Bump to allow terraform 1.0.X
+- **release:** [39a322a](https://github.com/devopsmakers/terraform-aws-eks/commit/39a322a) Update changelog for v11.0.1
 
 
 <a name="v11.0.0"></a>
@@ -124,7 +134,8 @@
 - [6338f6d](https://github.com/devopsmakers/terraform-aws-eks/commit/6338f6d) Initial commit
 
 
-[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.0.1...HEAD
+[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.1.0...HEAD
+[v11.1.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.0.1...v11.1.0
 [v11.0.1]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.0.0...v11.0.1
 [v11.0.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v10.2.3...v11.0.0
 [v10.2.3]: https://github.com/devopsmakers/terraform-aws-eks/compare/v10.2.2...v10.2.3

From d9bc92c9d679415c211afffae4fe6b404b004502 Mon Sep 17 00:00:00 2001
From: Andy Spiers <andy@spiers.co.uk>
Date: Fri, 29 Jul 2022 16:45:16 +0100
Subject: [PATCH 08/21] fix: replace deprecated data.template_file with
 templatefile function BOS-1567 (#4)

---
 modules/control_plane/README.md   |  3 ---
 modules/control_plane/data.tf     | 20 +++++++++-----------
 modules/control_plane/kubectl.tf  |  2 +-
 modules/control_plane/outputs.tf  |  2 +-
 modules/control_plane/versions.tf |  5 ++---
 5 files changed, 13 insertions(+), 19 deletions(-)

diff --git a/modules/control_plane/README.md b/modules/control_plane/README.md
index d29e4df..d6aa523 100644
--- a/modules/control_plane/README.md
+++ b/modules/control_plane/README.md
@@ -10,7 +10,6 @@ This submodule is designed for use by both the parent `eks` module and by the us
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.9 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.52.0 |
 | <a name="requirement_local"></a> [local](#requirement\_local) | >= 1.2 |
-| <a name="requirement_template"></a> [template](#requirement\_template) | >= 2.1 |
 
 ## Providers
 
@@ -18,7 +17,6 @@ This submodule is designed for use by both the parent `eks` module and by the us
 |------|---------|
 | <a name="provider_aws"></a> [aws](#provider\_aws) | >= 2.52.0 |
 | <a name="provider_local"></a> [local](#provider\_local) | >= 1.2 |
-| <a name="provider_template"></a> [template](#provider\_template) | >= 2.1 |
 
 ## Modules
 
@@ -39,7 +37,6 @@ No modules.
 | [local_file.kubeconfig](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource |
 | [aws_iam_policy_document.cluster_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_role.custom_cluster_iam_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_role) | data source |
-| [template_file.kubeconfig](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
 
 ## Inputs
 
diff --git a/modules/control_plane/data.tf b/modules/control_plane/data.tf
index 8f08441..6d50f8c 100644
--- a/modules/control_plane/data.tf
+++ b/modules/control_plane/data.tf
@@ -13,17 +13,15 @@ data "aws_iam_policy_document" "cluster_assume_role_policy" {
   }
 }
 
-data "template_file" "kubeconfig" {
-  count    = var.create_eks ? 1 : 0
-  template = file("${path.module}/templates/kubeconfig.tpl")
-
-  vars = {
-    kubeconfig_name     = local.kubeconfig_name
-    endpoint            = aws_eks_cluster.this[0].endpoint
-    cluster_auth_base64 = aws_eks_cluster.this[0].certificate_authority[0].data
-    region              = var.region
-    cluster_name        = var.cluster_name
-  }
+locals {
+  kubeconfig = var.create_eks ? templatefile("${path.module}/templates/kubeconfig.tpl",
+    {
+      kubeconfig_name     = local.kubeconfig_name,
+      endpoint            = aws_eks_cluster.this[0].endpoint,
+      cluster_auth_base64 = aws_eks_cluster.this[0].certificate_authority[0].data,
+      region              = var.region,
+      cluster_name        = var.cluster_name,
+  }) : ""
 }
 
 data "aws_iam_role" "custom_cluster_iam_role" {
diff --git a/modules/control_plane/kubectl.tf b/modules/control_plane/kubectl.tf
index fd61811..c213340 100644
--- a/modules/control_plane/kubectl.tf
+++ b/modules/control_plane/kubectl.tf
@@ -1,7 +1,7 @@
 
 resource "local_file" "kubeconfig" {
   count                = var.write_kubeconfig && var.create_eks ? 1 : 0
-  content              = data.template_file.kubeconfig[0].rendered
+  content              = local.kubeconfig
   filename             = substr(var.config_output_path, -1, 1) == "/" ? "${var.config_output_path}kubeconfig_${var.cluster_name}" : var.config_output_path
   directory_permission = "0750"
   file_permission      = "0600"
diff --git a/modules/control_plane/outputs.tf b/modules/control_plane/outputs.tf
index ac9b40c..f673cad 100644
--- a/modules/control_plane/outputs.tf
+++ b/modules/control_plane/outputs.tf
@@ -45,7 +45,7 @@ output "cloudwatch_log_group_name" {
 
 output "kubeconfig" {
   description = "kubectl config file contents for this EKS cluster."
-  value       = concat(data.template_file.kubeconfig[*].rendered, [""])[0]
+  value       = local.kubeconfig
 }
 
 output "kubeconfig_filename" {
diff --git a/modules/control_plane/versions.tf b/modules/control_plane/versions.tf
index 88bf9a9..b7d789f 100644
--- a/modules/control_plane/versions.tf
+++ b/modules/control_plane/versions.tf
@@ -2,8 +2,7 @@ terraform {
   required_version = ">= 0.12.9"
 
   required_providers {
-    aws      = ">= 2.52.0"
-    local    = ">= 1.2"
-    template = ">= 2.1"
+    aws   = ">= 2.52.0"
+    local = ">= 1.2"
   }
 }

From 9a8d031b976ee9f6c40cf5bee62372abec3244d6 Mon Sep 17 00:00:00 2001
From: Andy Spiers <andy@spiers.co.uk>
Date: Fri, 29 Jul 2022 16:48:35 +0100
Subject: [PATCH 09/21] chore(release): Update changelog for v11.2.0

---
 CHANGELOG.md | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9d34153..095c9a7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,13 +2,20 @@
 <a name="unreleased"></a>
 ## [Unreleased]
 
+<a name="v11.2.0"></a>
+## [v11.2.0] - 2022-07-29
+### 🐛 Bug Fixes
+- [d9bc92c](https://github.com/devopsmakers/terraform-aws-eks/commit/d9bc92c) replace deprecated data.template_file with templatefile function BOS-1567 ([#4](https://github.com/devopsmakers/terraform-aws-eks/issues/4))
+
+
 <a name="v11.1.0"></a>
-## [v11.1.0] - 2022-05-26
+## [v11.1.0] - 2022-05-27
 ### ✨ Features
 - [cbde2e7](https://github.com/devopsmakers/terraform-aws-eks/commit/cbde2e7) use aws instead of aws-iam-authenticator and simplify BOS-1154
 
 ### 🔧 Maintenance
 - [3b0cef8](https://github.com/devopsmakers/terraform-aws-eks/commit/3b0cef8) Use new version of auth (old one no longer works
+- **release:** [25eec11](https://github.com/devopsmakers/terraform-aws-eks/commit/25eec11) Update changelog for v11.1.0
 
 
 <a name="v11.0.1"></a>
@@ -134,7 +141,8 @@
 - [6338f6d](https://github.com/devopsmakers/terraform-aws-eks/commit/6338f6d) Initial commit
 
 
-[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.1.0...HEAD
+[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.0...HEAD
+[v11.2.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.1.0...v11.2.0
 [v11.1.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.0.1...v11.1.0
 [v11.0.1]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.0.0...v11.0.1
 [v11.0.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v10.2.3...v11.0.0

From 71f596a0bc02874a73fd2e2351b798a90af57907 Mon Sep 17 00:00:00 2001
From: dhumphries-sainsburys <daniel.humphries@sainsburys.co.uk>
Date: Wed, 7 Sep 2022 11:50:10 +0100
Subject: [PATCH 10/21] chore: update kubeconfig to current apiversion

---
 modules/control_plane/templates/kubeconfig.tpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/control_plane/templates/kubeconfig.tpl b/modules/control_plane/templates/kubeconfig.tpl
index 13f5e84..6fa8794 100644
--- a/modules/control_plane/templates/kubeconfig.tpl
+++ b/modules/control_plane/templates/kubeconfig.tpl
@@ -20,7 +20,7 @@ users:
 - name: ${kubeconfig_name}
   user:
     exec:
-      apiVersion: client.authentication.k8s.io/v1alpha1
+      apiVersion: client.authentication.k8s.io/v1beta1
       command: aws
       args:
       - --region

From 0efd9f28149fc079cb74ae259aff01481b3f8e95 Mon Sep 17 00:00:00 2001
From: dhumphries-sainsburys <daniel.humphries@sainsburys.co.uk>
Date: Wed, 7 Sep 2022 13:32:35 +0100
Subject: [PATCH 11/21] chore(release): Update changelog for v11.2.1

---
 CHANGELOG.md | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 095c9a7..f5bfc5b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,11 +2,20 @@
 <a name="unreleased"></a>
 ## [Unreleased]
 
+<a name="v11.2.1"></a>
+## [v11.2.1] - 2022-09-07
+### 🔧 Maintenance
+- [71f596a](https://github.com/devopsmakers/terraform-aws-eks/commit/71f596a) update kubeconfig to current apiversion
+
+
 <a name="v11.2.0"></a>
 ## [v11.2.0] - 2022-07-29
 ### 🐛 Bug Fixes
 - [d9bc92c](https://github.com/devopsmakers/terraform-aws-eks/commit/d9bc92c) replace deprecated data.template_file with templatefile function BOS-1567 ([#4](https://github.com/devopsmakers/terraform-aws-eks/issues/4))
 
+### 🔧 Maintenance
+- **release:** [9a8d031](https://github.com/devopsmakers/terraform-aws-eks/commit/9a8d031) Update changelog for v11.2.0
+
 
 <a name="v11.1.0"></a>
 ## [v11.1.0] - 2022-05-27
@@ -141,7 +150,8 @@
 - [6338f6d](https://github.com/devopsmakers/terraform-aws-eks/commit/6338f6d) Initial commit
 
 
-[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.0...HEAD
+[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.1...HEAD
+[v11.2.1]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.0...v11.2.1
 [v11.2.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.1.0...v11.2.0
 [v11.1.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.0.1...v11.1.0
 [v11.0.1]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.0.0...v11.0.1

From 5cff1d34f6da0c845ccc1a75de8f0191c3dff973 Mon Sep 17 00:00:00 2001
From: Andy Townsend <andy-townsend@users.noreply.github.com>
Date: Wed, 26 Mar 2025 10:13:23 +0000
Subject: [PATCH 12/21] feat: support log_group_class - BOS-3058 (#6)

* chore: fix tflint issues as well

* chore: change name of the cw logs group

* chore: update aws provider version required to support log_group_class

* fix: resolve tflint issues in aws_auth sub-module

* fix: resolve tflint issues in node_groups sub-module

* fix: resolve tflint issues in worker_groups sub-module

* chore: add support for changing region as was not set at top level of module, although we try to pass it in from ekscluster

* chore: comment out unused vars

* chore: remove unused vars
---
 README.md                          | 195 ++++++++++++++++-------------
 main.tf                            |  63 +++++-----
 modules/aws_auth/README.md         |  52 +++++---
 modules/aws_auth/aws_auth.tf       |   2 +-
 modules/aws_auth/outputs.tf        |   2 +-
 modules/aws_auth/variables.tf      |   1 +
 modules/aws_auth/versions.tf       |  20 ++-
 modules/control_plane/README.md    |   5 +-
 modules/control_plane/cluster.tf   |   3 +-
 modules/control_plane/irsa.tf      |   2 +-
 modules/control_plane/locals.tf    |   6 +-
 modules/control_plane/outputs.tf   |  10 +-
 modules/control_plane/variables.tf |   6 +
 modules/control_plane/versions.tf  |  10 +-
 modules/node_groups/README.md      |  60 ++++++---
 modules/node_groups/locals.tf      |   2 +-
 modules/node_groups/node_groups.tf |   2 +-
 modules/node_groups/versions.tf    |  10 +-
 modules/worker_groups/README.md    | 120 +++++++++++-------
 modules/worker_groups/data.tf      |   2 +-
 modules/worker_groups/locals.tf    |   4 +-
 modules/worker_groups/outputs.tf   |  24 ++--
 modules/worker_groups/variables.tf |   3 +-
 modules/worker_groups/versions.tf  |  15 ++-
 variables.tf                       |  42 ++-----
 25 files changed, 390 insertions(+), 271 deletions(-)

diff --git a/README.md b/README.md
index 693e4ff..2831a85 100644
--- a/README.md
+++ b/README.md
@@ -64,102 +64,123 @@ There are some core implementation changes from the original `eks` module:
    instance per worker_group further isolating the data structures in the state file.
 
 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.9 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.52.0 |
+| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 1.6.2 |
+| <a name="requirement_local"></a> [local](#requirement\_local) | >= 1.2 |
+| <a name="requirement_null"></a> [null](#requirement\_null) | >= 2.1 |
+| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.1 |
+| <a name="requirement_template"></a> [template](#requirement\_template) | >= 2.1 |
+
 ## Providers
 
-No provider.
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_aws_auth"></a> [aws\_auth](#module\_aws\_auth) | ./modules/aws_auth | n/a |
+| <a name="module_control_plane"></a> [control\_plane](#module\_control\_plane) | ./modules/control_plane | n/a |
+| <a name="module_node_groups"></a> [node\_groups](#module\_node\_groups) | ./modules/node_groups | n/a |
+| <a name="module_worker_groups"></a> [worker\_groups](#module\_worker\_groups) | ./modules/worker_groups | n/a |
+
+## Resources
+
+No resources.
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:-----:|
-| attach\_node\_cni\_policy | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default worker IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster. | `bool` | `true` | no |
-| attach\_worker\_cni\_policy | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default worker IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster. | `bool` | `true` | no |
-| cluster\_create\_security\_group | Whether to create a security group for the cluster or attach the cluster to `cluster_security_group_id`. | `bool` | `true` | no |
-| cluster\_create\_timeout | Timeout value when creating the EKS cluster. | `string` | `"30m"` | no |
-| cluster\_delete\_timeout | Timeout value when deleting the EKS cluster. | `string` | `"15m"` | no |
-| cluster\_enabled\_log\_types | A list of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) | `list(string)` | `[]` | no |
-| cluster\_encryption\_key\_arn | KMS Key ARN to encrypt EKS secrets with. | `string` | `""` | no |
-| cluster\_encryption\_resources | A list of the EKS resources to encrypt. | `list(string)` | <pre>[<br>  "secrets"<br>]</pre> | no |
-| cluster\_endpoint\_private\_access | Indicates whether or not the Amazon EKS private API server endpoint is enabled. | `bool` | `false` | no |
-| cluster\_endpoint\_public\_access | Indicates whether or not the Amazon EKS public API server endpoint is enabled. | `bool` | `true` | no |
-| cluster\_endpoint\_public\_access\_cidrs | List of CIDR blocks which can access the Amazon EKS public API server endpoint. | `list(string)` | <pre>[<br>  "0.0.0.0/0"<br>]</pre> | no |
-| cluster\_iam\_role\_name | IAM role name for the cluster. Only applicable if manage\_cluster\_iam\_resources is set to false. | `string` | `""` | no |
-| cluster\_log\_kms\_key\_id | If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html) | `string` | `""` | no |
-| cluster\_log\_retention\_in\_days | Number of days to retain log events. Default retention - 90 days. | `number` | `90` | no |
-| cluster\_name | Name of the EKS cluster. Also used as a prefix in names of related resources. | `string` | n/a | yes |
-| cluster\_security\_group\_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the workers | `string` | `""` | no |
-| cluster\_version | Kubernetes version to use for the EKS cluster. | `string` | `"1.15"` | no |
-| config\_output\_path | Where to save the Kubectl config file (if `write_kubeconfig = true`). Assumed to be a directory if the value ends with a forward slash `/`. | `string` | `"./"` | no |
-| create\_eks | Controls if EKS resources should be created (it affects almost all resources) | `bool` | `true` | no |
-| eks\_oidc\_root\_ca\_thumbprint | Thumbprint of Root CA for EKS OIDC, Valid until 2037 | `string` | `"9e99a48a9960b14926bb7f3b02e22da2b0ab7280"` | no |
-| enable\_irsa | Whether to create OpenID Connect Provider for EKS to enable IRSA | `bool` | `false` | no |
-| iam\_path | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no |
-| kubeconfig\_aws\_authenticator\_additional\_args | Any additional arguments to pass to the authenticator such as the role to assume. e.g. ["-r", "MyEksRole"]. | `list(string)` | `[]` | no |
-| kubeconfig\_aws\_authenticator\_command | Command to use to fetch AWS EKS credentials. | `string` | `"aws-iam-authenticator"` | no |
-| kubeconfig\_aws\_authenticator\_command\_args | Default arguments passed to the authenticator command. Defaults to [token -i $cluster\_name]. | `list(string)` | `[]` | no |
-| kubeconfig\_aws\_authenticator\_env\_variables | Environment variables that should be used when executing the authenticator. e.g. { AWS\_PROFILE = "eks"}. | `map(string)` | `{}` | no |
-| kubeconfig\_name | Override the default name used for items kubeconfig. | `string` | `""` | no |
-| manage\_aws\_auth | Whether to apply the aws-auth configmap file. | `bool` | `true` | no |
-| manage\_cluster\_iam\_resources | Whether to let the module manage cluster IAM resources. If set to false, cluster\_iam\_role\_name must be specified. | `bool` | `true` | no |
-| manage\_node\_iam\_resources | Whether to let the module manage worker IAM resources. If set to false, iam\_instance\_profile\_name must be specified for workers. | `bool` | `true` | no |
-| manage\_worker\_iam\_resources | Whether to let the module manage worker IAM resources. If set to false, iam\_instance\_profile\_name must be specified for workers. | `bool` | `true` | no |
-| map\_accounts | Additional AWS account numbers to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | `list(string)` | `[]` | no |
-| map\_roles | Additional IAM roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br>    rolearn  = string<br>    username = string<br>    groups   = list(string)<br>  }))</pre> | `[]` | no |
-| map\_users | Additional IAM users to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br>    userarn  = string<br>    username = string<br>    groups   = list(string)<br>  }))</pre> | `[]` | no |
-| node\_groups | Map of map of node groups to create. See `node_groups` module's documentation for more details | `any` | `{}` | no |
-| node\_groups\_additional\_policies | Additional policies to be added to workers | `list(string)` | `[]` | no |
-| node\_groups\_defaults | Map of values to be applied to all node groups. See `node_groups` module's documentaton for more details | `any` | `{}` | no |
-| node\_groups\_role\_name | User defined workers role name. | `string` | `""` | no |
-| permissions\_boundary | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | n/a | yes |
-| subnets | A list of subnets to place the EKS cluster and workers within. | `list(string)` | n/a | yes |
-| tags | A map of tags to add to all resources. | `map(string)` | `{}` | no |
-| vpc\_id | VPC where the cluster and workers will be deployed. | `string` | n/a | yes |
-| wait\_for\_cluster\_cmd | Custom local-exec command to execute for determining if the eks cluster is healthy. Cluster endpoint will be available as an environment variable called ENDPOINT | `string` | `"until wget --no-check-certificate -O - -q $ENDPOINT/healthz \u003e/dev/null; do sleep 4; done"` | no |
-| worker\_additional\_security\_group\_ids | A list of additional security group ids to attach to worker instances | `list(string)` | `[]` | no |
-| worker\_ami\_name\_filter | Name filter for AWS EKS worker AMI. If not provided, the latest official AMI for the specified 'cluster\_version' is used. | `string` | `""` | no |
-| worker\_ami\_name\_filter\_windows | Name filter for AWS EKS Windows worker AMI. If not provided, the latest official AMI for the specified 'cluster\_version' is used. | `string` | `""` | no |
-| worker\_ami\_owner\_id | The ID of the owner for the AMI to use for the AWS EKS workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"602401143452"` | no |
-| worker\_ami\_owner\_id\_windows | The ID of the owner for the AMI to use for the AWS EKS Windows workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"801119661308"` | no |
-| worker\_create\_initial\_lifecycle\_hooks | Whether to create initial lifecycle hooks provided in worker groups. | `bool` | `false` | no |
-| worker\_create\_security\_group | Whether to create a security group for the workers or attach the workers to `worker_security_group_id`. | `bool` | `true` | no |
-| worker\_groups | A list of maps defining worker group configurations to be defined using AWS Launch Configurations. See workers\_group\_defaults for valid keys. | `any` | `[]` | no |
-| worker\_groups\_additional\_policies | Additional policies to be added to workers | `list(string)` | `[]` | no |
-| worker\_groups\_defaults | Override default values for target groups. See worker\_group\_defaults in local.tf for valid keys. | `any` | `{}` | no |
-| worker\_groups\_launch\_template | A list of maps defining worker group configurations to be defined using AWS Launch Templates. See workers\_group\_defaults for valid keys. | `any` | `[]` | no |
-| worker\_groups\_role\_name | User defined workers role name. | `string` | `""` | no |
-| worker\_security\_group\_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the EKS cluster. | `string` | `""` | no |
-| worker\_sg\_ingress\_from\_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | `number` | `1025` | no |
-| write\_kubeconfig | Whether to write a Kubectl config file containing the cluster configuration. Saved to `config_output_path`. | `bool` | `true` | no |
+|------|-------------|------|---------|:--------:|
+| <a name="input_attach_node_cni_policy"></a> [attach\_node\_cni\_policy](#input\_attach\_node\_cni\_policy) | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default worker IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster. | `bool` | `true` | no |
+| <a name="input_attach_worker_cni_policy"></a> [attach\_worker\_cni\_policy](#input\_attach\_worker\_cni\_policy) | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default worker IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster. | `bool` | `true` | no |
+| <a name="input_cluster_create_security_group"></a> [cluster\_create\_security\_group](#input\_cluster\_create\_security\_group) | Whether to create a security group for the cluster or attach the cluster to `cluster_security_group_id`. | `bool` | `true` | no |
+| <a name="input_cluster_create_timeout"></a> [cluster\_create\_timeout](#input\_cluster\_create\_timeout) | Timeout value when creating the EKS cluster. | `string` | `"30m"` | no |
+| <a name="input_cluster_delete_timeout"></a> [cluster\_delete\_timeout](#input\_cluster\_delete\_timeout) | Timeout value when deleting the EKS cluster. | `string` | `"15m"` | no |
+| <a name="input_cluster_enabled_log_types"></a> [cluster\_enabled\_log\_types](#input\_cluster\_enabled\_log\_types) | A list of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) | `list(string)` | `[]` | no |
+| <a name="input_cluster_encryption_key_arn"></a> [cluster\_encryption\_key\_arn](#input\_cluster\_encryption\_key\_arn) | KMS Key ARN to encrypt EKS secrets with. | `string` | `""` | no |
+| <a name="input_cluster_encryption_resources"></a> [cluster\_encryption\_resources](#input\_cluster\_encryption\_resources) | A list of the EKS resources to encrypt. | `list(string)` | <pre>[<br>  "secrets"<br>]</pre> | no |
+| <a name="input_cluster_endpoint_private_access"></a> [cluster\_endpoint\_private\_access](#input\_cluster\_endpoint\_private\_access) | Indicates whether or not the Amazon EKS private API server endpoint is enabled. | `bool` | `false` | no |
+| <a name="input_cluster_endpoint_public_access"></a> [cluster\_endpoint\_public\_access](#input\_cluster\_endpoint\_public\_access) | Indicates whether or not the Amazon EKS public API server endpoint is enabled. | `bool` | `true` | no |
+| <a name="input_cluster_endpoint_public_access_cidrs"></a> [cluster\_endpoint\_public\_access\_cidrs](#input\_cluster\_endpoint\_public\_access\_cidrs) | List of CIDR blocks which can access the Amazon EKS public API server endpoint. | `list(string)` | <pre>[<br>  "0.0.0.0/0"<br>]</pre> | no |
+| <a name="input_cluster_iam_role_name"></a> [cluster\_iam\_role\_name](#input\_cluster\_iam\_role\_name) | IAM role name for the cluster. Only applicable if manage\_cluster\_iam\_resources is set to false. | `string` | `""` | no |
+| <a name="input_cluster_log_group_class"></a> [cluster\_log\_group\_class](#input\_cluster\_log\_group\_class) | Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT\_ACCESS | `string` | `"INFREQUENT_ACCESS"` | no |
+| <a name="input_cluster_log_kms_key_id"></a> [cluster\_log\_kms\_key\_id](#input\_cluster\_log\_kms\_key\_id) | If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html) | `string` | `""` | no |
+| <a name="input_cluster_log_retention_in_days"></a> [cluster\_log\_retention\_in\_days](#input\_cluster\_log\_retention\_in\_days) | Number of days to retain log events. Default retention - 90 days. | `number` | `90` | no |
+| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster. Also used as a prefix in names of related resources. | `string` | n/a | yes |
+| <a name="input_cluster_security_group_id"></a> [cluster\_security\_group\_id](#input\_cluster\_security\_group\_id) | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the workers | `string` | `""` | no |
+| <a name="input_cluster_version"></a> [cluster\_version](#input\_cluster\_version) | Kubernetes version to use for the EKS cluster. | `string` | `"1.15"` | no |
+| <a name="input_config_output_path"></a> [config\_output\_path](#input\_config\_output\_path) | Where to save the Kubectl config file (if `write_kubeconfig = true`). Assumed to be a directory if the value ends with a forward slash `/`. | `string` | `"./"` | no |
+| <a name="input_create_eks"></a> [create\_eks](#input\_create\_eks) | Controls if EKS resources should be created (it affects almost all resources) | `bool` | `true` | no |
+| <a name="input_eks_oidc_root_ca_thumbprint"></a> [eks\_oidc\_root\_ca\_thumbprint](#input\_eks\_oidc\_root\_ca\_thumbprint) | Thumbprint of Root CA for EKS OIDC, Valid until 2037 | `string` | `"9e99a48a9960b14926bb7f3b02e22da2b0ab7280"` | no |
+| <a name="input_enable_irsa"></a> [enable\_irsa](#input\_enable\_irsa) | Whether to create OpenID Connect Provider for EKS to enable IRSA | `bool` | `false` | no |
+| <a name="input_iam_path"></a> [iam\_path](#input\_iam\_path) | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no |
+| <a name="input_kubeconfig_name"></a> [kubeconfig\_name](#input\_kubeconfig\_name) | Override the default name used for items kubeconfig. | `string` | `""` | no |
+| <a name="input_manage_aws_auth"></a> [manage\_aws\_auth](#input\_manage\_aws\_auth) | Whether to apply the aws-auth configmap file. | `bool` | `true` | no |
+| <a name="input_manage_cluster_iam_resources"></a> [manage\_cluster\_iam\_resources](#input\_manage\_cluster\_iam\_resources) | Whether to let the module manage cluster IAM resources. If set to false, cluster\_iam\_role\_name must be specified. | `bool` | `true` | no |
+| <a name="input_manage_node_iam_resources"></a> [manage\_node\_iam\_resources](#input\_manage\_node\_iam\_resources) | Whether to let the module manage worker IAM resources. If set to false, iam\_instance\_profile\_name must be specified for workers. | `bool` | `true` | no |
+| <a name="input_manage_worker_iam_resources"></a> [manage\_worker\_iam\_resources](#input\_manage\_worker\_iam\_resources) | Whether to let the module manage worker IAM resources. If set to false, iam\_instance\_profile\_name must be specified for workers. | `bool` | `true` | no |
+| <a name="input_map_accounts"></a> [map\_accounts](#input\_map\_accounts) | Additional AWS account numbers to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | `list(string)` | `[]` | no |
+| <a name="input_map_roles"></a> [map\_roles](#input\_map\_roles) | Additional IAM roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br>    rolearn  = string<br>    username = string<br>    groups   = list(string)<br>  }))</pre> | `[]` | no |
+| <a name="input_map_users"></a> [map\_users](#input\_map\_users) | Additional IAM users to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br>    userarn  = string<br>    username = string<br>    groups   = list(string)<br>  }))</pre> | `[]` | no |
+| <a name="input_node_groups"></a> [node\_groups](#input\_node\_groups) | Map of map of node groups to create. See `node_groups` module's documentation for more details | `any` | `{}` | no |
+| <a name="input_node_groups_additional_policies"></a> [node\_groups\_additional\_policies](#input\_node\_groups\_additional\_policies) | Additional policies to be added to workers | `list(string)` | `[]` | no |
+| <a name="input_node_groups_defaults"></a> [node\_groups\_defaults](#input\_node\_groups\_defaults) | Map of values to be applied to all node groups. See `node_groups` module's documentaton for more details | `any` | `{}` | no |
+| <a name="input_node_groups_role_name"></a> [node\_groups\_role\_name](#input\_node\_groups\_role\_name) | User defined workers role name. | `string` | `""` | no |
+| <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | `null` | no |
+| <a name="input_region"></a> [region](#input\_region) | AWS region | `string` | n/a | yes |
+| <a name="input_subnets"></a> [subnets](#input\_subnets) | A list of subnets to place the EKS cluster and workers within. | `list(string)` | n/a | yes |
+| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to all resources. | `map(string)` | `{}` | no |
+| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | VPC where the cluster and workers will be deployed. | `string` | n/a | yes |
+| <a name="input_wait_for_cluster_cmd"></a> [wait\_for\_cluster\_cmd](#input\_wait\_for\_cluster\_cmd) | Custom local-exec command to execute for determining if the eks cluster is healthy. Cluster endpoint will be available as an environment variable called ENDPOINT | `string` | `"until wget --no-check-certificate -O - -q $ENDPOINT/healthz >/dev/null; do sleep 4; done"` | no |
+| <a name="input_worker_additional_security_group_ids"></a> [worker\_additional\_security\_group\_ids](#input\_worker\_additional\_security\_group\_ids) | A list of additional security group ids to attach to worker instances | `list(string)` | `[]` | no |
+| <a name="input_worker_ami_name_filter"></a> [worker\_ami\_name\_filter](#input\_worker\_ami\_name\_filter) | Name filter for AWS EKS worker AMI. If not provided, the latest official AMI for the specified 'cluster\_version' is used. | `string` | `""` | no |
+| <a name="input_worker_ami_name_filter_windows"></a> [worker\_ami\_name\_filter\_windows](#input\_worker\_ami\_name\_filter\_windows) | Name filter for AWS EKS Windows worker AMI. If not provided, the latest official AMI for the specified 'cluster\_version' is used. | `string` | `""` | no |
+| <a name="input_worker_ami_owner_id"></a> [worker\_ami\_owner\_id](#input\_worker\_ami\_owner\_id) | The ID of the owner for the AMI to use for the AWS EKS workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"602401143452"` | no |
+| <a name="input_worker_ami_owner_id_windows"></a> [worker\_ami\_owner\_id\_windows](#input\_worker\_ami\_owner\_id\_windows) | The ID of the owner for the AMI to use for the AWS EKS Windows workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"801119661308"` | no |
+| <a name="input_worker_create_initial_lifecycle_hooks"></a> [worker\_create\_initial\_lifecycle\_hooks](#input\_worker\_create\_initial\_lifecycle\_hooks) | Whether to create initial lifecycle hooks provided in worker groups. | `bool` | `false` | no |
+| <a name="input_worker_create_security_group"></a> [worker\_create\_security\_group](#input\_worker\_create\_security\_group) | Whether to create a security group for the workers or attach the workers to `worker_security_group_id`. | `bool` | `true` | no |
+| <a name="input_worker_groups"></a> [worker\_groups](#input\_worker\_groups) | A list of maps defining worker group configurations to be defined using AWS Launch Configurations. See workers\_group\_defaults for valid keys. | `any` | `[]` | no |
+| <a name="input_worker_groups_additional_policies"></a> [worker\_groups\_additional\_policies](#input\_worker\_groups\_additional\_policies) | Additional policies to be added to workers | `list(string)` | `[]` | no |
+| <a name="input_worker_groups_defaults"></a> [worker\_groups\_defaults](#input\_worker\_groups\_defaults) | Override default values for target groups. See worker\_group\_defaults in local.tf for valid keys. | `any` | `{}` | no |
+| <a name="input_worker_groups_role_name"></a> [worker\_groups\_role\_name](#input\_worker\_groups\_role\_name) | User defined workers role name. | `string` | `""` | no |
+| <a name="input_worker_security_group_id"></a> [worker\_security\_group\_id](#input\_worker\_security\_group\_id) | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the EKS cluster. | `string` | `""` | no |
+| <a name="input_worker_sg_ingress_from_port"></a> [worker\_sg\_ingress\_from\_port](#input\_worker\_sg\_ingress\_from\_port) | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | `number` | `1025` | no |
+| <a name="input_write_kubeconfig"></a> [write\_kubeconfig](#input\_write\_kubeconfig) | Whether to write a Kubectl config file containing the cluster configuration. Saved to `config_output_path`. | `bool` | `true` | no |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
-| cloudwatch\_log\_group\_name | Name of cloudwatch log group created |
-| cluster\_arn | The Amazon Resource Name (ARN) of the cluster. |
-| cluster\_certificate\_authority\_data | Nested attribute containing certificate-authority-data for your cluster. This is the base64 encoded certificate data required to communicate with your cluster. |
-| cluster\_endpoint | The endpoint for your EKS Kubernetes API. |
-| cluster\_iam\_role\_arn | IAM role ARN of the EKS cluster. |
-| cluster\_id | The name/id of the EKS cluster. |
-| cluster\_oidc\_issuer\_url | The URL on the EKS cluster OIDC Issuer |
-| cluster\_security\_group\_id | Security group ID attached to the EKS cluster. |
-| cluster\_version | The Kubernetes server version for the EKS cluster. |
-| config\_map\_aws\_auth | A kubernetes configuration to authenticate to this EKS cluster. |
-| kubeconfig | kubectl config file contents for this EKS cluster. |
-| kubeconfig\_filename | The filename of the generated kubectl config. |
-| node\_groups | Outputs from EKS node groups. Map of maps, keyed by var.node\_groups keys |
-| oidc\_provider\_arn | The ARN of the OIDC Provider if `enable_irsa = true`. |
-| worker\_iam\_instance\_profile\_arns | default IAM instance profile ARN for EKS worker groups |
-| worker\_iam\_instance\_profile\_names | default IAM instance profile name for EKS worker groups |
-| worker\_iam\_role\_arn | default IAM role ARN for EKS worker groups |
-| worker\_iam\_role\_name | default IAM role name for EKS worker groups |
-| worker\_security\_group\_id | Security group ID attached to the EKS workers. |
-| workers\_asg\_arns | IDs of the autoscaling groups containing workers. |
-| workers\_asg\_names | Names of the autoscaling groups containing workers. |
-| workers\_default\_ami\_id | ID of the default worker group AMI |
-| workers\_launch\_template\_arns | ARNs of the worker launch templates. |
-| workers\_launch\_template\_ids | IDs of the worker launch templates. |
-| workers\_launch\_template\_latest\_versions | Latest versions of the worker launch templates. |
-| workers\_user\_data | User data of worker groups |
-
+| <a name="output_cloudwatch_log_group_name"></a> [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created |
+| <a name="output_cluster_arn"></a> [cluster\_arn](#output\_cluster\_arn) | The Amazon Resource Name (ARN) of the cluster. |
+| <a name="output_cluster_certificate_authority_data"></a> [cluster\_certificate\_authority\_data](#output\_cluster\_certificate\_authority\_data) | Nested attribute containing certificate-authority-data for your cluster. This is the base64 encoded certificate data required to communicate with your cluster. |
+| <a name="output_cluster_endpoint"></a> [cluster\_endpoint](#output\_cluster\_endpoint) | The endpoint for your EKS Kubernetes API. |
+| <a name="output_cluster_iam_role_arn"></a> [cluster\_iam\_role\_arn](#output\_cluster\_iam\_role\_arn) | IAM role ARN of the EKS cluster. |
+| <a name="output_cluster_id"></a> [cluster\_id](#output\_cluster\_id) | The name/id of the EKS cluster. |
+| <a name="output_cluster_oidc_issuer_url"></a> [cluster\_oidc\_issuer\_url](#output\_cluster\_oidc\_issuer\_url) | The URL on the EKS cluster OIDC Issuer |
+| <a name="output_cluster_security_group_id"></a> [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ID attached to the EKS cluster. |
+| <a name="output_cluster_version"></a> [cluster\_version](#output\_cluster\_version) | The Kubernetes server version for the EKS cluster. |
+| <a name="output_config_map_aws_auth"></a> [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. |
+| <a name="output_kubeconfig"></a> [kubeconfig](#output\_kubeconfig) | kubectl config file contents for this EKS cluster. |
+| <a name="output_kubeconfig_filename"></a> [kubeconfig\_filename](#output\_kubeconfig\_filename) | The filename of the generated kubectl config. |
+| <a name="output_node_groups"></a> [node\_groups](#output\_node\_groups) | Outputs from EKS node groups. Map of maps, keyed by var.node\_groups keys |
+| <a name="output_oidc_provider_arn"></a> [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true`. |
+| <a name="output_worker_iam_instance_profile_arns"></a> [worker\_iam\_instance\_profile\_arns](#output\_worker\_iam\_instance\_profile\_arns) | default IAM instance profile ARN for EKS worker groups |
+| <a name="output_worker_iam_instance_profile_names"></a> [worker\_iam\_instance\_profile\_names](#output\_worker\_iam\_instance\_profile\_names) | default IAM instance profile name for EKS worker groups |
+| <a name="output_worker_iam_role_arn"></a> [worker\_iam\_role\_arn](#output\_worker\_iam\_role\_arn) | default IAM role ARN for EKS worker groups |
+| <a name="output_worker_iam_role_name"></a> [worker\_iam\_role\_name](#output\_worker\_iam\_role\_name) | default IAM role name for EKS worker groups |
+| <a name="output_worker_security_group_id"></a> [worker\_security\_group\_id](#output\_worker\_security\_group\_id) | Security group ID attached to the EKS workers. |
+| <a name="output_workers_asg_arns"></a> [workers\_asg\_arns](#output\_workers\_asg\_arns) | IDs of the autoscaling groups containing workers. |
+| <a name="output_workers_asg_names"></a> [workers\_asg\_names](#output\_workers\_asg\_names) | Names of the autoscaling groups containing workers. |
+| <a name="output_workers_default_ami_id"></a> [workers\_default\_ami\_id](#output\_workers\_default\_ami\_id) | ID of the default worker group AMI |
+| <a name="output_workers_launch_template_arns"></a> [workers\_launch\_template\_arns](#output\_workers\_launch\_template\_arns) | ARNs of the worker launch templates. |
+| <a name="output_workers_launch_template_ids"></a> [workers\_launch\_template\_ids](#output\_workers\_launch\_template\_ids) | IDs of the worker launch templates. |
+| <a name="output_workers_launch_template_latest_versions"></a> [workers\_launch\_template\_latest\_versions](#output\_workers\_launch\_template\_latest\_versions) | Latest versions of the worker launch templates. |
+| <a name="output_workers_user_data"></a> [workers\_user\_data](#output\_workers\_user\_data) | User data of worker groups |
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/main.tf b/main.tf
index 90be71c..4709fe6 100644
--- a/main.tf
+++ b/main.tf
@@ -1,37 +1,34 @@
 module "control_plane" {
-  source = "./modules/control_plane"
-
-  cluster_create_security_group                = var.cluster_create_security_group
-  cluster_create_timeout                       = var.cluster_create_timeout
-  cluster_delete_timeout                       = var.cluster_delete_timeout
-  cluster_enabled_log_types                    = var.cluster_enabled_log_types
-  cluster_encryption_key_arn                   = var.cluster_encryption_key_arn
-  cluster_encryption_resources                 = var.cluster_encryption_resources
-  cluster_endpoint_private_access              = var.cluster_endpoint_private_access
-  cluster_endpoint_public_access               = var.cluster_endpoint_public_access
-  cluster_endpoint_public_access_cidrs         = var.cluster_endpoint_public_access_cidrs
-  cluster_iam_role_name                        = var.cluster_iam_role_name
-  cluster_log_kms_key_id                       = var.cluster_log_kms_key_id
-  cluster_log_retention_in_days                = var.cluster_log_retention_in_days
-  cluster_name                                 = var.cluster_name
-  cluster_security_group_id                    = var.cluster_security_group_id
-  cluster_version                              = var.cluster_version
-  config_output_path                           = var.config_output_path
-  create_eks                                   = var.create_eks
-  eks_oidc_root_ca_thumbprint                  = var.eks_oidc_root_ca_thumbprint
-  enable_irsa                                  = var.enable_irsa
-  iam_path                                     = var.iam_path
-  kubeconfig_aws_authenticator_additional_args = var.kubeconfig_aws_authenticator_additional_args
-  kubeconfig_aws_authenticator_command         = var.kubeconfig_aws_authenticator_command
-  kubeconfig_aws_authenticator_command_args    = var.kubeconfig_aws_authenticator_command_args
-  kubeconfig_aws_authenticator_env_variables   = var.kubeconfig_aws_authenticator_env_variables
-  kubeconfig_name                              = var.kubeconfig_name
-  manage_cluster_iam_resources                 = var.manage_cluster_iam_resources
-  permissions_boundary                         = var.permissions_boundary
-  subnets                                      = var.subnets
-  tags                                         = var.tags
-  vpc_id                                       = var.vpc_id
-  write_kubeconfig                             = var.write_kubeconfig
+  source                               = "./modules/control_plane"
+  region                               = var.region
+  cluster_create_security_group        = var.cluster_create_security_group
+  cluster_create_timeout               = var.cluster_create_timeout
+  cluster_delete_timeout               = var.cluster_delete_timeout
+  cluster_enabled_log_types            = var.cluster_enabled_log_types
+  cluster_encryption_key_arn           = var.cluster_encryption_key_arn
+  cluster_encryption_resources         = var.cluster_encryption_resources
+  cluster_endpoint_private_access      = var.cluster_endpoint_private_access
+  cluster_endpoint_public_access       = var.cluster_endpoint_public_access
+  cluster_endpoint_public_access_cidrs = var.cluster_endpoint_public_access_cidrs
+  cluster_iam_role_name                = var.cluster_iam_role_name
+  cluster_log_kms_key_id               = var.cluster_log_kms_key_id
+  cluster_log_retention_in_days        = var.cluster_log_retention_in_days
+  cluster_log_group_class              = var.cluster_log_group_class
+  cluster_name                         = var.cluster_name
+  cluster_security_group_id            = var.cluster_security_group_id
+  cluster_version                      = var.cluster_version
+  config_output_path                   = var.config_output_path
+  create_eks                           = var.create_eks
+  eks_oidc_root_ca_thumbprint          = var.eks_oidc_root_ca_thumbprint
+  enable_irsa                          = var.enable_irsa
+  iam_path                             = var.iam_path
+  kubeconfig_name                      = var.kubeconfig_name
+  manage_cluster_iam_resources         = var.manage_cluster_iam_resources
+  permissions_boundary                 = var.permissions_boundary
+  subnets                              = var.subnets
+  tags                                 = var.tags
+  vpc_id                               = var.vpc_id
+  write_kubeconfig                     = var.write_kubeconfig
 }
 
 module "worker_groups" {
diff --git a/modules/aws_auth/README.md b/modules/aws_auth/README.md
index 340654b..9ec76f7 100644
--- a/modules/aws_auth/README.md
+++ b/modules/aws_auth/README.md
@@ -1,32 +1,54 @@
 # eks `aws_auth` submodule
 
 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.9 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.52.0 |
+| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 1.6.2 |
+| <a name="requirement_null"></a> [null](#requirement\_null) | >= 2.1 |
+| <a name="requirement_template"></a> [template](#requirement\_template) | >= 2.1 |
+
 ## Providers
 
 | Name | Version |
 |------|---------|
-| aws | >= 2.52.0 |
-| kubernetes | >= 1.6.2 |
-| null | >= 2.1 |
-| template | >= 2.1 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 2.52.0 |
+| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | >= 1.6.2 |
+| <a name="provider_null"></a> [null](#provider\_null) | >= 2.1 |
+| <a name="provider_template"></a> [template](#provider\_template) | >= 2.1 |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [kubernetes_config_map.aws_auth](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/config_map) | resource |
+| [null_resource.wait_for_cluster](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
+| [aws_eks_cluster.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
+| [template_file.map_instances](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:-----:|
-| cluster\_name | Name of the EKS cluster. | `string` | n/a | yes |
-| create\_eks | Controls if EKS resources should be created (it affects almost all resources). | `bool` | `true` | no |
-| manage\_aws\_auth | Whether to apply the aws-auth configmap file. | `bool` | `true` | no |
-| map\_accounts | Additional AWS account numbers to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | `list(string)` | `[]` | no |
-| map\_instances | IAM instance roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br>    instance_role_arn = string<br>    platform          = string<br>  }))</pre> | `[]` | no |
-| map\_roles | Additional IAM roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br>    rolearn  = string<br>    username = string<br>    groups   = list(string)<br>  }))</pre> | `[]` | no |
-| map\_users | Additional IAM users to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br>    userarn  = string<br>    username = string<br>    groups   = list(string)<br>  }))</pre> | `[]` | no |
-| wait\_for\_cluster\_cmd | Custom local-exec command to execute for determining if the eks cluster is healthy. Cluster endpoint will be available as an environment variable called ENDPOINT | `string` | `"until wget --no-check-certificate -O - -q $ENDPOINT/healthz \u003e/dev/null; do sleep 4; done"` | no |
+|------|-------------|------|---------|:--------:|
+| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster. | `string` | n/a | yes |
+| <a name="input_create_eks"></a> [create\_eks](#input\_create\_eks) | Controls if EKS resources should be created (it affects almost all resources). | `bool` | `true` | no |
+| <a name="input_manage_aws_auth"></a> [manage\_aws\_auth](#input\_manage\_aws\_auth) | Whether to apply the aws-auth configmap file. | `bool` | `true` | no |
+| <a name="input_map_accounts"></a> [map\_accounts](#input\_map\_accounts) | Additional AWS account numbers to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | `list(string)` | `[]` | no |
+| <a name="input_map_instances"></a> [map\_instances](#input\_map\_instances) | IAM instance roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br>    instance_role_arn = string<br>    platform          = string<br>  }))</pre> | `[]` | no |
+| <a name="input_map_roles"></a> [map\_roles](#input\_map\_roles) | Additional IAM roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br>    rolearn  = string<br>    username = string<br>    groups   = list(string)<br>  }))</pre> | `[]` | no |
+| <a name="input_map_users"></a> [map\_users](#input\_map\_users) | Additional IAM users to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br>    userarn  = string<br>    username = string<br>    groups   = list(string)<br>  }))</pre> | `[]` | no |
+| <a name="input_wait_for_cluster_cmd"></a> [wait\_for\_cluster\_cmd](#input\_wait\_for\_cluster\_cmd) | Custom local-exec command to execute for determining if the eks cluster is healthy. Cluster endpoint will be available as an environment variable called ENDPOINT | `string` | `"until wget --no-check-certificate -O - -q $ENDPOINT/healthz >/dev/null; do sleep 4; done"` | no |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
-| config\_map\_aws\_auth | A kubernetes configuration to authenticate to this EKS cluster. |
-
+| <a name="output_config_map_aws_auth"></a> [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. |
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/modules/aws_auth/aws_auth.tf b/modules/aws_auth/aws_auth.tf
index 71a0ca0..c7f1d9d 100644
--- a/modules/aws_auth/aws_auth.tf
+++ b/modules/aws_auth/aws_auth.tf
@@ -35,7 +35,7 @@ resource "kubernetes_config_map" "aws_auth" {
 
   data = {
     mapRoles    = <<EOF
-${join("", distinct(data.template_file.map_instances.*.rendered))}
+${join("", distinct(data.template_file.map_instances[*].rendered))}
 %{if length(var.map_roles) != 0}${yamlencode(var.map_roles)}%{endif}
 EOF
     mapUsers    = yamlencode(var.map_users)
diff --git a/modules/aws_auth/outputs.tf b/modules/aws_auth/outputs.tf
index af71759..4ed645d 100644
--- a/modules/aws_auth/outputs.tf
+++ b/modules/aws_auth/outputs.tf
@@ -1,4 +1,4 @@
 output "config_map_aws_auth" {
   description = "A kubernetes configuration to authenticate to this EKS cluster."
-  value       = kubernetes_config_map.aws_auth.*
+  value       = kubernetes_config_map.aws_auth[*]
 }
diff --git a/modules/aws_auth/variables.tf b/modules/aws_auth/variables.tf
index 615d09e..8c92bf3 100644
--- a/modules/aws_auth/variables.tf
+++ b/modules/aws_auth/variables.tf
@@ -11,6 +11,7 @@ variable "cluster_name" {
 
 variable "manage_aws_auth" {
   description = "Whether to apply the aws-auth configmap file."
+  type        = bool
   default     = true
 }
 
diff --git a/modules/aws_auth/versions.tf b/modules/aws_auth/versions.tf
index cb67399..c0e2bc8 100644
--- a/modules/aws_auth/versions.tf
+++ b/modules/aws_auth/versions.tf
@@ -2,9 +2,21 @@ terraform {
   required_version = ">= 0.12.9"
 
   required_providers {
-    aws        = ">= 2.52.0"
-    null       = ">= 2.1"
-    template   = ">= 2.1"
-    kubernetes = ">= 1.6.2"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 2.52.0"
+    }
+    null = {
+      source  = "hashicorp/null"
+      version = ">= 2.1"
+    }
+    template = {
+      source  = "hashicorp/template"
+      version = ">= 2.1"
+    }
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = ">= 1.6.2"
+    }
   }
 }
diff --git a/modules/control_plane/README.md b/modules/control_plane/README.md
index d6aa523..aa4fdbc 100644
--- a/modules/control_plane/README.md
+++ b/modules/control_plane/README.md
@@ -8,14 +8,14 @@ This submodule is designed for use by both the parent `eks` module and by the us
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.9 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.52.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.30.0 |
 | <a name="requirement_local"></a> [local](#requirement\_local) | >= 1.2 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 2.52.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.30.0 |
 | <a name="provider_local"></a> [local](#provider\_local) | >= 1.2 |
 
 ## Modules
@@ -52,6 +52,7 @@ No modules.
 | <a name="input_cluster_endpoint_public_access"></a> [cluster\_endpoint\_public\_access](#input\_cluster\_endpoint\_public\_access) | Indicates whether or not the Amazon EKS public API server endpoint is enabled. | `bool` | `true` | no |
 | <a name="input_cluster_endpoint_public_access_cidrs"></a> [cluster\_endpoint\_public\_access\_cidrs](#input\_cluster\_endpoint\_public\_access\_cidrs) | List of CIDR blocks which can access the Amazon EKS public API server endpoint. | `list(string)` | <pre>[<br>  "0.0.0.0/0"<br>]</pre> | no |
 | <a name="input_cluster_iam_role_name"></a> [cluster\_iam\_role\_name](#input\_cluster\_iam\_role\_name) | IAM role name for the cluster. Only applicable if manage\_cluster\_iam\_resources is set to false. | `string` | `""` | no |
+| <a name="input_cluster_log_group_class"></a> [cluster\_log\_group\_class](#input\_cluster\_log\_group\_class) | Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT\_ACCESS | `string` | `"INFREQUENT_ACCESS"` | no |
 | <a name="input_cluster_log_kms_key_id"></a> [cluster\_log\_kms\_key\_id](#input\_cluster\_log\_kms\_key\_id) | If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html) | `string` | `""` | no |
 | <a name="input_cluster_log_retention_in_days"></a> [cluster\_log\_retention\_in\_days](#input\_cluster\_log\_retention\_in\_days) | Number of days to retain log events. Default retention - 90 days. | `number` | `90` | no |
 | <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster. Also used as a prefix in names of related resources. | `string` | n/a | yes |
diff --git a/modules/control_plane/cluster.tf b/modules/control_plane/cluster.tf
index 8a12623..75fb5be 100644
--- a/modules/control_plane/cluster.tf
+++ b/modules/control_plane/cluster.tf
@@ -1,7 +1,8 @@
 resource "aws_cloudwatch_log_group" "this" {
   count             = length(var.cluster_enabled_log_types) > 0 && var.create_eks ? 1 : 0
-  name              = "/aws/eks/${var.cluster_name}/cluster"
+  name              = "/aws/eks/${var.cluster_name}/logs"
   retention_in_days = var.cluster_log_retention_in_days
+  log_group_class   = var.cluster_log_group_class
   kms_key_id        = var.cluster_log_kms_key_id
   tags              = var.tags
 }
diff --git a/modules/control_plane/irsa.tf b/modules/control_plane/irsa.tf
index df2df0d..61d3075 100644
--- a/modules/control_plane/irsa.tf
+++ b/modules/control_plane/irsa.tf
@@ -11,5 +11,5 @@ resource "aws_iam_openid_connect_provider" "oidc_provider" {
   count           = var.create_eks && var.enable_irsa ? 1 : 0
   client_id_list  = ["sts.amazonaws.com"]
   thumbprint_list = [var.eks_oidc_root_ca_thumbprint]
-  url             = flatten(concat(aws_eks_cluster.this[*].identity[*].oidc.0.issuer, [""]))[0]
+  url             = flatten(concat(aws_eks_cluster.this[*].identity[*].oidc[0].issuer, [""]))[0]
 }
diff --git a/modules/control_plane/locals.tf b/modules/control_plane/locals.tf
index d664dcf..5448cc9 100644
--- a/modules/control_plane/locals.tf
+++ b/modules/control_plane/locals.tf
@@ -1,6 +1,6 @@
 locals {
-  cluster_security_group_id = var.cluster_create_security_group ? aws_security_group.cluster.0.id : var.cluster_security_group_id
-  cluster_iam_role_name     = var.manage_cluster_iam_resources ? aws_iam_role.cluster.0.name : var.cluster_iam_role_name
-  cluster_iam_role_arn      = var.manage_cluster_iam_resources ? aws_iam_role.cluster.0.arn : data.aws_iam_role.custom_cluster_iam_role.0.arn
+  cluster_security_group_id = var.cluster_create_security_group ? aws_security_group.cluster[0].id : var.cluster_security_group_id
+  cluster_iam_role_name     = var.manage_cluster_iam_resources ? aws_iam_role.cluster[0].name : var.cluster_iam_role_name
+  cluster_iam_role_arn      = var.manage_cluster_iam_resources ? aws_iam_role.cluster[0].arn : data.aws_iam_role.custom_cluster_iam_role[0].arn
   kubeconfig_name           = var.kubeconfig_name == "" ? "eks_${var.cluster_name}" : var.kubeconfig_name
 }
diff --git a/modules/control_plane/outputs.tf b/modules/control_plane/outputs.tf
index f673cad..ee43a20 100644
--- a/modules/control_plane/outputs.tf
+++ b/modules/control_plane/outputs.tf
@@ -1,11 +1,11 @@
 output "cluster_id" {
   description = "The name/id of the EKS cluster."
-  value       = element(concat(aws_eks_cluster.this.*.id, [""]), 0)
+  value       = element(concat(aws_eks_cluster.this[*].id, [""]), 0)
 }
 
 output "cluster_arn" {
   description = "The Amazon Resource Name (ARN) of the cluster."
-  value       = element(concat(aws_eks_cluster.this.*.arn, [""]), 0)
+  value       = element(concat(aws_eks_cluster.this[*].arn, [""]), 0)
 }
 
 output "cluster_certificate_authority_data" {
@@ -15,7 +15,7 @@ output "cluster_certificate_authority_data" {
 
 output "cluster_endpoint" {
   description = "The endpoint for your EKS Kubernetes API."
-  value       = element(concat(aws_eks_cluster.this.*.endpoint, [""]), 0)
+  value       = element(concat(aws_eks_cluster.this[*].endpoint, [""]), 0)
 }
 
 output "cluster_version" {
@@ -35,7 +35,7 @@ output "cluster_iam_role_arn" {
 
 output "cluster_oidc_issuer_url" {
   description = "The URL on the EKS cluster OIDC Issuer"
-  value       = var.enable_irsa ? flatten(concat(aws_eks_cluster.this[*].identity[*].oidc.0.issuer, [""]))[0] : null
+  value       = var.enable_irsa ? flatten(concat(aws_eks_cluster.this[*].identity[*].oidc[0].issuer, [""]))[0] : null
 }
 
 output "cloudwatch_log_group_name" {
@@ -50,7 +50,7 @@ output "kubeconfig" {
 
 output "kubeconfig_filename" {
   description = "The filename of the generated kubectl config."
-  value       = concat(local_file.kubeconfig.*.filename, [""])[0]
+  value       = concat(local_file.kubeconfig[*].filename, [""])[0]
 }
 
 output "oidc_provider_arn" {
diff --git a/modules/control_plane/variables.tf b/modules/control_plane/variables.tf
index ae2184d..6bbf60d 100644
--- a/modules/control_plane/variables.tf
+++ b/modules/control_plane/variables.tf
@@ -26,6 +26,12 @@ variable "cluster_log_retention_in_days" {
   type        = number
 }
 
+variable "cluster_log_group_class" {
+  default     = "INFREQUENT_ACCESS"
+  description = "Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT_ACCESS"
+  type        = string
+}
+
 variable "cluster_name" {
   description = "Name of the EKS cluster. Also used as a prefix in names of related resources."
   type        = string
diff --git a/modules/control_plane/versions.tf b/modules/control_plane/versions.tf
index b7d789f..dff2653 100644
--- a/modules/control_plane/versions.tf
+++ b/modules/control_plane/versions.tf
@@ -2,7 +2,13 @@ terraform {
   required_version = ">= 0.12.9"
 
   required_providers {
-    aws   = ">= 2.52.0"
-    local = ">= 1.2"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 5.30.0"
+    }
+    local = {
+      source  = "hashicorp/local"
+      version = ">= 1.2"
+    }
   }
 }
diff --git a/modules/node_groups/README.md b/modules/node_groups/README.md
index 6557997..8c1db2a 100644
--- a/modules/node_groups/README.md
+++ b/modules/node_groups/README.md
@@ -24,35 +24,59 @@ This submodule is designed for use by both the parent `eks` module and by the us
 | version | Kubernetes version | `string` | Provider default behavior |
 
 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.9 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.52.0 |
+| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.1 |
+
 ## Providers
 
 | Name | Version |
 |------|---------|
-| aws | >= 2.52.0 |
-| random | >= 2.1 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 2.52.0 |
+| <a name="provider_random"></a> [random](#provider\_random) | >= 2.1 |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_eks_node_group.node_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_node_group) | resource |
+| [aws_iam_role.node_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role_policy_attachment.nodes_AmazonEC2ContainerRegistryReadOnly](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_iam_role_policy_attachment.nodes_AmazonEKSWorkerNodePolicy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_iam_role_policy_attachment.nodes_AmazonEKS_CNI_Policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_iam_role_policy_attachment.nodes_additional_policies](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [random_pet.node_groups](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource |
+| [aws_iam_policy_document.node_groups_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:-----:|
-| attach\_node\_cni\_policy | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default node groups IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster. | `bool` | `true` | no |
-| cluster\_name | Name of parent cluster. | `string` | n/a | yes |
-| create\_eks | Controls if EKS resources should be created (it affects almost all resources). | `bool` | `true` | no |
-| iam\_path | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no |
-| manage\_node\_iam\_resources | Whether to let the module manage node group IAM resources. If set to false, iam\_instance\_profile\_name must be specified for nodes. | `bool` | `true` | no |
-| node\_groups | Map of map of node groups to create. See documentation above for more details. | `any` | `{}` | no |
-| node\_groups\_additional\_policies | Additional policies to be added to node groups. | `list(string)` | `[]` | no |
-| node\_groups\_defaults | Map of values to be applied to all node groups. See documentation above for more details. | `any` | `{}` | no |
-| node\_groups\_role\_name | User defined node groups role name. | `string` | `""` | no |
-| permissions\_boundary | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | n/a | yes |
-| subnets | A list of subnets to place the EKS cluster and nodes within. | `list(string)` | n/a | yes |
-| tags | A map of tags to add to all resources. | `map(string)` | n/a | yes |
+|------|-------------|------|---------|:--------:|
+| <a name="input_attach_node_cni_policy"></a> [attach\_node\_cni\_policy](#input\_attach\_node\_cni\_policy) | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default node groups IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster. | `bool` | `true` | no |
+| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of parent cluster. | `string` | n/a | yes |
+| <a name="input_create_eks"></a> [create\_eks](#input\_create\_eks) | Controls if EKS resources should be created (it affects almost all resources). | `bool` | `true` | no |
+| <a name="input_iam_path"></a> [iam\_path](#input\_iam\_path) | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no |
+| <a name="input_manage_node_iam_resources"></a> [manage\_node\_iam\_resources](#input\_manage\_node\_iam\_resources) | Whether to let the module manage node group IAM resources. If set to false, iam\_instance\_profile\_name must be specified for nodes. | `bool` | `true` | no |
+| <a name="input_node_groups"></a> [node\_groups](#input\_node\_groups) | Map of map of node groups to create. See documentation above for more details. | `any` | `{}` | no |
+| <a name="input_node_groups_additional_policies"></a> [node\_groups\_additional\_policies](#input\_node\_groups\_additional\_policies) | Additional policies to be added to node groups. | `list(string)` | `[]` | no |
+| <a name="input_node_groups_defaults"></a> [node\_groups\_defaults](#input\_node\_groups\_defaults) | Map of values to be applied to all node groups. See documentation above for more details. | `any` | `{}` | no |
+| <a name="input_node_groups_role_name"></a> [node\_groups\_role\_name](#input\_node\_groups\_role\_name) | User defined node groups role name. | `string` | `""` | no |
+| <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | `null` | no |
+| <a name="input_subnets"></a> [subnets](#input\_subnets) | A list of subnets to place the EKS cluster and nodes within. | `list(string)` | n/a | yes |
+| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to all resources. | `map(string)` | n/a | yes |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
-| aws\_auth\_roles | Roles for use in aws-auth ConfigMap |
-| node\_groups | Outputs from EKS node groups. Map of maps, keyed by `var.node_groups` keys. See `aws_eks_node_group` Terraform documentation for values |
-
+| <a name="output_aws_auth_roles"></a> [aws\_auth\_roles](#output\_aws\_auth\_roles) | Roles for use in aws-auth ConfigMap |
+| <a name="output_node_groups"></a> [node\_groups](#output\_node\_groups) | Outputs from EKS node groups. Map of maps, keyed by `var.node_groups` keys. See `aws_eks_node_group` Terraform documentation for values |
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/modules/node_groups/locals.tf b/modules/node_groups/locals.tf
index 0b340cf..9ea6c60 100644
--- a/modules/node_groups/locals.tf
+++ b/modules/node_groups/locals.tf
@@ -1,6 +1,6 @@
 locals {
   node_group_defaults = {
-    iam_role_arn     = concat(aws_iam_role.node_groups.*.arn, [""])[0]
+    iam_role_arn     = concat(aws_iam_role.node_groups[*].arn, [""])[0]
     instance_type    = "m4.large"  # Size of the node group instances.
     desired_capacity = "1"         # Desired node group capacity in the autoscaling group. Note: Ignored on change. Hint: Use the Cluster Autoscaler.
     max_capacity     = "3"         # Maximum node group capacity in the autoscaling group.
diff --git a/modules/node_groups/node_groups.tf b/modules/node_groups/node_groups.tf
index 444b92f..504808f 100644
--- a/modules/node_groups/node_groups.tf
+++ b/modules/node_groups/node_groups.tf
@@ -45,7 +45,7 @@ resource "aws_eks_node_group" "node_groups" {
 
   lifecycle {
     create_before_destroy = true
-    ignore_changes        = [scaling_config.0.desired_size]
+    ignore_changes        = [scaling_config[0].desired_size]
   }
 
   depends_on = [
diff --git a/modules/node_groups/versions.tf b/modules/node_groups/versions.tf
index 73c25f6..b2772c7 100644
--- a/modules/node_groups/versions.tf
+++ b/modules/node_groups/versions.tf
@@ -2,7 +2,13 @@ terraform {
   required_version = ">= 0.12.9"
 
   required_providers {
-    aws    = ">= 2.52.0"
-    random = ">= 2.1"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 2.52.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 2.1"
+    }
   }
 }
diff --git a/modules/worker_groups/README.md b/modules/worker_groups/README.md
index 9f38fb2..94789f7 100644
--- a/modules/worker_groups/README.md
+++ b/modules/worker_groups/README.md
@@ -11,64 +11,94 @@ This submodule is designed for use by both the parent `eks` module and by the us
 
 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.9 |
-| aws | >= 2.52.0 |
-| random | >= 2.1 |
-| template | >= 2.1 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.9 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.52.0 |
+| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.1 |
+| <a name="requirement_template"></a> [template](#requirement\_template) | >= 2.1 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| aws | >= 2.52.0 |
-| template | >= 2.1 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 2.52.0 |
+| <a name="provider_template"></a> [template](#provider\_template) | >= 2.1 |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_autoscaling_group.worker_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/autoscaling_group) | resource |
+| [aws_iam_instance_profile.worker_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource |
+| [aws_iam_role.worker_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role_policy_attachment.workers_AmazonEC2ContainerRegistryReadOnly](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_iam_role_policy_attachment.workers_AmazonEKSWorkerNodePolicy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_iam_role_policy_attachment.workers_AmazonEKS_CNI_Policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_iam_role_policy_attachment.workers_additional_policies](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_launch_template.worker_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template) | resource |
+| [aws_security_group.worker_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
+| [aws_security_group_rule.cluster_https_workers_ingress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
+| [aws_security_group_rule.workers_egress_internet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
+| [aws_security_group_rule.workers_ingress_cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
+| [aws_security_group_rule.workers_ingress_cluster_https](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
+| [aws_security_group_rule.workers_ingress_cluster_kubelet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
+| [aws_security_group_rule.workers_ingress_self](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
+| [aws_ami.eks_worker](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
+| [aws_ami.eks_worker_windows](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
+| [aws_eks_cluster.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
+| [aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_instance_profile) | data source |
+| [aws_iam_policy_document.workers_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
+| [template_file.launch_template_userdata](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| attach\_worker\_cni\_policy | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default worker groups IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-worker` DaemonSet pods via another method or workers will not be able to join the cluster. | `bool` | `true` | no |
-| cluster\_name | Name of the parent EKS cluster. | `string` | n/a | yes |
-| cluster\_security\_group\_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the workers | `string` | n/a | yes |
-| create\_eks | Controls if EKS resources should be created (it affects almost all resources). | `bool` | `true` | no |
-| iam\_path | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no |
-| manage\_worker\_iam\_resources | Whether to let the module manage worker IAM resources. If set to false, iam\_instance\_profile\_name must be specified for workers. | `bool` | `true` | no |
-| permissions\_boundary | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | `null` | no |
-| subnets | A list of subnets to place the EKS cluster and workers within. | `list(string)` | n/a | yes |
-| tags | A map of tags to add to all resources. | `map(string)` | n/a | yes |
-| vpc\_id | VPC where the cluster and workers will be deployed. | `string` | n/a | yes |
-| worker\_additional\_security\_group\_ids | A list of additional security group ids to attach to worker instances | `list(string)` | `[]` | no |
-| worker\_ami\_name\_filter | Name filter for AWS EKS worker AMI. If not provided, the latest official AMI for the specified 'cluster\_version' is used. | `string` | `""` | no |
-| worker\_ami\_name\_filter\_windows | Name filter for AWS EKS Windows worker AMI. If not provided, the latest official AMI for the specified 'cluster\_version' is used. | `string` | `""` | no |
-| worker\_ami\_owner\_id | The ID of the owner for the AMI to use for the AWS EKS workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"602401143452"` | no |
-| worker\_ami\_owner\_id\_windows | The ID of the owner for the AMI to use for the AWS EKS Windows workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"801119661308"` | no |
-| worker\_create\_initial\_lifecycle\_hooks | Whether to create initial lifecycle hooks provided in worker groups. | `bool` | `false` | no |
-| worker\_create\_security\_group | Whether to create a security group for the workers or attach the workers to `worker_security_group_id`. | `bool` | `true` | no |
-| worker\_groups | Map of map of worker groups to create. See documentation above for more details. | `any` | `{}` | no |
-| worker\_groups\_additional\_policies | Additional policies to be added to worker groups. | `list(string)` | `[]` | no |
-| worker\_groups\_defaults | Map of values to be applied to all worker groups. See documentation above for more details. | `any` | `{}` | no |
-| worker\_groups\_role\_name | User defined worker groups role name. | `string` | `""` | no |
-| worker\_security\_group\_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the EKS cluster. | `string` | `""` | no |
-| worker\_sg\_ingress\_from\_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | `number` | `1025` | no |
-| workers\_additional\_policies | Additional policies to be added to workers | `list(string)` | `[]` | no |
-| workers\_role\_name | User defined workers role name. | `string` | `""` | no |
+| <a name="input_attach_worker_cni_policy"></a> [attach\_worker\_cni\_policy](#input\_attach\_worker\_cni\_policy) | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default worker groups IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-worker` DaemonSet pods via another method or workers will not be able to join the cluster. | `bool` | `true` | no |
+| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the parent EKS cluster. | `string` | n/a | yes |
+| <a name="input_cluster_security_group_id"></a> [cluster\_security\_group\_id](#input\_cluster\_security\_group\_id) | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the workers | `string` | n/a | yes |
+| <a name="input_create_eks"></a> [create\_eks](#input\_create\_eks) | Controls if EKS resources should be created (it affects almost all resources). | `bool` | `true` | no |
+| <a name="input_iam_path"></a> [iam\_path](#input\_iam\_path) | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no |
+| <a name="input_manage_worker_iam_resources"></a> [manage\_worker\_iam\_resources](#input\_manage\_worker\_iam\_resources) | Whether to let the module manage worker IAM resources. If set to false, iam\_instance\_profile\_name must be specified for workers. | `bool` | `true` | no |
+| <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | `null` | no |
+| <a name="input_subnets"></a> [subnets](#input\_subnets) | A list of subnets to place the EKS cluster and workers within. | `list(string)` | n/a | yes |
+| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to all resources. | `map(string)` | n/a | yes |
+| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | VPC where the cluster and workers will be deployed. | `string` | n/a | yes |
+| <a name="input_worker_additional_security_group_ids"></a> [worker\_additional\_security\_group\_ids](#input\_worker\_additional\_security\_group\_ids) | A list of additional security group ids to attach to worker instances | `list(string)` | `[]` | no |
+| <a name="input_worker_ami_name_filter"></a> [worker\_ami\_name\_filter](#input\_worker\_ami\_name\_filter) | Name filter for AWS EKS worker AMI. If not provided, the latest official AMI for the specified 'cluster\_version' is used. | `string` | `""` | no |
+| <a name="input_worker_ami_name_filter_windows"></a> [worker\_ami\_name\_filter\_windows](#input\_worker\_ami\_name\_filter\_windows) | Name filter for AWS EKS Windows worker AMI. If not provided, the latest official AMI for the specified 'cluster\_version' is used. | `string` | `""` | no |
+| <a name="input_worker_ami_owner_id"></a> [worker\_ami\_owner\_id](#input\_worker\_ami\_owner\_id) | The ID of the owner for the AMI to use for the AWS EKS workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"602401143452"` | no |
+| <a name="input_worker_ami_owner_id_windows"></a> [worker\_ami\_owner\_id\_windows](#input\_worker\_ami\_owner\_id\_windows) | The ID of the owner for the AMI to use for the AWS EKS Windows workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"801119661308"` | no |
+| <a name="input_worker_create_initial_lifecycle_hooks"></a> [worker\_create\_initial\_lifecycle\_hooks](#input\_worker\_create\_initial\_lifecycle\_hooks) | Whether to create initial lifecycle hooks provided in worker groups. | `bool` | `false` | no |
+| <a name="input_worker_create_security_group"></a> [worker\_create\_security\_group](#input\_worker\_create\_security\_group) | Whether to create a security group for the workers or attach the workers to `worker_security_group_id`. | `bool` | `true` | no |
+| <a name="input_worker_groups"></a> [worker\_groups](#input\_worker\_groups) | Map of map of worker groups to create. See documentation above for more details. | `any` | `{}` | no |
+| <a name="input_worker_groups_additional_policies"></a> [worker\_groups\_additional\_policies](#input\_worker\_groups\_additional\_policies) | Additional policies to be added to worker groups. | `list(string)` | `[]` | no |
+| <a name="input_worker_groups_defaults"></a> [worker\_groups\_defaults](#input\_worker\_groups\_defaults) | Map of values to be applied to all worker groups. See documentation above for more details. | `any` | `{}` | no |
+| <a name="input_worker_groups_role_name"></a> [worker\_groups\_role\_name](#input\_worker\_groups\_role\_name) | User defined worker groups role name. | `string` | `""` | no |
+| <a name="input_worker_security_group_id"></a> [worker\_security\_group\_id](#input\_worker\_security\_group\_id) | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the EKS cluster. | `string` | `""` | no |
+| <a name="input_worker_sg_ingress_from_port"></a> [worker\_sg\_ingress\_from\_port](#input\_worker\_sg\_ingress\_from\_port) | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | `number` | `1025` | no |
+| <a name="input_workers_additional_policies"></a> [workers\_additional\_policies](#input\_workers\_additional\_policies) | Additional policies to be added to workers | `list(string)` | `[]` | no |
+| <a name="input_workers_role_name"></a> [workers\_role\_name](#input\_workers\_role\_name) | User defined workers role name. | `string` | `""` | no |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
-| aws\_auth\_roles | Roles for use in aws-auth ConfigMap |
-| worker\_iam\_instance\_profile\_arns | default IAM instance profile ARN for EKS worker groups |
-| worker\_iam\_instance\_profile\_names | default IAM instance profile name for EKS worker groups |
-| worker\_iam\_role\_arn | default IAM role ARN for EKS worker groups |
-| worker\_iam\_role\_name | default IAM role name for EKS worker groups |
-| worker\_security\_group\_id | Security group ID attached to the EKS workers. |
-| workers\_asg\_arns | IDs of the autoscaling groups containing workers. |
-| workers\_asg\_names | Names of the autoscaling groups containing workers. |
-| workers\_default\_ami\_id | ID of the default worker group AMI |
-| workers\_launch\_template\_arns | ARNs of the worker launch templates. |
-| workers\_launch\_template\_ids | IDs of the worker launch templates. |
-| workers\_launch\_template\_latest\_versions | Latest versions of the worker launch templates. |
-| workers\_user\_data | User data of worker groups |
-
+| <a name="output_aws_auth_roles"></a> [aws\_auth\_roles](#output\_aws\_auth\_roles) | Roles for use in aws-auth ConfigMap |
+| <a name="output_worker_iam_instance_profile_arns"></a> [worker\_iam\_instance\_profile\_arns](#output\_worker\_iam\_instance\_profile\_arns) | default IAM instance profile ARN for EKS worker groups |
+| <a name="output_worker_iam_instance_profile_names"></a> [worker\_iam\_instance\_profile\_names](#output\_worker\_iam\_instance\_profile\_names) | default IAM instance profile name for EKS worker groups |
+| <a name="output_worker_iam_role_arn"></a> [worker\_iam\_role\_arn](#output\_worker\_iam\_role\_arn) | default IAM role ARN for EKS worker groups |
+| <a name="output_worker_iam_role_name"></a> [worker\_iam\_role\_name](#output\_worker\_iam\_role\_name) | default IAM role name for EKS worker groups |
+| <a name="output_worker_security_group_id"></a> [worker\_security\_group\_id](#output\_worker\_security\_group\_id) | Security group ID attached to the EKS workers. |
+| <a name="output_workers_asg_arns"></a> [workers\_asg\_arns](#output\_workers\_asg\_arns) | IDs of the autoscaling groups containing workers. |
+| <a name="output_workers_asg_names"></a> [workers\_asg\_names](#output\_workers\_asg\_names) | Names of the autoscaling groups containing workers. |
+| <a name="output_workers_default_ami_id"></a> [workers\_default\_ami\_id](#output\_workers\_default\_ami\_id) | ID of the default worker group AMI |
+| <a name="output_workers_launch_template_arns"></a> [workers\_launch\_template\_arns](#output\_workers\_launch\_template\_arns) | ARNs of the worker launch templates. |
+| <a name="output_workers_launch_template_ids"></a> [workers\_launch\_template\_ids](#output\_workers\_launch\_template\_ids) | IDs of the worker launch templates. |
+| <a name="output_workers_launch_template_latest_versions"></a> [workers\_launch\_template\_latest\_versions](#output\_workers\_launch\_template\_latest\_versions) | Latest versions of the worker launch templates. |
+| <a name="output_workers_user_data"></a> [workers\_user\_data](#output\_workers\_user\_data) | User data of worker groups |
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/modules/worker_groups/data.tf b/modules/worker_groups/data.tf
index d78e107..e8fd2f0 100644
--- a/modules/worker_groups/data.tf
+++ b/modules/worker_groups/data.tf
@@ -69,7 +69,7 @@ data "template_file" "launch_template_userdata" {
     platform             = each.value["platform"]
     cluster_name         = var.cluster_name
     endpoint             = data.aws_eks_cluster.this.endpoint
-    cluster_auth_base64  = data.aws_eks_cluster.this.certificate_authority.0.data
+    cluster_auth_base64  = data.aws_eks_cluster.this.certificate_authority[0].data
     pre_userdata         = each.value["pre_userdata"]
     additional_userdata  = each.value["additional_userdata"]
     bootstrap_extra_args = each.value["bootstrap_extra_args"]
diff --git a/modules/worker_groups/locals.tf b/modules/worker_groups/locals.tf
index 03b7982..d6d0951 100644
--- a/modules/worker_groups/locals.tf
+++ b/modules/worker_groups/locals.tf
@@ -8,7 +8,7 @@ locals {
     )
   ]
 
-  default_iam_role_id    = concat(aws_iam_role.worker_groups.*.id, [""])[0]
+  default_iam_role_id    = concat(aws_iam_role.worker_groups[*].id, [""])[0]
   default_ami_id_linux   = data.aws_ami.eks_worker.id
   default_ami_id_windows = data.aws_ami.eks_worker_windows.id
 
@@ -80,7 +80,7 @@ locals {
     v,
   ) if var.create_eks }
 
-  worker_security_group_id = local.worker_create_security_group ? aws_security_group.worker_groups.0.id : var.worker_security_group_id
+  worker_security_group_id = local.worker_create_security_group ? aws_security_group.worker_groups[0].id : var.worker_security_group_id
 
   policy_arn_prefix = contains(["cn-northwest-1", "cn-north-1"], data.aws_region.current.name) ? "arn:aws-cn:iam::aws:policy" : "arn:aws:iam::aws:policy"
 
diff --git a/modules/worker_groups/outputs.tf b/modules/worker_groups/outputs.tf
index 08bc04e..c440306 100644
--- a/modules/worker_groups/outputs.tf
+++ b/modules/worker_groups/outputs.tf
@@ -10,17 +10,17 @@ output "aws_auth_roles" {
 
 output "workers_asg_arns" {
   description = "IDs of the autoscaling groups containing workers."
-  value       = values(aws_autoscaling_group.worker_groups).*.arn
+  value       = values(aws_autoscaling_group.worker_groups)[*].arn
 }
 
 output "workers_asg_names" {
   description = "Names of the autoscaling groups containing workers."
-  value       = values(aws_autoscaling_group.worker_groups).*.id
+  value       = values(aws_autoscaling_group.worker_groups)[*].id
 }
 
 output "workers_user_data" {
   description = "User data of worker groups"
-  value       = values(data.template_file.launch_template_userdata).*.rendered
+  value       = values(data.template_file.launch_template_userdata)[*].rendered
 }
 
 output "workers_default_ami_id" {
@@ -30,17 +30,17 @@ output "workers_default_ami_id" {
 
 output "workers_launch_template_ids" {
   description = "IDs of the worker launch templates."
-  value       = values(aws_launch_template.worker_groups).*.id
+  value       = values(aws_launch_template.worker_groups)[*].id
 }
 
 output "workers_launch_template_arns" {
   description = "ARNs of the worker launch templates."
-  value       = values(aws_launch_template.worker_groups).*.arn
+  value       = values(aws_launch_template.worker_groups)[*].arn
 }
 
 output "workers_launch_template_latest_versions" {
   description = "Latest versions of the worker launch templates."
-  value       = values(aws_launch_template.worker_groups).*.latest_version
+  value       = values(aws_launch_template.worker_groups)[*].latest_version
 }
 
 output "worker_security_group_id" {
@@ -50,19 +50,19 @@ output "worker_security_group_id" {
 
 output "worker_iam_instance_profile_arns" {
   description = "default IAM instance profile ARN for EKS worker groups"
-  value       = values(aws_iam_instance_profile.worker_groups).*.arn
+  value       = values(aws_iam_instance_profile.worker_groups)[*].arn
 }
 
 output "worker_iam_instance_profile_names" {
   description = "default IAM instance profile name for EKS worker groups"
-  value       = values(aws_iam_instance_profile.worker_groups).*.name
+  value       = values(aws_iam_instance_profile.worker_groups)[*].name
 }
 
 output "worker_iam_role_name" {
   description = "default IAM role name for EKS worker groups"
   value = coalescelist(
-    aws_iam_role.worker_groups.*.name,
-    values(data.aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile).*.role_name,
+    aws_iam_role.worker_groups[*].name,
+    values(data.aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile)[*].role_name,
     [""]
   )[0]
 }
@@ -70,8 +70,8 @@ output "worker_iam_role_name" {
 output "worker_iam_role_arn" {
   description = "default IAM role ARN for EKS worker groups"
   value = coalescelist(
-    aws_iam_role.worker_groups.*.arn,
-    values(data.aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile).*.role_arn,
+    aws_iam_role.worker_groups[*].arn,
+    values(data.aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile)[*].role_arn,
     [""]
   )[0]
 }
diff --git a/modules/worker_groups/variables.tf b/modules/worker_groups/variables.tf
index b487059..661db3b 100644
--- a/modules/worker_groups/variables.tf
+++ b/modules/worker_groups/variables.tf
@@ -31,6 +31,7 @@ variable "subnets" {
   type        = list(string)
 }
 
+# tflint-ignore: terraform_unused_declarations
 variable "worker_groups_role_name" {
   description = "User defined worker groups role name."
   type        = string
@@ -54,7 +55,7 @@ variable "attach_worker_cni_policy" {
   type        = bool
   default     = true
 }
-
+# tflint-ignore: terraform_unused_declarations
 variable "worker_groups_additional_policies" {
   description = "Additional policies to be added to worker groups."
   type        = list(string)
diff --git a/modules/worker_groups/versions.tf b/modules/worker_groups/versions.tf
index 598469c..1da25a1 100644
--- a/modules/worker_groups/versions.tf
+++ b/modules/worker_groups/versions.tf
@@ -2,8 +2,17 @@ terraform {
   required_version = ">= 0.12.9"
 
   required_providers {
-    aws      = ">= 2.52.0"
-    template = ">= 2.1"
-    random   = ">= 2.1"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 2.52.0"
+    }
+    template = {
+      source  = "hashicorp/template"
+      version = ">= 2.1"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 2.1"
+    }
   }
 }
diff --git a/variables.tf b/variables.tf
index 53f40fe..51a9f17 100644
--- a/variables.tf
+++ b/variables.tf
@@ -14,6 +14,12 @@ variable "cluster_log_retention_in_days" {
   type        = number
 }
 
+variable "cluster_log_group_class" {
+  default     = "INFREQUENT_ACCESS"
+  description = "Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT_ACCESS"
+  type        = string
+}
+
 variable "cluster_name" {
   description = "Name of the EKS cluster. Also used as a prefix in names of related resources."
   type        = string
@@ -45,6 +51,7 @@ variable "write_kubeconfig" {
 
 variable "manage_aws_auth" {
   description = "Whether to apply the aws-auth configmap file."
+  type        = bool
   default     = true
 }
 
@@ -102,12 +109,6 @@ variable "worker_groups_defaults" {
   default     = {}
 }
 
-variable "worker_groups_launch_template" {
-  description = "A list of maps defining worker group configurations to be defined using AWS Launch Templates. See workers_group_defaults for valid keys."
-  type        = any
-  default     = []
-}
-
 variable "worker_security_group_id" {
   description = "If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the EKS cluster."
   type        = string
@@ -162,30 +163,6 @@ variable "node_groups_additional_policies" {
   default     = []
 }
 
-variable "kubeconfig_aws_authenticator_command" {
-  description = "Command to use to fetch AWS EKS credentials."
-  type        = string
-  default     = "aws-iam-authenticator"
-}
-
-variable "kubeconfig_aws_authenticator_command_args" {
-  description = "Default arguments passed to the authenticator command. Defaults to [token -i $cluster_name]."
-  type        = list(string)
-  default     = []
-}
-
-variable "kubeconfig_aws_authenticator_additional_args" {
-  description = "Any additional arguments to pass to the authenticator such as the role to assume. e.g. [\"-r\", \"MyEksRole\"]."
-  type        = list(string)
-  default     = []
-}
-
-variable "kubeconfig_aws_authenticator_env_variables" {
-  description = "Environment variables that should be used when executing the authenticator. e.g. { AWS_PROFILE = \"eks\"}."
-  type        = map(string)
-  default     = {}
-}
-
 variable "kubeconfig_name" {
   description = "Override the default name used for items kubeconfig."
   type        = string
@@ -347,3 +324,8 @@ variable "cluster_encryption_resources" {
   description = "A list of the EKS resources to encrypt."
   default     = ["secrets"]
 }
+
+variable "region" {
+  type        = string
+  description = "AWS region"
+}

From c57d6d09c0b671b868bd63f89e9e1ed0b5dc24c7 Mon Sep 17 00:00:00 2001
From: Andy Townsend <me@andytownsend.co.uk>
Date: Wed, 26 Mar 2025 10:22:54 +0000
Subject: [PATCH 13/21] chore(release): Update changelog for v11.2.2

---
 CHANGELOG.md | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f5bfc5b..74b88e9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,10 +2,17 @@
 <a name="unreleased"></a>
 ## [Unreleased]
 
+<a name="v11.2.2"></a>
+## [v11.2.2] - 2025-03-26
+### ✨ Features
+- [5cff1d3](https://github.com/devopsmakers/terraform-aws-eks/commit/5cff1d3) support log_group_class - BOS-3058 ([#6](https://github.com/devopsmakers/terraform-aws-eks/issues/6))
+
+
 <a name="v11.2.1"></a>
 ## [v11.2.1] - 2022-09-07
 ### 🔧 Maintenance
 - [71f596a](https://github.com/devopsmakers/terraform-aws-eks/commit/71f596a) update kubeconfig to current apiversion
+- **release:** [0efd9f2](https://github.com/devopsmakers/terraform-aws-eks/commit/0efd9f2) Update changelog for v11.2.1
 
 
 <a name="v11.2.0"></a>
@@ -150,7 +157,8 @@
 - [6338f6d](https://github.com/devopsmakers/terraform-aws-eks/commit/6338f6d) Initial commit
 
 
-[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.1...HEAD
+[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.2...HEAD
+[v11.2.2]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.1...v11.2.2
 [v11.2.1]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.0...v11.2.1
 [v11.2.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.1.0...v11.2.0
 [v11.1.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.0.1...v11.1.0

From e87a9e720a34efd7ae9680ee301e3850ed8d8eea Mon Sep 17 00:00:00 2001
From: Andy Townsend <andy-townsend@users.noreply.github.com>
Date: Thu, 27 Mar 2025 14:33:27 +0000
Subject: [PATCH 14/21] chore: change log_group name back to cluster (#7)

---
 modules/control_plane/cluster.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/control_plane/cluster.tf b/modules/control_plane/cluster.tf
index 75fb5be..3aa33d7 100644
--- a/modules/control_plane/cluster.tf
+++ b/modules/control_plane/cluster.tf
@@ -1,6 +1,6 @@
 resource "aws_cloudwatch_log_group" "this" {
   count             = length(var.cluster_enabled_log_types) > 0 && var.create_eks ? 1 : 0
-  name              = "/aws/eks/${var.cluster_name}/logs"
+  name              = "/aws/eks/${var.cluster_name}/cluster"
   retention_in_days = var.cluster_log_retention_in_days
   log_group_class   = var.cluster_log_group_class
   kms_key_id        = var.cluster_log_kms_key_id

From 7c944c22c77515893438cc995c7b2c4ab149d372 Mon Sep 17 00:00:00 2001
From: Andy Townsend <me@andytownsend.co.uk>
Date: Thu, 27 Mar 2025 14:33:44 +0000
Subject: [PATCH 15/21] chore(release): Update changelog for v11.2.3

---
 CHANGELOG.md | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 74b88e9..4d522c2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,11 +2,20 @@
 <a name="unreleased"></a>
 ## [Unreleased]
 
+<a name="v11.2.3"></a>
+## [v11.2.3] - 2025-03-27
+### 🔧 Maintenance
+- [e87a9e7](https://github.com/devopsmakers/terraform-aws-eks/commit/e87a9e7) change log_group name back to cluster ([#7](https://github.com/devopsmakers/terraform-aws-eks/issues/7))
+
+
 <a name="v11.2.2"></a>
 ## [v11.2.2] - 2025-03-26
 ### ✨ Features
 - [5cff1d3](https://github.com/devopsmakers/terraform-aws-eks/commit/5cff1d3) support log_group_class - BOS-3058 ([#6](https://github.com/devopsmakers/terraform-aws-eks/issues/6))
 
+### 🔧 Maintenance
+- **release:** [c57d6d0](https://github.com/devopsmakers/terraform-aws-eks/commit/c57d6d0) Update changelog for v11.2.2
+
 
 <a name="v11.2.1"></a>
 ## [v11.2.1] - 2022-09-07
@@ -157,7 +166,8 @@
 - [6338f6d](https://github.com/devopsmakers/terraform-aws-eks/commit/6338f6d) Initial commit
 
 
-[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.2...HEAD
+[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.3...HEAD
+[v11.2.3]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.2...v11.2.3
 [v11.2.2]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.1...v11.2.2
 [v11.2.1]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.0...v11.2.1
 [v11.2.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.1.0...v11.2.0

From 4449c6a1ece03c341cca7bdcf2bf10cce1dca665 Mon Sep 17 00:00:00 2001
From: John <43172431+js-johnpope@users.noreply.github.com>
Date: Mon, 6 Oct 2025 16:02:45 +0100
Subject: [PATCH 16/21] chore: add deletion_protection (#8)

---
 modules/control_plane/README.md    | 5 +++--
 modules/control_plane/cluster.tf   | 1 +
 modules/control_plane/variables.tf | 6 ++++++
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/modules/control_plane/README.md b/modules/control_plane/README.md
index aa4fdbc..3b32de1 100644
--- a/modules/control_plane/README.md
+++ b/modules/control_plane/README.md
@@ -47,10 +47,10 @@ No modules.
 | <a name="input_cluster_delete_timeout"></a> [cluster\_delete\_timeout](#input\_cluster\_delete\_timeout) | Timeout value when deleting the EKS cluster. | `string` | `"15m"` | no |
 | <a name="input_cluster_enabled_log_types"></a> [cluster\_enabled\_log\_types](#input\_cluster\_enabled\_log\_types) | A list of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) | `list(string)` | `[]` | no |
 | <a name="input_cluster_encryption_key_arn"></a> [cluster\_encryption\_key\_arn](#input\_cluster\_encryption\_key\_arn) | KMS Key ARN to encrypt EKS resources with. | `string` | `""` | no |
-| <a name="input_cluster_encryption_resources"></a> [cluster\_encryption\_resources](#input\_cluster\_encryption\_resources) | A list of the EKS resources to encrypt. | `list(string)` | <pre>[<br>  "secrets"<br>]</pre> | no |
+| <a name="input_cluster_encryption_resources"></a> [cluster\_encryption\_resources](#input\_cluster\_encryption\_resources) | A list of the EKS resources to encrypt. | `list(string)` | <pre>[<br/>  "secrets"<br/>]</pre> | no |
 | <a name="input_cluster_endpoint_private_access"></a> [cluster\_endpoint\_private\_access](#input\_cluster\_endpoint\_private\_access) | Indicates whether or not the Amazon EKS private API server endpoint is enabled. | `bool` | `false` | no |
 | <a name="input_cluster_endpoint_public_access"></a> [cluster\_endpoint\_public\_access](#input\_cluster\_endpoint\_public\_access) | Indicates whether or not the Amazon EKS public API server endpoint is enabled. | `bool` | `true` | no |
-| <a name="input_cluster_endpoint_public_access_cidrs"></a> [cluster\_endpoint\_public\_access\_cidrs](#input\_cluster\_endpoint\_public\_access\_cidrs) | List of CIDR blocks which can access the Amazon EKS public API server endpoint. | `list(string)` | <pre>[<br>  "0.0.0.0/0"<br>]</pre> | no |
+| <a name="input_cluster_endpoint_public_access_cidrs"></a> [cluster\_endpoint\_public\_access\_cidrs](#input\_cluster\_endpoint\_public\_access\_cidrs) | List of CIDR blocks which can access the Amazon EKS public API server endpoint. | `list(string)` | <pre>[<br/>  "0.0.0.0/0"<br/>]</pre> | no |
 | <a name="input_cluster_iam_role_name"></a> [cluster\_iam\_role\_name](#input\_cluster\_iam\_role\_name) | IAM role name for the cluster. Only applicable if manage\_cluster\_iam\_resources is set to false. | `string` | `""` | no |
 | <a name="input_cluster_log_group_class"></a> [cluster\_log\_group\_class](#input\_cluster\_log\_group\_class) | Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT\_ACCESS | `string` | `"INFREQUENT_ACCESS"` | no |
 | <a name="input_cluster_log_kms_key_id"></a> [cluster\_log\_kms\_key\_id](#input\_cluster\_log\_kms\_key\_id) | If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html) | `string` | `""` | no |
@@ -60,6 +60,7 @@ No modules.
 | <a name="input_cluster_version"></a> [cluster\_version](#input\_cluster\_version) | Kubernetes version to use for the EKS cluster. | `string` | `"1.15"` | no |
 | <a name="input_config_output_path"></a> [config\_output\_path](#input\_config\_output\_path) | Where to save the Kubectl config file (if `write_kubeconfig = true`). Assumed to be a directory if the value ends with a forward slash `/`. | `string` | `"./"` | no |
 | <a name="input_create_eks"></a> [create\_eks](#input\_create\_eks) | Controls if EKS resources should be created (it affects almost all resources) | `bool` | `true` | no |
+| <a name="input_deletion_protection"></a> [deletion\_protection](#input\_deletion\_protection) | Whether to enable deletion protection for the EKS cluster. | `bool` | `false` | no |
 | <a name="input_eks_oidc_root_ca_thumbprint"></a> [eks\_oidc\_root\_ca\_thumbprint](#input\_eks\_oidc\_root\_ca\_thumbprint) | Thumbprint of Root CA for EKS OIDC, Valid until 2037 | `string` | `"9e99a48a9960b14926bb7f3b02e22da2b0ab7280"` | no |
 | <a name="input_enable_irsa"></a> [enable\_irsa](#input\_enable\_irsa) | Whether to create OpenID Connect Provider for EKS to enable IRSA | `bool` | `false` | no |
 | <a name="input_iam_path"></a> [iam\_path](#input\_iam\_path) | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no |
diff --git a/modules/control_plane/cluster.tf b/modules/control_plane/cluster.tf
index 3aa33d7..14e0db4 100644
--- a/modules/control_plane/cluster.tf
+++ b/modules/control_plane/cluster.tf
@@ -14,6 +14,7 @@ resource "aws_eks_cluster" "this" {
   role_arn                  = local.cluster_iam_role_arn
   version                   = var.cluster_version
   tags                      = var.tags
+  deletion_protection       = var.deletion_protection
 
   vpc_config {
     security_group_ids      = [local.cluster_security_group_id]
diff --git a/modules/control_plane/variables.tf b/modules/control_plane/variables.tf
index 6bbf60d..ba7280b 100644
--- a/modules/control_plane/variables.tf
+++ b/modules/control_plane/variables.tf
@@ -165,3 +165,9 @@ variable "region" {
   type        = string
   description = "AWS region"
 }
+
+variable "deletion_protection" {
+  description = "Whether to enable deletion protection for the EKS cluster."
+  type        = bool
+  default     = false
+}

From cc763f2f72701b69aabcfd88a897d02ce4c97097 Mon Sep 17 00:00:00 2001
From: John <43172431+js-johnpope@users.noreply.github.com>
Date: Mon, 6 Oct 2025 16:36:41 +0100
Subject: [PATCH 17/21] chore: default true for deletion protection (#9)

---
 modules/control_plane/README.md    | 2 +-
 modules/control_plane/variables.tf | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/control_plane/README.md b/modules/control_plane/README.md
index 3b32de1..90afece 100644
--- a/modules/control_plane/README.md
+++ b/modules/control_plane/README.md
@@ -60,7 +60,7 @@ No modules.
 | <a name="input_cluster_version"></a> [cluster\_version](#input\_cluster\_version) | Kubernetes version to use for the EKS cluster. | `string` | `"1.15"` | no |
 | <a name="input_config_output_path"></a> [config\_output\_path](#input\_config\_output\_path) | Where to save the Kubectl config file (if `write_kubeconfig = true`). Assumed to be a directory if the value ends with a forward slash `/`. | `string` | `"./"` | no |
 | <a name="input_create_eks"></a> [create\_eks](#input\_create\_eks) | Controls if EKS resources should be created (it affects almost all resources) | `bool` | `true` | no |
-| <a name="input_deletion_protection"></a> [deletion\_protection](#input\_deletion\_protection) | Whether to enable deletion protection for the EKS cluster. | `bool` | `false` | no |
+| <a name="input_deletion_protection"></a> [deletion\_protection](#input\_deletion\_protection) | Whether to enable deletion protection for the EKS cluster. | `bool` | `true` | no |
 | <a name="input_eks_oidc_root_ca_thumbprint"></a> [eks\_oidc\_root\_ca\_thumbprint](#input\_eks\_oidc\_root\_ca\_thumbprint) | Thumbprint of Root CA for EKS OIDC, Valid until 2037 | `string` | `"9e99a48a9960b14926bb7f3b02e22da2b0ab7280"` | no |
 | <a name="input_enable_irsa"></a> [enable\_irsa](#input\_enable\_irsa) | Whether to create OpenID Connect Provider for EKS to enable IRSA | `bool` | `false` | no |
 | <a name="input_iam_path"></a> [iam\_path](#input\_iam\_path) | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no |
diff --git a/modules/control_plane/variables.tf b/modules/control_plane/variables.tf
index ba7280b..5f8c735 100644
--- a/modules/control_plane/variables.tf
+++ b/modules/control_plane/variables.tf
@@ -169,5 +169,5 @@ variable "region" {
 variable "deletion_protection" {
   description = "Whether to enable deletion protection for the EKS cluster."
   type        = bool
-  default     = false
+  default     = true
 }

From 53b807c409b1454fb0455828949a9e88d2c68718 Mon Sep 17 00:00:00 2001
From: John Pope <john.pope@sainsburys.co.uk>
Date: Mon, 6 Oct 2025 16:50:44 +0100
Subject: [PATCH 18/21] chore(release): Update changelog for v11.3.0

---
 CHANGELOG.md | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4d522c2..e71214a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,10 +2,18 @@
 <a name="unreleased"></a>
 ## [Unreleased]
 
+<a name="v11.3.0"></a>
+## [v11.3.0] - 2025-10-06
+### 🔧 Maintenance
+- [cc763f2](https://github.com/devopsmakers/terraform-aws-eks/commit/cc763f2) default true for deletion protection ([#9](https://github.com/devopsmakers/terraform-aws-eks/issues/9))
+- [4449c6a](https://github.com/devopsmakers/terraform-aws-eks/commit/4449c6a) add deletion_protection ([#8](https://github.com/devopsmakers/terraform-aws-eks/issues/8))
+
+
 <a name="v11.2.3"></a>
 ## [v11.2.3] - 2025-03-27
 ### 🔧 Maintenance
 - [e87a9e7](https://github.com/devopsmakers/terraform-aws-eks/commit/e87a9e7) change log_group name back to cluster ([#7](https://github.com/devopsmakers/terraform-aws-eks/issues/7))
+- **release:** [7c944c2](https://github.com/devopsmakers/terraform-aws-eks/commit/7c944c2) Update changelog for v11.2.3
 
 
 <a name="v11.2.2"></a>
@@ -166,7 +174,8 @@
 - [6338f6d](https://github.com/devopsmakers/terraform-aws-eks/commit/6338f6d) Initial commit
 
 
-[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.3...HEAD
+[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.3.0...HEAD
+[v11.3.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.3...v11.3.0
 [v11.2.3]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.2...v11.2.3
 [v11.2.2]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.1...v11.2.2
 [v11.2.1]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.0...v11.2.1

From 7f8fa14c95e7af44bc4eea0ee2720a0e1c95df3c Mon Sep 17 00:00:00 2001
From: Aman Chadha <aman.chadha1@sainsburys.co.uk>
Date: Mon, 9 Mar 2026 12:48:33 +0000
Subject: [PATCH 19/21] chore: add eks cluster authentication mode (#10)

* chore: add eks cluster authentication mode

* chore: adding vars and updating Readme

* chore: adding the default variable

* chore: adding the default variable

* chore: adding default bootstrap variable
---
 README.md                          | 10 +++--
 main.tf                            | 62 +++++++++++++++---------------
 modules/aws_auth/README.md         |  6 +--
 modules/control_plane/README.md    |  2 +
 modules/control_plane/cluster.tf   |  4 ++
 modules/control_plane/variables.tf | 12 ++++++
 variables.tf                       | 12 ++++++
 7 files changed, 71 insertions(+), 37 deletions(-)

diff --git a/README.md b/README.md
index 2831a85..fb9d349 100644
--- a/README.md
+++ b/README.md
@@ -99,15 +99,17 @@ No resources.
 |------|-------------|------|---------|:--------:|
 | <a name="input_attach_node_cni_policy"></a> [attach\_node\_cni\_policy](#input\_attach\_node\_cni\_policy) | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default worker IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster. | `bool` | `true` | no |
 | <a name="input_attach_worker_cni_policy"></a> [attach\_worker\_cni\_policy](#input\_attach\_worker\_cni\_policy) | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default worker IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster. | `bool` | `true` | no |
+| <a name="input_bootstrap_cluster_creator_admin_permissions"></a> [bootstrap\_cluster\_creator\_admin\_permissions](#input\_bootstrap\_cluster\_creator\_admin\_permissions) | Whether to give cluster creator admin permissions when using API authentication mode. Only applicable if cluster\_authentication\_mode is set to API or API\_AND\_CONFIG\_MAP. | `bool` | `false` | no |
+| <a name="input_cluster_authentication_mode"></a> [cluster\_authentication\_mode](#input\_cluster\_authentication\_mode) | The authentication mode for the cluster that is one of CONFIG\_MAP, API or API\_AND\_CONFIG\_MAP | `string` | `"API_AND_CONFIG_MAP"` | no |
 | <a name="input_cluster_create_security_group"></a> [cluster\_create\_security\_group](#input\_cluster\_create\_security\_group) | Whether to create a security group for the cluster or attach the cluster to `cluster_security_group_id`. | `bool` | `true` | no |
 | <a name="input_cluster_create_timeout"></a> [cluster\_create\_timeout](#input\_cluster\_create\_timeout) | Timeout value when creating the EKS cluster. | `string` | `"30m"` | no |
 | <a name="input_cluster_delete_timeout"></a> [cluster\_delete\_timeout](#input\_cluster\_delete\_timeout) | Timeout value when deleting the EKS cluster. | `string` | `"15m"` | no |
 | <a name="input_cluster_enabled_log_types"></a> [cluster\_enabled\_log\_types](#input\_cluster\_enabled\_log\_types) | A list of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) | `list(string)` | `[]` | no |
 | <a name="input_cluster_encryption_key_arn"></a> [cluster\_encryption\_key\_arn](#input\_cluster\_encryption\_key\_arn) | KMS Key ARN to encrypt EKS secrets with. | `string` | `""` | no |
-| <a name="input_cluster_encryption_resources"></a> [cluster\_encryption\_resources](#input\_cluster\_encryption\_resources) | A list of the EKS resources to encrypt. | `list(string)` | <pre>[<br>  "secrets"<br>]</pre> | no |
+| <a name="input_cluster_encryption_resources"></a> [cluster\_encryption\_resources](#input\_cluster\_encryption\_resources) | A list of the EKS resources to encrypt. | `list(string)` | <pre>[<br/>  "secrets"<br/>]</pre> | no |
 | <a name="input_cluster_endpoint_private_access"></a> [cluster\_endpoint\_private\_access](#input\_cluster\_endpoint\_private\_access) | Indicates whether or not the Amazon EKS private API server endpoint is enabled. | `bool` | `false` | no |
 | <a name="input_cluster_endpoint_public_access"></a> [cluster\_endpoint\_public\_access](#input\_cluster\_endpoint\_public\_access) | Indicates whether or not the Amazon EKS public API server endpoint is enabled. | `bool` | `true` | no |
-| <a name="input_cluster_endpoint_public_access_cidrs"></a> [cluster\_endpoint\_public\_access\_cidrs](#input\_cluster\_endpoint\_public\_access\_cidrs) | List of CIDR blocks which can access the Amazon EKS public API server endpoint. | `list(string)` | <pre>[<br>  "0.0.0.0/0"<br>]</pre> | no |
+| <a name="input_cluster_endpoint_public_access_cidrs"></a> [cluster\_endpoint\_public\_access\_cidrs](#input\_cluster\_endpoint\_public\_access\_cidrs) | List of CIDR blocks which can access the Amazon EKS public API server endpoint. | `list(string)` | <pre>[<br/>  "0.0.0.0/0"<br/>]</pre> | no |
 | <a name="input_cluster_iam_role_name"></a> [cluster\_iam\_role\_name](#input\_cluster\_iam\_role\_name) | IAM role name for the cluster. Only applicable if manage\_cluster\_iam\_resources is set to false. | `string` | `""` | no |
 | <a name="input_cluster_log_group_class"></a> [cluster\_log\_group\_class](#input\_cluster\_log\_group\_class) | Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT\_ACCESS | `string` | `"INFREQUENT_ACCESS"` | no |
 | <a name="input_cluster_log_kms_key_id"></a> [cluster\_log\_kms\_key\_id](#input\_cluster\_log\_kms\_key\_id) | If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html) | `string` | `""` | no |
@@ -126,8 +128,8 @@ No resources.
 | <a name="input_manage_node_iam_resources"></a> [manage\_node\_iam\_resources](#input\_manage\_node\_iam\_resources) | Whether to let the module manage worker IAM resources. If set to false, iam\_instance\_profile\_name must be specified for workers. | `bool` | `true` | no |
 | <a name="input_manage_worker_iam_resources"></a> [manage\_worker\_iam\_resources](#input\_manage\_worker\_iam\_resources) | Whether to let the module manage worker IAM resources. If set to false, iam\_instance\_profile\_name must be specified for workers. | `bool` | `true` | no |
 | <a name="input_map_accounts"></a> [map\_accounts](#input\_map\_accounts) | Additional AWS account numbers to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | `list(string)` | `[]` | no |
-| <a name="input_map_roles"></a> [map\_roles](#input\_map\_roles) | Additional IAM roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br>    rolearn  = string<br>    username = string<br>    groups   = list(string)<br>  }))</pre> | `[]` | no |
-| <a name="input_map_users"></a> [map\_users](#input\_map\_users) | Additional IAM users to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br>    userarn  = string<br>    username = string<br>    groups   = list(string)<br>  }))</pre> | `[]` | no |
+| <a name="input_map_roles"></a> [map\_roles](#input\_map\_roles) | Additional IAM roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br/>    rolearn  = string<br/>    username = string<br/>    groups   = list(string)<br/>  }))</pre> | `[]` | no |
+| <a name="input_map_users"></a> [map\_users](#input\_map\_users) | Additional IAM users to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br/>    userarn  = string<br/>    username = string<br/>    groups   = list(string)<br/>  }))</pre> | `[]` | no |
 | <a name="input_node_groups"></a> [node\_groups](#input\_node\_groups) | Map of map of node groups to create. See `node_groups` module's documentation for more details | `any` | `{}` | no |
 | <a name="input_node_groups_additional_policies"></a> [node\_groups\_additional\_policies](#input\_node\_groups\_additional\_policies) | Additional policies to be added to workers | `list(string)` | `[]` | no |
 | <a name="input_node_groups_defaults"></a> [node\_groups\_defaults](#input\_node\_groups\_defaults) | Map of values to be applied to all node groups. See `node_groups` module's documentaton for more details | `any` | `{}` | no |
diff --git a/main.tf b/main.tf
index 4709fe6..3d5ea1a 100644
--- a/main.tf
+++ b/main.tf
@@ -1,34 +1,36 @@
 module "control_plane" {
-  source                               = "./modules/control_plane"
-  region                               = var.region
-  cluster_create_security_group        = var.cluster_create_security_group
-  cluster_create_timeout               = var.cluster_create_timeout
-  cluster_delete_timeout               = var.cluster_delete_timeout
-  cluster_enabled_log_types            = var.cluster_enabled_log_types
-  cluster_encryption_key_arn           = var.cluster_encryption_key_arn
-  cluster_encryption_resources         = var.cluster_encryption_resources
-  cluster_endpoint_private_access      = var.cluster_endpoint_private_access
-  cluster_endpoint_public_access       = var.cluster_endpoint_public_access
-  cluster_endpoint_public_access_cidrs = var.cluster_endpoint_public_access_cidrs
-  cluster_iam_role_name                = var.cluster_iam_role_name
-  cluster_log_kms_key_id               = var.cluster_log_kms_key_id
-  cluster_log_retention_in_days        = var.cluster_log_retention_in_days
-  cluster_log_group_class              = var.cluster_log_group_class
-  cluster_name                         = var.cluster_name
-  cluster_security_group_id            = var.cluster_security_group_id
-  cluster_version                      = var.cluster_version
-  config_output_path                   = var.config_output_path
-  create_eks                           = var.create_eks
-  eks_oidc_root_ca_thumbprint          = var.eks_oidc_root_ca_thumbprint
-  enable_irsa                          = var.enable_irsa
-  iam_path                             = var.iam_path
-  kubeconfig_name                      = var.kubeconfig_name
-  manage_cluster_iam_resources         = var.manage_cluster_iam_resources
-  permissions_boundary                 = var.permissions_boundary
-  subnets                              = var.subnets
-  tags                                 = var.tags
-  vpc_id                               = var.vpc_id
-  write_kubeconfig                     = var.write_kubeconfig
+  source                                      = "./modules/control_plane"
+  region                                      = var.region
+  cluster_create_security_group               = var.cluster_create_security_group
+  cluster_create_timeout                      = var.cluster_create_timeout
+  cluster_delete_timeout                      = var.cluster_delete_timeout
+  cluster_enabled_log_types                   = var.cluster_enabled_log_types
+  cluster_encryption_key_arn                  = var.cluster_encryption_key_arn
+  cluster_encryption_resources                = var.cluster_encryption_resources
+  cluster_endpoint_private_access             = var.cluster_endpoint_private_access
+  cluster_endpoint_public_access              = var.cluster_endpoint_public_access
+  cluster_endpoint_public_access_cidrs        = var.cluster_endpoint_public_access_cidrs
+  cluster_iam_role_name                       = var.cluster_iam_role_name
+  cluster_log_kms_key_id                      = var.cluster_log_kms_key_id
+  cluster_log_retention_in_days               = var.cluster_log_retention_in_days
+  cluster_log_group_class                     = var.cluster_log_group_class
+  cluster_name                                = var.cluster_name
+  cluster_security_group_id                   = var.cluster_security_group_id
+  cluster_version                             = var.cluster_version
+  cluster_authentication_mode                 = var.cluster_authentication_mode
+  bootstrap_cluster_creator_admin_permissions = var.bootstrap_cluster_creator_admin_permissions
+  config_output_path                          = var.config_output_path
+  create_eks                                  = var.create_eks
+  eks_oidc_root_ca_thumbprint                 = var.eks_oidc_root_ca_thumbprint
+  enable_irsa                                 = var.enable_irsa
+  iam_path                                    = var.iam_path
+  kubeconfig_name                             = var.kubeconfig_name
+  manage_cluster_iam_resources                = var.manage_cluster_iam_resources
+  permissions_boundary                        = var.permissions_boundary
+  subnets                                     = var.subnets
+  tags                                        = var.tags
+  vpc_id                                      = var.vpc_id
+  write_kubeconfig                            = var.write_kubeconfig
 }
 
 module "worker_groups" {
diff --git a/modules/aws_auth/README.md b/modules/aws_auth/README.md
index 9ec76f7..b82d0d6 100644
--- a/modules/aws_auth/README.md
+++ b/modules/aws_auth/README.md
@@ -41,9 +41,9 @@ No modules.
 | <a name="input_create_eks"></a> [create\_eks](#input\_create\_eks) | Controls if EKS resources should be created (it affects almost all resources). | `bool` | `true` | no |
 | <a name="input_manage_aws_auth"></a> [manage\_aws\_auth](#input\_manage\_aws\_auth) | Whether to apply the aws-auth configmap file. | `bool` | `true` | no |
 | <a name="input_map_accounts"></a> [map\_accounts](#input\_map\_accounts) | Additional AWS account numbers to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | `list(string)` | `[]` | no |
-| <a name="input_map_instances"></a> [map\_instances](#input\_map\_instances) | IAM instance roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br>    instance_role_arn = string<br>    platform          = string<br>  }))</pre> | `[]` | no |
-| <a name="input_map_roles"></a> [map\_roles](#input\_map\_roles) | Additional IAM roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br>    rolearn  = string<br>    username = string<br>    groups   = list(string)<br>  }))</pre> | `[]` | no |
-| <a name="input_map_users"></a> [map\_users](#input\_map\_users) | Additional IAM users to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br>    userarn  = string<br>    username = string<br>    groups   = list(string)<br>  }))</pre> | `[]` | no |
+| <a name="input_map_instances"></a> [map\_instances](#input\_map\_instances) | IAM instance roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br/>    instance_role_arn = string<br/>    platform          = string<br/>  }))</pre> | `[]` | no |
+| <a name="input_map_roles"></a> [map\_roles](#input\_map\_roles) | Additional IAM roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br/>    rolearn  = string<br/>    username = string<br/>    groups   = list(string)<br/>  }))</pre> | `[]` | no |
+| <a name="input_map_users"></a> [map\_users](#input\_map\_users) | Additional IAM users to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | <pre>list(object({<br/>    userarn  = string<br/>    username = string<br/>    groups   = list(string)<br/>  }))</pre> | `[]` | no |
 | <a name="input_wait_for_cluster_cmd"></a> [wait\_for\_cluster\_cmd](#input\_wait\_for\_cluster\_cmd) | Custom local-exec command to execute for determining if the eks cluster is healthy. Cluster endpoint will be available as an environment variable called ENDPOINT | `string` | `"until wget --no-check-certificate -O - -q $ENDPOINT/healthz >/dev/null; do sleep 4; done"` | no |
 
 ## Outputs
diff --git a/modules/control_plane/README.md b/modules/control_plane/README.md
index 90afece..fa398e5 100644
--- a/modules/control_plane/README.md
+++ b/modules/control_plane/README.md
@@ -42,6 +42,8 @@ No modules.
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_bootstrap_cluster_creator_admin_permissions"></a> [bootstrap\_cluster\_creator\_admin\_permissions](#input\_bootstrap\_cluster\_creator\_admin\_permissions) | Whether to give cluster creator admin permissions when using API authentication mode. Only applicable if cluster\_authentication\_mode is set to API or API\_AND\_CONFIG\_MAP. | `bool` | `false` | no |
+| <a name="input_cluster_authentication_mode"></a> [cluster\_authentication\_mode](#input\_cluster\_authentication\_mode) | The authentication mode for the cluster that is one of CONFIG\_MAP, API or API\_AND\_CONFIG\_MAP | `string` | `"API_AND_CONFIG_MAP"` | no |
 | <a name="input_cluster_create_security_group"></a> [cluster\_create\_security\_group](#input\_cluster\_create\_security\_group) | Whether to create a security group for the cluster or attach the cluster to `cluster_security_group_id`. | `bool` | `true` | no |
 | <a name="input_cluster_create_timeout"></a> [cluster\_create\_timeout](#input\_cluster\_create\_timeout) | Timeout value when creating the EKS cluster. | `string` | `"30m"` | no |
 | <a name="input_cluster_delete_timeout"></a> [cluster\_delete\_timeout](#input\_cluster\_delete\_timeout) | Timeout value when deleting the EKS cluster. | `string` | `"15m"` | no |
diff --git a/modules/control_plane/cluster.tf b/modules/control_plane/cluster.tf
index 14e0db4..1585a12 100644
--- a/modules/control_plane/cluster.tf
+++ b/modules/control_plane/cluster.tf
@@ -15,6 +15,10 @@ resource "aws_eks_cluster" "this" {
   version                   = var.cluster_version
   tags                      = var.tags
   deletion_protection       = var.deletion_protection
+  access_config {
+    authentication_mode                         = var.cluster_authentication_mode
+    bootstrap_cluster_creator_admin_permissions = var.bootstrap_cluster_creator_admin_permissions
+  }
 
   vpc_config {
     security_group_ids      = [local.cluster_security_group_id]
diff --git a/modules/control_plane/variables.tf b/modules/control_plane/variables.tf
index 5f8c735..b3a9754 100644
--- a/modules/control_plane/variables.tf
+++ b/modules/control_plane/variables.tf
@@ -61,6 +61,18 @@ variable "cluster_create_security_group" {
   default     = true
 }
 
+variable "cluster_authentication_mode" {
+  description = "The authentication mode for the cluster that is one of CONFIG_MAP, API or API_AND_CONFIG_MAP"
+  type        = string
+  default     = "API_AND_CONFIG_MAP"
+}
+
+variable "bootstrap_cluster_creator_admin_permissions" {
+  description = "Whether to give cluster creator admin permissions when using API authentication mode. Only applicable if cluster_authentication_mode is set to API or API_AND_CONFIG_MAP."
+  type        = bool
+  default     = false
+}
+
 variable "iam_path" {
   description = "If provided, all IAM roles will be created on this path."
   type        = string
diff --git a/variables.tf b/variables.tf
index 51a9f17..d60011f 100644
--- a/variables.tf
+++ b/variables.tf
@@ -37,6 +37,18 @@ variable "cluster_version" {
   default     = "1.15"
 }
 
+variable "cluster_authentication_mode" {
+  description = "The authentication mode for the cluster that is one of CONFIG_MAP, API or API_AND_CONFIG_MAP"
+  type        = string
+  default     = "API_AND_CONFIG_MAP"
+}
+
+variable "bootstrap_cluster_creator_admin_permissions" {
+  description = "Whether to give cluster creator admin permissions when using API authentication mode. Only applicable if cluster_authentication_mode is set to API or API_AND_CONFIG_MAP."
+  type        = bool
+  default     = false
+}
+
 variable "config_output_path" {
   description = "Where to save the Kubectl config file (if `write_kubeconfig = true`). Assumed to be a directory if the value ends with a forward slash `/`."
   type        = string

From 7f1c7b163afc9d0705948ae4c1d1fcfa31106f0b Mon Sep 17 00:00:00 2001
From: Aman Chadha <aman.chadha1@sainsburys.co.uk>
Date: Mon, 9 Mar 2026 12:51:02 +0000
Subject: [PATCH 20/21] chore(release): Update changelog for v11.3.1

---
 CHANGELOG.md | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e71214a..52575b7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,11 +2,18 @@
 <a name="unreleased"></a>
 ## [Unreleased]
 
+<a name="v11.3.1"></a>
+## [v11.3.1] - 2026-03-09
+### 🔧 Maintenance
+- [7f8fa14](https://github.com/devopsmakers/terraform-aws-eks/commit/7f8fa14) add eks cluster authentication mode ([#10](https://github.com/devopsmakers/terraform-aws-eks/issues/10))
+
+
 <a name="v11.3.0"></a>
 ## [v11.3.0] - 2025-10-06
 ### 🔧 Maintenance
 - [cc763f2](https://github.com/devopsmakers/terraform-aws-eks/commit/cc763f2) default true for deletion protection ([#9](https://github.com/devopsmakers/terraform-aws-eks/issues/9))
 - [4449c6a](https://github.com/devopsmakers/terraform-aws-eks/commit/4449c6a) add deletion_protection ([#8](https://github.com/devopsmakers/terraform-aws-eks/issues/8))
+- **release:** [53b807c](https://github.com/devopsmakers/terraform-aws-eks/commit/53b807c) Update changelog for v11.3.0
 
 
 <a name="v11.2.3"></a>
@@ -174,7 +181,8 @@
 - [6338f6d](https://github.com/devopsmakers/terraform-aws-eks/commit/6338f6d) Initial commit
 
 
-[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.3.0...HEAD
+[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.3.1...HEAD
+[v11.3.1]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.3.0...v11.3.1
 [v11.3.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.3...v11.3.0
 [v11.2.3]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.2...v11.2.3
 [v11.2.2]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.1...v11.2.2

From 281d919cca81b40cd84822bf0ccb108a027371e7 Mon Sep 17 00:00:00 2001
From: "daniel.humphries" <daniel.humphries@sainsburys.co.uk>
Date: Fri, 8 May 2026 14:16:24 +0100
Subject: [PATCH 21/21] chore: update makefile to require passing argument -
 BOS-3863

Signed-off-by: daniel.humphries <daniel.humphries@sainsburys.co.uk>
---
 Makefile | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/Makefile b/Makefile
index 44b7972..3fbcdc9 100644
--- a/Makefile
+++ b/Makefile
@@ -1,9 +1,8 @@
-.PHONY: release
+.PHONY: release guard
 
-TYPE := patch
-VERSION := $(shell semtag final -s $(TYPE) -o)
+VERSION = $(shell semtag final -s $(TYPE) -o)
 
-release:
+release: guard
 	git checkout master
 	git pull origin master
 	@echo $(VERSION) | grep "ERROR" && exit 1 || true
@@ -11,4 +10,10 @@ release:
 	git add CHANGELOG.md
 	git commit -m "chore(release): Update changelog for $(VERSION)"
 	git tag $(VERSION)
-	git push origin master --tags
\ No newline at end of file
+	git push origin master --tags
+
+guard:
+	@if [ -z "$(TYPE)" ]; then \
+			echo "ERROR: TYPE is required. Usage: make release TYPE=patch|minor|major"; \
+			exit 1; \
+	fi