<p>I'm trying to create a EKS cluster in a private subnet. I'm having issues getting it working. I get the error <code>unhealthy nodes in the kubernetes cluster</code>. Wonder if its due to security group or some other issues like VPC endpoints?</p>
<p>When I use NAT gateway setup then it works fine. But I don't want to use nat gateway anymore.</p>
<p>One think I'm not sure is should the EKS cluster subnet_ids be only private subnets?</p>
<p>In the below config I'm using both public and private subnets.</p>
<pre><code>resource &quot;aws_eks_cluster&quot; &quot;main&quot; {
  name      = var.eks_cluster_name
  role_arn  = aws_iam_role.eks_cluster.arn

  vpc_config {
    subnet_ids              = concat(var.public_subnet_ids, var.private_subnet_ids)
    security_group_ids      = [aws_security_group.eks_cluster.id, aws_security_group.eks_nodes.id, aws_security_group.external_access.id]
    endpoint_private_access = true
    endpoint_public_access  = false
  }

  # Ensure that IAM Role permissions are created before and deleted after EKS Cluster handling.
  # Otherwise, EKS will not be able to properly delete EKS managed EC2 infrastructure such as Security Groups.

  depends_on = [
    &quot;aws_iam_role_policy_attachment.aws_eks_cluster_policy&quot;,
    &quot;aws_iam_role_policy_attachment.aws_eks_service_policy&quot;
  ]
}
</code></pre>

user630702
<p>Since you don't have NAT gateway/instance, your nodes <strong>can't connect to the internet</strong> and fail as they can't &quot;communicate with the control plane and other AWS services&quot;  (from <a href="https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html#vpc-cidr" rel="nofollow noreferrer">here</a>).</p>
<p>Thus, you can use <strong>VPC endpoints</strong> to enable communication with the plain and the services. To view the properly setup VPC with <strong>private subnets</strong> for EKS, you can check <a href="https://s3.us-west-2.amazonaws.com/amazon-eks/cloudformation/2020-10-29/amazon-eks-fully-private-vpc.yaml" rel="nofollow noreferrer">AWS provided VPC template for EKS</a> (from <a href="https://docs.aws.amazon.com/eks/latest/userguide/create-public-private-vpc.html" rel="nofollow noreferrer">here</a>).</p>
<p>From the template, the <strong>VPC endpoints</strong> in <code>us-east-1</code>:</p>
<ul>
<li>com.amazonaws.us-east-1.ec2</li>
<li>com.amazonaws.us-east-1.ecr.api</li>
<li>com.amazonaws.us-east-1.s3</li>
<li>com.amazonaws.us-east-1.logs</li>
<li>com.amazonaws.us-east-1.ecr.dkr</li>
<li>com.amazonaws.us-east-1.sts</li>
</ul>
<p>Please note that all these endpoints, escept S3, are <strong>not free</strong>. So you have to consider if running cheap NAT instances or gateway would be cheaper or more expensive then maintaining these endpoints.</p>
