title: Terraform:EKS -Cluster creation with ONLY Private Subnets
body: <p>Requirement: Is to create EKS Cluster via Terraform with only Private subnets</p>
  <pre><code>     Error: error waiting for EKS Node Group (eks-dev-cluster:ng_2) to create: unexpected state 'CREATE_FAILED',
       wanted target 'ACTIVE'. last error: 1 error occurred:
          │   * subnet-******, subnet-******e5, subnet-******4: Ec2SubnetInvalidConfiguration: One or more Amazon EC2 Subnets of [subnet-*****, subnet-*****, subnet-*****] for node group ng_2 does not automatically assign public IP addresses to instances launched into it. 
  If you want your instances to be assigned a public IP address, then you need to enable auto-assign public IP address for the subnet.
  See IP addressing in VPC guide: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-ip-addressing.html#subnet-public-ip
          │
          │   with aws_eks_node_group.eks_nodegroup[&quot;ng_2&quot;],
          │   on eks-workers.tf line 9, in resource &quot;aws_eks_node_group&quot; &quot;EKS_NG&quot;:
          │    9: resource &quot;aws_eks_node_group&quot; &quot;eks_nodegroup&quot; {
  </code></pre>
  <p>I gave the <code>map_public_ip_on_launch = false</code>  as below</p>
  <pre><code>module &quot;vpc&quot; {
    source  = &quot;terraform-aws-modules/vpc/aws&quot;
    version = &quot;3.11.0&quot;
    create_vpc = var.create_vpc
    name = var.vpc_name
    cidr = var.vpc_cidr
  
    azs             = slice(data.aws_availability_zones.available.names, 0, 3)
    private_subnets = var.private_subnets
    public_subnets  = var.public_subnets
    map_public_ip_on_launch = false
    enable_nat_gateway = var.enable_nat_gateway
    single_nat_gateway = var.single_nat_gateway
    enable_vpn_gateway = var.enable_vpn_gateway
  
    tags = {
      Name                                      = var.vpc_name
      Environment                               = terraform.workspace
      &quot;kubernetes.io/cluster/${var.cluster-name}&quot; = &quot;shared&quot;
    }
  }
  </code></pre>
  <p>Also the error came out when running below file</p>
  <h5>eks-workers.tf</h5>
  <pre><code>locals{
  private_subnet_ids = var.create_vpc? module.vpc.private_subnets : tolist(data.aws_subnet_ids.private[0].ids)
  }
  
  # creating node groups
  
  resource &quot;aws_eks_node_group&quot; &quot;EKS_NG&quot; {
    for_each = var.eks_node_groups
    cluster_name = aws_eks_cluster.ds-eks-airflow.name
    node_group_name =  each.key
    node_role_arn = var.create_role? aws_iam_role.ds-eks-airflow-node[0].arn : var.node_rolearn
    subnet_ids = local.private_subnet_ids
    instance_types = [each.value.instance_type]
    capacity_type =  each.value.capacity_type
    scaling_config {
      desired_size = each.value.desired_size
      max_size     = each.value.max_size
      min_size     = each.value.min_size
    }
    
    remote_access {
       ec2_ssh_key = each.value.ec2_ssh_key
       source_security_group_ids = [ aws_security_group.ds-eks-airflow-node.id ]
    }
   
    tags = each.value.tags
    labels = each.value.labels
    # Ensure that IAM Role permissions are created before EKS Node Group handling.
  
    depends_on = [
      aws_iam_role_policy_attachment.AmazonEKSWorkerNodePolicy,
      aws_iam_role_policy_attachment.AmazonEKS_CNI_Policy,
      aws_iam_role_policy_attachment.AmazonEC2ContainerRegistryReadOnly,
      aws_eks_cluster.ds-eks-airflow,
      aws_security_group.ds-eks-airflow-node
    ]
  }
  </code></pre>