[Bug]: EKS cluster ID is not always cluster name

[bryantbiggs]

Terraform Core Version

1.3.3

AWS Provider Version

4.37.0

Affected Resource(s)

• aws_eks_cluster

Expected Behavior

The computed output for id should be pulled from the describe-cluster API when present, otherwise fallback to current behavior of using the cluster name

Specifically, if you provision a local cluster on AWS Outposts, the cluster ID will NOT match the cluster name and instead look like a UUID/GUID

Actual Behavior

All clusters created, the computed ID is set to the cluster name per

terraform-provider-aws/internal/service/eks/cluster.go

Line 345 in 990f9ae

d.SetId(aws.StringValue(output.Cluster.Name))

Relevant Error/Panic Output Snippet

No response

Terraform Configuration Files

An example can be found here https://github.com/bryantbiggs/terraform-aws-eks/tree/refactor/v19/examples/outposts

Steps to Reproduce

AWS CLI

Commercial regions with EKS cluster provisioned on AWS:

aws eks describe-cluster --name <NAME> --region <REGION> --query 'cluster.id'

Will return null

Local cluster provisioned on AWS Outposts (both control plane and data plane):

aws eks describe-cluster --name <NAME> --region <REGION> --query 'cluster.id'

Should return a value that looks like a UUID/GUID value

Terraform

Minimal reproduction using and updated version of this test case. Note, this will result in an Unauthorized error since the --cluster-id passed is the cluster name. Once corrected in the provider, this should apply successfully without modification

data "aws_iam_role" "test" {
  name = "AmazonEKSLocalOutpostClusterRole"
}
data "aws_outposts_outposts" "test" {}
data "aws_subnets" test {
  filter {
    name   = "outpost-arn"
    values = [tolist(data.aws_outposts_outposts.test.arns)[0]]
  }
}
resource "aws_eks_cluster" "test" {
  name     = %[1]q
  role_arn = data.aws_iam_role.test.arn
  outpost_config {
    control_plane_instance_type = "m5d.large"
    outpost_arns                = [tolist(data.aws_outposts_outposts.test.arns)[0]]
  }
  vpc_config {
    endpoint_private_access = true
    endpoint_public_access  = false
    subnet_ids              = [tolist(data.aws_subnets.test.ids)[0]]
  }
}

data "aws_region" "current" {}

provider "kubernetes" {
  host                   = aws_eks_cluster.test.endpoint
  cluster_ca_certificate = base64decode(aws_eks_cluster.this[0].certificate_authority[0].data)

  exec {
    api_version = "client.authentication.k8s.io/v1beta1"
    command     = "aws"
    args        = ["eks", "get-token", "--cluster-id", aws_eks_cluster.this.id, "--region", data.aws_region.current.name]
  }
}

resource "kubernetes_storage_class_v1" "this" {
  metadata {
    name = "ebs-sc"
    annotations = {
      "storageclass.kubernetes.io/is-default-class" = "true"
    }
  }

  storage_provisioner    = "ebs.csi.aws.com"
  volume_binding_mode    = "WaitForFirstConsumer"
  allow_volume_expansion = true

  parameters = {
    type      = "gp2"
    encrypted = "true"
  }
}

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

Yes

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[github-actions]

This functionality has been released in v4.45.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.