Same terraform apply in environments/dev (all modules are wired into one root config; re-running apply picks up whatever's new in the plan).

Expect: cluster + node-group IAM roles, OIDC provider, EKS cluster, managed node group, deployer access entry.

IAM checkpoint: add IAM role management actions (CreateRole, AttachRolePolicy, scoped PassRole for the two specific roles, iam:CreateServiceLinkedRole on a fresh account) and EKS cluster/nodegroup actions as errors name them.

Common snag: if this is a genuinely fresh AWS account, expect one AccessDenied on iam:CreateServiceLinkedRole - first-ever EKS use in an account needs to bootstrap a service-linked role.

aws eks update-kubeconfig --name <cluster-name> --region <region>
kubectl get nodes

nodes-running.png

all nodes Ready

node-group.png

cluster Compute tab