Configuration options for the cluster provider.

interface AsgClusterProviderProps {
    allowAllOutbound?: boolean;
    associatePublicIpAddress?: boolean;
    autoScalingGroupName?: string;
    blockDevices?: BlockDevice[];
    bootstrapEnabled?: boolean;
    bootstrapOptions?: BootstrapOptions;
    capacityRebalance?: boolean;
    clusterName?: string;
    cooldown?: Duration;
    defaultInstanceWarmup?: Duration;
    desiredSize?: number;
    groupMetrics?: GroupMetrics[];
    healthCheck?: HealthCheck;
    id: string;
    ignoreUnmodifiedSizeProperties?: boolean;
    instanceMonitoring?: Monitoring;
    instanceType?: InstanceType;
    keyName?: string;
    machineImageType?: MachineImageType;
    mapRole?: boolean;
    maxInstanceLifetime?: Duration;
    maxSize?: number;
    minSize?: number;
    name?: string;
    newInstancesProtectedFromScaleIn?: boolean;
    nodeGroupSubnets?: SubnetSelection;
    notifications?: NotificationConfiguration[];
    outputClusterName?: boolean;
    outputConfigCommand?: boolean;
    privateCluster?: boolean;
    role?: IRole;
    securityGroup?: ISecurityGroup;
    signals?: Signals;
    spotInterruptHandler?: boolean;
    spotPrice?: string;
    ssmSessionPermissions?: boolean;
    tags?: {
        [key: string]: string;
    terminationPolicies?: TerminationPolicy[];
    terminationPolicyCustomLambdaFunctionArn?: string;
    updatePolicy?: UpdatePolicy;
    version?: KubernetesVersion;
    vpc?: IVpc;
    vpcSubnets?: SubnetSelection[];

Hierarchy (view full)


allowAllOutbound?: boolean

Whether the instances can initiate connections to anywhere by default


associatePublicIpAddress?: boolean

Whether instances in the Auto Scaling Group should have public IP addresses associated with them.

launchTemplate and mixedInstancesPolicy must not be specified when this property is specified


- Use subnet setting.
autoScalingGroupName?: string

The name of the Auto Scaling group. This name must be unique per Region per account.


- Auto generated by CloudFormation
blockDevices?: BlockDevice[]

Specifies how block devices are exposed to the instance. You can specify virtual devices and EBS volumes.

Each instance that is launched has an associated root device volume, either an Amazon EBS volume or an instance store volume. You can use block device mappings to specify additional EBS volumes or instance store volumes to attach to an instance when it is launched.

launchTemplate and mixedInstancesPolicy must not be specified when this property is specified



- Uses the block device mapping of the AMI
bootstrapEnabled?: boolean

Configures the EC2 user-data script for instances in this autoscaling group to bootstrap the node (invoke /etc/eks/ and associate it with the EKS cluster.

If you wish to provide a custom user data script, set this to false and manually invoke autoscalingGroup.addUserData().


bootstrapOptions?: BootstrapOptions

EKS node bootstrapping options.


- none
capacityRebalance?: boolean

Indicates whether Capacity Rebalancing is enabled. When you turn on Capacity Rebalancing, Amazon EC2 Auto Scaling attempts to launch a Spot Instance whenever Amazon EC2 notifies that a Spot Instance is at an elevated risk of interruption. After launching a new instance, it then terminates an old instance.

clusterName?: string

Name for the cluster.


- Automatically generated name
cooldown?: Duration

Default scaling cooldown for this AutoScalingGroup


defaultInstanceWarmup?: Duration

The amount of time, in seconds, until a newly launched instance can contribute to the Amazon CloudWatch metrics. This delay lets an instance finish initializing before Amazon EC2 Auto Scaling aggregates instance metrics, resulting in more reliable usage data. Set this value equal to the amount of time that it takes for resource consumption to become stable after an instance reaches the InService state.

To optimize the performance of scaling policies that scale continuously, such as target tracking and step scaling policies, we strongly recommend that you enable the default instance warmup, even if its value is set to 0 seconds

Default instance warmup will not be added if no value is specified

desiredSize?: number

Desired size, defaults to min size.

groupMetrics?: GroupMetrics[]

Enable monitoring for group metrics, these metrics describe the group rather than any of its instances. To report all group metrics use GroupMetrics.all() Group metrics are reported in a granularity of 1 minute at no additional charge.


- no group metrics will be reported
healthCheck?: HealthCheck

Configuration for health checks


- HealthCheck.ec2 with no grace period
id: string

Id of this node group. Expected to be unique in cluster scope.

ignoreUnmodifiedSizeProperties?: boolean

If the ASG has scheduled actions, don't reset unchanged group sizes

Only used if the ASG has scheduled actions (which may scale your ASG up or down regardless of cdk deployments). If true, the size of the group will only be reset if it has been changed in the CDK app. If false, the sizes will always be changed back to what they were in the CDK app on deployment.


instanceMonitoring?: Monitoring

Controls whether instances in this group are launched with detailed or basic monitoring.

When detailed monitoring is enabled, Amazon CloudWatch generates metrics every minute and your account is charged a fee. When you disable detailed monitoring, CloudWatch generates metrics every 5 minutes.

launchTemplate and mixedInstancesPolicy must not be specified when this property is specified

instanceType?: InstanceType

Instance type of the instances to start. If not specified defaults are applied in the following order:

  • 'eks.default.instance-type' in CDK context (e.g. ~/.cdk.json under "context" key))
  • M5.Large
keyName?: string

Name of SSH keypair to grant access to instances

launchTemplate and mixedInstancesPolicy must not be specified when this property is specified


- No SSH access will be possible.
machineImageType?: MachineImageType

Machine image type


mapRole?: boolean

Will automatically update the aws-auth ConfigMap to map the IAM instance role to RBAC.

This cannot be explicitly set to true if the cluster has kubectl disabled.


- true if the cluster has kubectl enabled (which is the default).
maxInstanceLifetime?: Duration

The maximum amount of time that an instance can be in service. The maximum duration applies to all current and future instances in the group. As an instance approaches its maximum duration, it is terminated and replaced, and cannot be used again.

You must specify a value of at least 604,800 seconds (7 days). To clear a previously set value, leave this property undefined.

maxSize?: number

Max size of the node group.


minSize?: number

Min size of the node group


name?: string

The name for the cluster.

newInstancesProtectedFromScaleIn?: boolean

Whether newly-launched instances are protected from termination by Amazon EC2 Auto Scaling when scaling in.

By default, Auto Scaling can terminate an instance at any time after launch when scaling in an Auto Scaling Group, subject to the group's termination policy. However, you may wish to protect newly-launched instances from being scaled in if they are going to run critical applications that should not be prematurely terminated.

This flag must be enabled if the Auto Scaling Group will be associated with an ECS Capacity Provider with managed termination protection.


nodeGroupSubnets?: SubnetSelection

Subnets for the autoscaling group where nodes (instances) will be placed.


all private subnets
notifications?: NotificationConfiguration[]

Configure autoscaling group to send notifications about fleet changes to an SNS topic(s)

outputClusterName?: boolean

Determines whether a CloudFormation output with the name of the cluster will be synthesized.


outputConfigCommand?: boolean

Determines whether a CloudFormation output with the aws eks update-kubeconfig command will be synthesized. This command will include the cluster name and, if applicable, the ARN of the masters IAM role.


privateCluster?: boolean

Is it a private only EKS Cluster? Defaults to private_and_public cluster, set to true for private cluster


role?: IRole

Role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf.


- A role is automatically created for you
securityGroup?: ISecurityGroup

Security Group to use for Control Plane ENIs


- A security group is automatically created
signals?: Signals

Configure waiting for signals during deployment

Use this to pause the CloudFormation deployment to wait for the instances in the AutoScalingGroup to report successful startup during creation and updates. The UserData script needs to invoke cfn-signal with a success or failure code after it is done setting up the instance.

Without waiting for signals, the CloudFormation deployment will proceed as soon as the AutoScalingGroup has been created or updated but before the instances in the group have been started.

For example, to have instances wait for an Elastic Load Balancing health check before they signal success, add a health-check verification by using the cfn-init helper script. For an example, see the verify_instance_health command in the Auto Scaling rolling updates sample template:


- Do not wait for signals
spotInterruptHandler?: boolean

Installs the AWS spot instance interrupt handler on the cluster if it's not already added. Only relevant if spotPrice is used.


spotPrice?: string

The maximum hourly price (in USD) to be paid for any Spot Instance launched to fulfill the request. Spot Instances are launched when the price you specify exceeds the current Spot market price.

launchTemplate and mixedInstancesPolicy must not be specified when this property is specified


ssmSessionPermissions?: boolean

Add SSM session permissions to the instance role

Setting this to true adds the necessary permissions to connect to the instance using SSM Session Manager. You can do this from the AWS Console.

NOTE: Setting this flag to true may not be enough by itself. You must also use an AMI that comes with the SSM Agent, or install the SSM Agent yourself. See Working with SSM Agent in the SSM Developer Guide.


tags?: {
    [key: string]: string;

Tags for the cluster

Type declaration

  • [key: string]: string
terminationPolicies?: TerminationPolicy[]

A policy or a list of policies that are used to select the instances to terminate. The policies are executed in the order that you list them.

terminationPolicyCustomLambdaFunctionArn?: string

A lambda function Arn that can be used as a custom termination policy to select the instances to terminate. This property must be specified if the TerminationPolicy.CUSTOM_LAMBDA_FUNCTION is used.

updatePolicy?: UpdatePolicy

What to do when an AutoScalingGroup's instance configuration is changed

This is applied when any of the settings on the ASG are changed that affect how the instances should be created (VPC, instance type, startup scripts, etc.). It indicates how the existing instances should be replaced with new instances matching the new config. By default, nothing is done and only new instances are launched with the new config.


  • UpdatePolicy.rollingUpdate() if using init, UpdatePolicy.none() otherwise
version?: KubernetesVersion

The Kubernetes version to run in the cluster

vpc?: IVpc

The VPC in which to create the Cluster.


  • a VPC with default configuration will be created and can be accessed through cluster.vpc.
vpcSubnets?: SubnetSelection[]

Where to place EKS Control Plane ENIs

For example, to only select private subnets, supply the following:

vpcSubnets: [{ subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }]


- All public and private subnets

Generated using TypeDoc