title: Error creating EKS node-group with terraform
body: <p>While I am trying to deploy EKS via Terraform, I am facing an error with node-group creation.
  I am getting the following error:</p>
  <pre><code>Error: error waiting for EKS Node Group (Self-Hosted-Runner:Self-Hosted-Runner-default-node-group) to create:
  unexpected state 'CREATE_FAILED', wanted target 'ACTIVE'.
  last error: 1 error occurred:i-04db15f25be4212fb, i-07bd88adabaa103c0, i-0915982ac0f217fe4:
  NodeCreationFailure: Instances failed to join the kubernetes cluster. 
  with module.eks.aws_eks_node_group.eks-node-group,
  │   on ../../modules/aws/eks/eks-node-group.tf line 1, in resource &quot;aws_eks_node_group&quot; &quot;eks-node-group&quot;:
  │    1: resource &quot;aws_eks_node_group&quot; &quot;eks-node-group&quot; {
  </code></pre>
  <p>EKS</p>
  <pre><code># EKS Cluster Resources
  resource &quot;aws_eks_cluster&quot; &quot;eks&quot; {
    name = var.cluster-name
  
    version = var.k8s-version
  
    role_arn = aws_iam_role.cluster.arn
  
    vpc_config {
      security_group_ids = [var.security_group]
      subnet_ids         = var.private_subnets
    }
  
    enabled_cluster_log_types = var.eks-cw-logging
  
    depends_on = [
      aws_iam_role_policy_attachment.cluster-AmazonEKSClusterPolicy,
      aws_iam_role_policy_attachment.cluster-AmazonEKSServicePolicy,
    ]
  }
  
  </code></pre>
  <p>EKS-NODE-GROUP</p>
  <pre><code>resource &quot;aws_eks_node_group&quot; &quot;eks-node-group&quot; {
    cluster_name    = var.cluster-name
    node_group_name = &quot;${var.cluster-name}-default-node-group&quot;
    node_role_arn   = aws_iam_role.node.arn
    subnet_ids      = var.private_subnets
    capacity_type   = &quot;SPOT&quot;
    node_group_name_prefix = null #&quot;Creates a unique name beginning with the specified prefix. Conflicts with node_group_name&quot;
    scaling_config {
      desired_size  = var.desired-capacity
      max_size      = var.max-size
      min_size      = var.min-size
    }
    update_config {
      max_unavailable = 1
    }
    instance_types = [var.node-instance-type]
    # Ensure that IAM Role permissions are created before and deleted after EKS Node Group handling.
    # Otherwise, EKS will not be able to properly delete EC2 Instances and Elastic Network Interfaces.
    depends_on = [
      aws_eks_cluster.eks,
      aws_iam_role_policy_attachment.node-AmazonEKSWorkerNodePolicy,
      aws_iam_role_policy_attachment.node-AmazonEKS_CNI_Policy
    ]
    tags = {
      Name = &quot;${var.cluster-name}-default-node-group&quot;
    }
  }
  </code></pre>
  <p>IAM</p>
  <pre><code># IAM
  
  # CLUSTER
  resource &quot;aws_iam_role&quot; &quot;cluster&quot; {
    name = &quot;${var.cluster-name}-eks-cluster-role&quot;
  
    assume_role_policy = &lt;&lt;POLICY
  {
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: {
          &quot;Service&quot;: &quot;eks.amazonaws.com&quot;
        },
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;
      }
    ]
  }
  POLICY
  }
  
  resource &quot;aws_iam_role_policy_attachment&quot; &quot;cluster-AmazonEKSClusterPolicy&quot; {
    policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSClusterPolicy&quot;
    role       = aws_iam_role.cluster.name
  }
  
  resource &quot;aws_iam_role_policy_attachment&quot; &quot;cluster-AmazonEKSServicePolicy&quot; {
    policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSServicePolicy&quot;
    role       = aws_iam_role.cluster.name
  }
  
  # NODES
  resource &quot;aws_iam_role&quot; &quot;node&quot; {
    name = &quot;${var.cluster-name}-eks-node-role&quot;
  
    assume_role_policy = &lt;&lt;POLICY
  {
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: {
          &quot;Service&quot;: &quot;ec2.amazonaws.com&quot;
        },
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;
      }
    ]
  }
  POLICY
  }
  
  resource &quot;aws_iam_role_policy_attachment&quot; &quot;node-AmazonEKSWorkerNodePolicy&quot; {
    policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy&quot;
    role       = aws_iam_role.node.name
  }
  
  resource &quot;aws_iam_role_policy_attachment&quot; &quot;node-AmazonEKS_CNI_Policy&quot; {
    policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy&quot;
    role       = aws_iam_role.node.name
  }
  
  resource &quot;aws_iam_role_policy_attachment&quot; &quot;node-AmazonEC2ContainerRegistryReadOnly&quot; {
    policy_arn = &quot;arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly&quot;
    role       = aws_iam_role.node.name
  }
  
  resource &quot;aws_iam_instance_profile&quot; &quot;node&quot; {
    name = &quot;${var.cluster-name}-eks-node-instance-profile&quot;
    role = aws_iam_role.node.name
  }
  </code></pre>
  <p>Security Group</p>
  <pre><code># Create Security Group
  resource &quot;aws_security_group&quot; &quot;cluster&quot; {
    name        = &quot;terraform_cluster&quot;
    description = &quot;AWS security group for terraform&quot;
    vpc_id      = aws_vpc.vpc1.id
  
    # Input
    ingress {
      from_port   = &quot;1&quot;
      to_port     = &quot;65365&quot;
      protocol    = &quot;TCP&quot;
      cidr_blocks = [var.address_allowed, var.vpc1_cidr_block]
    }
  
    # Output
    egress {
      from_port   = 0             # any port
      to_port     = 0             # any port
      protocol    = &quot;-1&quot;          # any protocol
      cidr_blocks = [&quot;0.0.0.0/0&quot;] # any destination
    }
  
    # ICMP Ping 
    ingress {
      from_port   = -1
      to_port     = -1
      protocol    = &quot;icmp&quot;
      cidr_blocks = [var.address_allowed, var.vpc1_cidr_block]
    }
  
    tags = merge(
      {
        Name = &quot;onboarding-sg&quot;,
      },
      var.tags,
    )
  }
  </code></pre>
  <p>VPC</p>
  <pre><code>
  # Create VPC
  resource &quot;aws_vpc&quot; &quot;vpc1&quot; {
    cidr_block           = var.vpc1_cidr_block
    instance_tenancy     = &quot;default&quot;
    enable_dns_support   = true
    enable_dns_hostnames = true
  
    tags = merge(
      {
        Name = &quot;onboarding-vpc&quot;,
      },
      var.tags,
    )
  }
  
  
  # Subnet Public
  resource &quot;aws_subnet&quot; &quot;subnet_public1&quot; {
    vpc_id                  = aws_vpc.vpc1.id
    cidr_block              = var.subnet_public1_cidr_block[0]
    map_public_ip_on_launch = &quot;true&quot; #it makes this a public subnet
    availability_zone       = data.aws_availability_zones.available.names[0]
  
    tags = merge(
      {
        Name                     = &quot;onboarding-public-sub&quot;,
        &quot;kubernetes.io/role/elb&quot; = &quot;1&quot;
      },
      var.tags,
    )
  }
  
  # Subnet Private
  resource &quot;aws_subnet&quot; &quot;subnet_private1&quot; {
    for_each                = { for idx, cidr_block in var.subnet_private1_cidr_block: cidr_block =&gt; idx}
    vpc_id                  = aws_vpc.vpc1.id
    cidr_block              = each.key
    map_public_ip_on_launch = &quot;false&quot; //it makes this a public subnet
    availability_zone       = data.aws_availability_zones.available.names[each.value]
  
    tags = merge(
      {
        Name                              = &quot;onboarding-private-sub&quot;,
        &quot;kubernetes.io/role/internal-elb&quot; = &quot;1&quot;,
        &quot;kubernetes.io/cluster/${var.cluster-name}&quot; = &quot;owned&quot;
      },
      var.tags,
    )
  }
  </code></pre>
  <p>tfvars</p>
  <pre><code>#General vars
  region = &quot;eu-west-1&quot;
  
  #Bucket vars
  
  bucket             = &quot;tf-state&quot;
  tag_name           = &quot;test&quot;
  tag_environment    = &quot;Dev&quot;
  acl                = &quot;private&quot;
  versioning_enabled = &quot;Enabled&quot;
  
  # Network EKS vars
  aws_public_key_path        = &quot;~/.ssh/id_rsa.pub&quot;
  aws_key_name               = &quot;aws-k8s&quot;
  address_allowed            = &quot;/32&quot; # Office public IP Address
  vpc1_cidr_block            = &quot;10.0.0.0/16&quot;
  subnet_public1_cidr_block  = [&quot;10.0.128.0/20&quot;, &quot;10.0.144.0/20&quot;, &quot;10.0.160.0/20&quot;]
  subnet_private1_cidr_block = [&quot;10.0.0.0/19&quot;, &quot;10.0.32.0/19&quot;, &quot;10.0.64.0/19&quot;]
  
  tags = {
    Scost       = &quot;testing&quot;,
    Terraform   = &quot;true&quot;,
    Environment = &quot;testing&quot;
  }
  
  #EKS
  cluster-name        = &quot;Self-Hosted-Runner&quot;
  k8s-version         = &quot;1.21&quot;
  node-instance-type  = &quot;t3.medium&quot;
  desired-capacity    = &quot;3&quot;
  max-size            = &quot;7&quot;
  min-size            = &quot;1&quot;
  # db-subnet-cidr      = [&quot;10.0.192.0/21&quot;, &quot;10.0.200.0/21&quot;, &quot;10.0.208.0/21&quot;]
  eks-cw-logging      = [&quot;api&quot;, &quot;audit&quot;, &quot;authenticator&quot;, &quot;controllerManager&quot;, &quot;scheduler&quot;]
  ec2-key-public-key  = &quot;&quot;
  </code></pre>
  <pre><code>&quot;issues&quot; : [ {
          &quot;code&quot; : &quot;NodeCreationFailure&quot;,
          &quot;message&quot; : &quot;Instances failed to join the kubernetes cluster&quot;,
  </code></pre>
  <p>What do you think I missed configured?</p>