Provisioning

Overview

This step executes Terraform to create all AWS infrastructure. The process takes 15-25 minutes and provisions:

• VPC with public/private subnets and NAT gateway
• EKS cluster with managed node groups
• RDS PostgreSQL database with automatic password rotation
• S3 bucket with VPC endpoint for private access
• Secrets Manager with KMS encryption
• IAM roles for pod identity (IRSA)
• Helm releases: ALB Controller, External Secrets, ArgoCD, ClickHouse Operator

After completion, you will have a fully provisioned AWS environment ready for Kubernetes workloads.

What happens during provisioning

When you run terraform apply, Terraform:

1. Reads your configuration from terraform.tfvars
2. Calculates dependencies to determine the order resources must be created
3. Creates resources in AWS via API calls
4. Tracks state in your S3 backend so it knows what exists
5. Outputs important values you’ll need for subsequent steps

The process is mostly automated, but you’ll need to monitor for errors and potentially troubleshoot issues.

Initialize Terraform

From the aws_tf directory, initialize the working directory:

$
terraform init

This command:

• Downloads required provider plugins (AWS, Kubernetes, Helm)
• Configures the S3 backend for state storage
• Validates your backend configuration

Expected output:

Initializing the backend...
Successfully configured the backend "s3"!
Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 6.0"...
- Installing hashicorp/aws v6.x.x...
Terraform has been successfully initialized!

Review the plan

Before creating anything, preview what Terraform will do:

$
terraform plan

This shows all resources that will be created, modified, or destroyed. For a fresh deployment, you should see only resource additions (green + symbols).

Key resources in the plan:

Apply the infrastructure

Once you’ve reviewed the plan, create the resources:

$
terraform apply

Terraform shows the plan again and asks for confirmation. Type yes to proceed.

Expected duration: 15-25 minutes

Common provisioning errors

IAM permission errors

Error: creating IAM Role: AccessDenied

Your IAM user/role lacks permission to create IAM resources. You need:

• iam:CreateRole, iam:AttachRolePolicy, iam:CreatePolicy
• iam:CreateOpenIDConnectProvider (for IRSA)

Service quota errors

Error: creating EKS Node Group: ResourceLimitExceeded

You’ve hit an AWS service quota. Common limits:

Naming conflicts

Error: creating S3 Bucket: BucketAlreadyExists

Resource names must be globally unique (S3) or unique within your account (most others). If you get naming conflicts:

• Change confident_application_name to something unique
• Verify you’re not running multiple deployments with the same name

EKS cluster creation timeout

Error: waiting for EKS Cluster to create: timeout while waiting

EKS can occasionally take longer than expected. Usually just re-running terraform apply continues where it left off. If it keeps failing:

• Check AWS Health Dashboard for regional issues
• Verify your VPC has available IPs
• Check for restrictive SCPs (Service Control Policies) in your organization

Provider authentication errors

Error: error configuring Terraform AWS Provider: no valid credential sources found

Terraform can’t authenticate to AWS. Verify:

• aws sts get-caller-identity works
• Environment variables are set if using them
• AWS SSO session hasn’t expired (re-run aws sso login)

Helm release errors

Error: unable to build kubernetes objects from release manifest

This usually means EKS isn’t fully ready when Helm tries to install charts. Re-running terraform apply typically resolves it.

Capture important outputs

After successful completion, Terraform displays outputs. Save these—you’ll need them for subsequent steps:

$
# View all outputs
$
terraform output
$
$
# Get specific values
$
terraform output cluster_name
$
terraform output db_instance_endpoint
$
terraform output app_bucket_name
$
terraform output argocd_server_url

What was deployed

Here’s what now exists in your AWS account:

Networking

• VPC with DNS support enabled
• Public subnets (2) — where the ALB receives traffic
• Private subnets (2) — where EKS nodes run, no direct internet access
• Database subnets (2) — isolated subnets for RDS
• NAT Gateway — allows private subnets to make outbound requests
• Internet Gateway — connects public subnets to the internet
• S3 VPC Endpoint — private connection to S3, traffic never touches internet

Compute (EKS)

• EKS Cluster — Kubernetes control plane managed by AWS
• Node Group — EC2 instances running Kubernetes workloads
• EBS CSI Driver — allows pods to use persistent storage

Data stores

• RDS PostgreSQL — managed database with encryption and automated backups
• S3 Bucket — private bucket for uploaded files
• Secrets Manager secret — contains all application credentials

Kubernetes components (pre-installed via Helm)

• AWS Load Balancer Controller — creates ALBs from Kubernetes Ingress
• External Secrets Operator — syncs secrets from Secrets Manager to Kubernetes
• ArgoCD — GitOps tool for managing deployments
• ClickHouse Operator — manages the analytics database

Security

• KMS Key — encrypts secrets at rest
• IAM Roles — separate roles for EKS, nodes, and pods (IRSA)
• Security Groups — firewall rules for each component

What to do if provisioning fails

1. Read the error message carefully. Terraform errors usually indicate exactly what went wrong.

2. Don’t panic. Terraform is idempotent—you can run apply again and it will continue from where it failed.

3. Check common causes:

   • IAM permissions
   • Service quotas
   • Network connectivity
   • Invalid variable values

4. If stuck, don’t destroy and recreate. This can leave orphaned resources. Instead, fix the configuration and re-apply.

Next steps

After infrastructure is provisioned, proceed to SSL Certificates to validate your HTTPS certificate.