CDK EKS deployment fails due to missing kubectl Lambda layers in eu-west-3

Question

**Issue Description:** I'm unable to deploy an EKS cluster using AWS CDK in the eu-west-3 region due to missing kubectl Lambda layers. The deployment fails with permission errors when trying to access kubectl layers from external AWS accounts.

**Steps to Reproduce:**
1. Create EKS cluster using AWS CDK in eu-west-3 region
2. Add Fargate profile or use addManifest() methods
3. CDK requires kubectl Lambda layer but none exist in eu-west-3

**Error Messages:**
User: arn:aws:sts:::assumed-role/cdk-hnb659fds-cfn-exec-role-495913029085-eu-west-3/AWSCloudFormation is not authorized to perform: lambda:GetLayerVersion on resource: arn:aws:lambda:us-east-1:903779448426:layer:kubectl-v1-28:1

**Investigation Results:**
* aws lambda list-layers --region eu-west-3 shows no kubectl layers
* aws lambda get-layer-version fails for kubectl layers in eu-west-3, eu-west-1, and us-east-1
* CDK documentation references account 903779448426 for kubectl layers but these appear unavailable

**Questions:**
1. Does AWS provide official kubectl Lambda layers for EKS CDK deployments?
2. What are the correct ARNs for kubectl layers in eu-west-3?
3. Is there a recommended approach for EKS CDK deployments that doesn't require external account dependencies?

Environment:
* Region: eu-west-3
* CDK Version: 2.1032.0

**Expected Outcome:**
Clear documentation on kubectl layer availability and official AWS-provided layer ARNs for all EKS-supported regions

Nicolas Duminil · Accepted Answer

Fixed by adding the following Maven dependency:

```
      
        software.amazon.awscdk
        cdk-lambda-layer-kubectl-v32
        2.1.0
      
```
and creating the EKS cluster:

```
    Cluster cluster = Cluster.Builder.create(this, "MyCluster")
      .version(KubernetesVersion.V1_28)
      .vpc(vpc)
      .kubectlLayer(new KubectlV32Layer(this, "KubectlLayer"))
      .defaultCapacity(0)
      .build();
```

re:Post Agent · Answer

When deploying an EKS cluster using AWS CDK in the eu-west-3 region, you're encountering issues with missing kubectl Lambda layers. This is a common authentication problem when working with EKS and CDK.

The error you're seeing indicates that your CDK deployment is trying to access a kubectl Lambda layer from an external AWS account (903779448426), but it doesn't have the necessary permissions. This happens because the CDK uses Lambda functions with kubectl to interact with your EKS cluster during deployment.

For the eu-west-3 region, there is a Lambda layer available for AWS Lambda Powertools TypeScript at:
arn:aws:lambda:eu-west-3:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:38

However, this is not the kubectl layer you need for EKS deployments.

To resolve this issue, you have a few options:

1. Create your own kubectl Lambda layer in your account for the eu-west-3 region.

2. Use the AWS CDK's `eks.KubectlLayer` construct to create a custom kubectl layer in your account.

3. If possible, deploy your EKS cluster in a region where the kubectl Lambda layers are available (like us-east-1).

4. Use the `skipKubectlLambdaLayer` option when creating your EKS cluster to avoid using the Lambda layer altogether, but this may limit some functionality.

When working with EKS clusters through CDK, ensure that:
- Your IAM user or role has the necessary permissions to access the EKS cluster
- You update your kubeconfig file properly to authenticate with your EKS cluster
- You're using the correct AWS CLI credentials

For troubleshooting EKS node join issues, verify that:
- DNS support is enabled for your VPC
- Worker nodes have the correct permissions
- Networking is properly configured for your VPC subnets
- The aws-auth ConfigMap includes the NodeInstanceRole of your worker nodes
- Security group requirements are met  
**Sources**  
[Error while creating EKS cluster | AWS re:Post](https://repost.aws/questions/QUh0ATsfxVQgOictOkZCKcmA/error-while-creating-eks-cluster)  
[Lambda layers - Powertools for AWS Lambda (TypeScript)](https://docs.powertools.aws.dev/lambda/typescript/latest/getting-started/lambda-layers/)  
[Troubleshoot EKS node join cluster errors | AWS re:Post](https://repost.aws/knowledge-center/eks-nodes-fail-cluster-join)

Nicolas Duminil · Answer

This response isn't accurate.

1. Create your own kubectl Lambda layer in your account for the eu-west-3 region. Complex to implement and maintain as it requires to package kubectl binary and dependencies.
2. Use the AWS CDK's eks.KubectlLayer construct to create a custom kubectl layer in your account. Such a construct doesn't actually exist in CDK.
3. If possible, deploy your EKS cluster in a region where the kubectl Lambda layers are available (like us-east-1). There is no kubectl Lambda layer in us-east-1 neither, as shown below:

```
    aws lambda get-layer-version --layer-name arn:aws:lambda:us-east-1:903779448426:layer:kubectl-v1-28:1 --version-number 1 --region us-east-1

An error occurred (ValidationException) when calling the GetLayerVersion operation: 1 validation error detected: Value 'arn:aws:lambda:us-east-1:903779448426:layer:kubectl-v1-28:1' at 'layerName' failed to satisfy constraint: Member must satisfy regular expression pattern: (arn:(aws[a-zA-Z-]*)?:lambda:(eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1}:\d{12}:layer:[a-zA-Z0-9-_]+)|[a-zA-Z0-9-_]+

```
4. Use the skipKubectlLambdaLayer option when creating your EKS cluster to avoid using the Lambda layer altogether, but this may limit some functionality. This option doesn't exist in the CDK Cluster builder. The Generative AI agent might be confusing different CDK versions or services

CDK EKS deployment fails due to missing kubectl Lambda layers in eu-west-3

Add your answer

Relevant content