{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/amazon-eks/json-schema/amazon-eks-create-cluster-request-schema.json",
  "title": "CreateClusterRequest",
  "x-generated": "2026-11-11",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/amazon-eks-clusters-api-openapi.yml#/components/schemas/CreateClusterRequest",
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "The unique name to give to your cluster. The name can contain only alphanumeric characters (case-sensitive), hyphens, and underscores. It must start with an alphanumeric character and can't be longer than 100 characters. The name must be unique within the Amazon Web Services Region and Amazon Web Services account that you're creating the cluster in."
    },
    "version": {
      "type": "string",
      "description": "The desired Kubernetes version for your cluster. If you don't specify a value here, the default version available in Amazon EKS is used. The default version might not be the latest version available."
    },
    "roleArn": {
      "type": "string",
      "description": "The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to Amazon Web Services API operations on your behalf. For more information, see Amazon EKS Service IAM Role in the Amazon EKS User Guide ."
    },
    "resourcesVpcConfig": {
      "$ref": "#/$defs/VpcConfigRequest"
    },
    "kubernetesNetworkConfig": {
      "$ref": "#/$defs/KubernetesNetworkConfigRequest"
    },
    "logging": {
      "$ref": "#/$defs/Logging"
    },
    "clientRequestToken": {
      "type": "string",
      "description": "A unique, case-sensitive identifier that you provide to ensure the idempotency of the request."
    },
    "tags": {
      "type": "object",
      "additionalProperties": {
        "type": "string"
      },
      "description": "Metadata that assists with categorization and organization. Each tag consists of a key and an optional value. You define both. Tags don't propagate to any other cluster or Amazon Web Services resources."
    },
    "encryptionConfig": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/EncryptionConfig"
      },
      "description": "The encryption configuration for the cluster."
    },
    "outpostConfig": {
      "$ref": "#/$defs/OutpostConfigRequest"
    },
    "accessConfig": {
      "$ref": "#/$defs/CreateAccessConfigRequest"
    },
    "bootstrapSelfManagedAddons": {
      "type": "boolean",
      "description": "If you set this value to False when creating a cluster, the default networking add-ons will not be installed. The default networking add-ons include vpc-cni, coredns, and kube-proxy. Use this option when you plan to install third-party alternative add-ons or self-manage the default networking add-ons."
    },
    "upgradePolicy": {
      "$ref": "#/$defs/UpgradePolicyRequest"
    },
    "zonalShiftConfig": {
      "$ref": "#/$defs/ZonalShiftConfigRequest"
    },
    "remoteNetworkConfig": {
      "$ref": "#/$defs/RemoteNetworkConfigRequest"
    },
    "computeConfig": {
      "$ref": "#/$defs/ComputeConfigRequest"
    },
    "storageConfig": {
      "$ref": "#/$defs/StorageConfigRequest"
    },
    "deletionProtection": {
      "type": "boolean",
      "description": "Indicates whether to enable deletion protection for the cluster. When enabled, the cluster cannot be deleted unless deletion protection is first disabled. This helps prevent accidental cluster deletion. Default value is false."
    },
    "controlPlaneScalingConfig": {
      "$ref": "#/$defs/ControlPlaneScalingConfig"
    },
    "kubeApiServerConfig": {
      "$ref": "#/$defs/KubeApiServerConfigRequest"
    },
    "kubeSchedulerConfig": {
      "$ref": "#/$defs/KubeSchedulerConfigRequest"
    },
    "kubeControllerManagerConfig": {
      "$ref": "#/$defs/KubeControllerManagerConfigRequest"
    }
  },
  "required": [
    "name",
    "roleArn",
    "resourcesVpcConfig"
  ],
  "$defs": {
    "BlockStorage": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Indicates if the block storage capability is enabled on your EKS Auto Mode cluster. If the block storage capability is enabled, EKS Auto Mode will create and delete EBS volumes in your Amazon Web Services account."
        }
      }
    },
    "ComputeConfigRequest": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Request to enable or disable the compute capability on your EKS Auto Mode cluster. If the compute capability is enabled, EKS Auto Mode will create and delete EC2 Managed Instances in your Amazon Web Services account."
        },
        "nodePools": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Configuration for node pools that defines the compute resources for your EKS Auto Mode cluster. For more information, see EKS Auto Mode Node Pools in the Amazon EKS User Guide."
        },
        "nodeRoleArn": {
          "type": "string",
          "description": "The ARN of the IAM Role EKS will assign to EC2 Managed Instances in your EKS Auto Mode cluster. This value cannot be changed after the compute capability of EKS Auto Mode is enabled. For more information, see the IAM Reference in the Amazon EKS User Guide."
        }
      }
    },
    "ControlPlanePlacementRequest": {
      "type": "object",
      "properties": {
        "groupName": {
          "type": "string",
          "description": "The name of the placement group for the Kubernetes control plane instances. This setting can't be changed after cluster creation."
        },
        "spreadLevel": {
          "type": "string",
          "enum": [
            "host",
            "rack"
          ],
          "description": "Optional parameter to specify the placement group spread level for control plane instances. If not provided, Amazon EKS will deploy control plane instances without a placement group."
        }
      }
    },
    "ControlPlaneScalingConfig": {
      "type": "object",
      "properties": {
        "tier": {
          "type": "string",
          "enum": [
            "standard",
            "tier-xl",
            "tier-2xl",
            "tier-4xl",
            "tier-8xl"
          ],
          "description": "The control plane scaling tier configuration. Available options are standard, tier-xl, tier-2xl, tier-4xl, or tier-8xl. For more information, see EKS Provisioned Control Plane in the Amazon EKS User Guide."
        }
      }
    },
    "CrdManagementConfiguration": {
      "type": "object",
      "properties": {
        "managed": {
          "type": "boolean",
          "description": "Indicates if Gateway API CRD management is enabled on your EKS Auto Mode cluster. If CRD management is enabled, EKS Auto Mode will create and update the Gateway API CRDs in your EKS Auto Mode cluster."
        }
      }
    },
    "CreateAccessConfigRequest": {
      "type": "object",
      "properties": {
        "bootstrapClusterCreatorAdminPermissions": {
          "type": "boolean",
          "description": "Specifies whether or not the cluster creator IAM principal was set as a cluster admin access entry during cluster creation time. The default value is true."
        },
        "authenticationMode": {
          "type": "string",
          "enum": [
            "API",
            "API_AND_CONFIG_MAP",
            "CONFIG_MAP"
          ],
          "description": "The desired authentication mode for the cluster. If you create a cluster by using the EKS API, Amazon Web Services SDKs, or CloudFormation, the default is CONFIG_MAP. If you create the cluster by using the Amazon Web Services Management Console, the default value is API_AND_CONFIG_MAP."
        }
      }
    },
    "ElasticLoadBalancing": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Indicates if the load balancing capability is enabled on your EKS Auto Mode cluster. If the load balancing capability is enabled, EKS Auto Mode will create and delete load balancers in your Amazon Web Services account."
        },
        "gatewayApi": {
          "$ref": "#/$defs/GatewayApiConfiguration"
        }
      }
    },
    "EncryptionConfig": {
      "type": "object",
      "properties": {
        "resources": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Amazon EKS encrypts all Kubernetes API data with envelope encryption by default for clusters running Kubernetes version 1.28 or higher, so this field no longer affects which resources are encrypted. Specifies the resources to be encrypted. The only supported value is secrets."
        },
        "provider": {
          "$ref": "#/$defs/Provider"
        }
      }
    },
    "EtcdPlacementRequest": {
      "type": "object",
      "properties": {
        "spreadLevel": {
          "type": "string",
          "enum": [
            "host",
            "rack"
          ],
          "description": "Optional parameter to specify the placement group spread level for etcd instances. If not provided, Amazon EKS will deploy etcd instances without a placement group."
        }
      }
    },
    "GatewayApiConfiguration": {
      "type": "object",
      "properties": {
        "crds": {
          "$ref": "#/$defs/CrdManagementConfiguration"
        }
      }
    },
    "HorizontalPodAutoscalerControllerConfigRequest": {
      "type": "object",
      "properties": {
        "horizontalPodAutoscalerSyncPeriod": {
          "type": "string",
          "description": "The interval between each sync of the horizontal pod autoscaler. Valid values are single-unit durations such as 15s or 1m."
        }
      }
    },
    "KubeApiServerConfigRequest": {
      "type": "object",
      "properties": {
        "eventTtl": {
          "type": "string",
          "description": "The duration that Kubernetes events are retained. Valid values are single-unit durations such as 30m or 1h."
        },
        "serviceNodePortRange": {
          "$ref": "#/$defs/ServiceNodePortRange"
        }
      }
    },
    "KubeControllerManagerConfigRequest": {
      "type": "object",
      "properties": {
        "podGcControllerConfig": {
          "$ref": "#/$defs/PodGcControllerConfigRequest"
        },
        "horizontalPodAutoscalerControllerConfig": {
          "$ref": "#/$defs/HorizontalPodAutoscalerControllerConfigRequest"
        }
      }
    },
    "KubeSchedulerConfigRequest": {
      "type": "object",
      "properties": {
        "nodeResourcesFit": {
          "$ref": "#/$defs/NodeResourcesFitConfig"
        }
      }
    },
    "KubernetesNetworkConfigRequest": {
      "type": "object",
      "properties": {
        "serviceIpv4Cidr": {
          "type": "string",
          "description": "Don't specify a value if you select ipv6 for ipFamily. The CIDR block to assign Kubernetes service IP addresses from. If you don't specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks. We recommend that you specify a block that does not overlap with resources in other networks that are peered or connected to your VPC. The block must meet the following requirements: Within one of the following private IP address blocks: 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. Doesn't overlap with any CIDR block assigned to the VPC that you selected for V"
        },
        "ipFamily": {
          "type": "string",
          "enum": [
            "ipv4",
            "ipv6"
          ],
          "description": "Specify which IP family is used to assign Kubernetes pod and service IP addresses. If you don't specify a value, ipv4 is used by default. You can only specify an IP family when you create a cluster and can't change this value once the cluster is created. If you specify ipv6, the VPC and subnets that you specify for cluster creation must have both IPv4 and IPv6 CIDR blocks assigned to them. You can't specify ipv6 for clusters in China Regions. You can only specify ipv6 for 1.21 and later clusters that use version 1.10.1 or later of the Amazon VPC CNI add-on. If you specify ipv6, then ensure tha"
        },
        "elasticLoadBalancing": {
          "$ref": "#/$defs/ElasticLoadBalancing"
        }
      }
    },
    "LogSetup": {
      "type": "object",
      "properties": {
        "types": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "api",
              "audit",
              "authenticator",
              "controllerManager",
              "scheduler"
            ]
          },
          "description": "The available cluster control plane log types."
        },
        "enabled": {
          "type": "boolean",
          "description": "If a log type is enabled, that log type exports its control plane logs to CloudWatch Logs . If a log type isn't enabled, that log type doesn't export its control plane logs. Each individual log type can be enabled or disabled independently."
        }
      }
    },
    "Logging": {
      "type": "object",
      "properties": {
        "clusterLogging": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/LogSetup"
          },
          "description": "The cluster control plane logging configuration for your cluster."
        }
      }
    },
    "NodeResourcesFitConfig": {
      "type": "object",
      "properties": {
        "scoringStrategy": {
          "$ref": "#/$defs/ScoringStrategy"
        }
      }
    },
    "OutpostConfigRequest": {
      "type": "object",
      "properties": {
        "outpostArns": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The ARN of the Outpost that you want to use for your local Amazon EKS cluster on Outposts. Only a single Outpost ARN is supported."
        },
        "controlPlaneInstanceType": {
          "type": "string",
          "description": "The Amazon EC2 instance type for the Kubernetes control plane instances of your local Amazon EKS cluster on Amazon Web Services Outposts. This instance type applies to all control plane instances and cannot be changed after cluster creation. For more information, see Capacity considerations in the Amazon EKS User Guide."
        },
        "controlPlanePlacement": {
          "$ref": "#/$defs/ControlPlanePlacementRequest"
        },
        "etcdInstanceType": {
          "type": "string",
          "description": "The Amazon EC2 instance type for etcd instances of your local Amazon EKS cluster on Amazon Web Services Outposts. This instance type applies to all etcd instances and cannot be changed after cluster creation."
        },
        "etcdPlacement": {
          "$ref": "#/$defs/EtcdPlacementRequest"
        }
      },
      "required": [
        "outpostArns",
        "controlPlaneInstanceType"
      ]
    },
    "PodGcControllerConfigRequest": {
      "type": "object",
      "properties": {
        "terminatedPodGcThreshold": {
          "type": "integer",
          "description": "The number of terminated pods that can exist before the garbage collector starts deleting them."
        }
      }
    },
    "Provider": {
      "type": "object",
      "properties": {
        "keyArn": {
          "type": "string",
          "description": "Amazon Resource Name (ARN) or alias of the KMS key. The KMS key must be symmetric and created in the same Amazon Web Services Region as the cluster. If the KMS key was created in a different account, the IAM principal must have access to the KMS key. For more information, see Allowing users in other accounts to use a KMS key in the Key Management Service Developer Guide."
        }
      }
    },
    "RemoteNetworkConfigRequest": {
      "type": "object",
      "properties": {
        "remoteNodeNetworks": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/RemoteNodeNetwork"
          },
          "description": "The list of network CIDRs that can contain hybrid nodes. These CIDR blocks define the expected IP address range of the hybrid nodes that join the cluster. These blocks are typically determined by your network administrator. Enter one or more IPv4 CIDR blocks in decimal dotted-quad notation (for example, 10.2.0.0/16). It must satisfy the following requirements: Each block must be within an IPv4 RFC-1918 network range. Minimum allowed size is /32, maximum allowed size is /8. Publicly-routable addresses aren't supported. Each block cannot overlap with the range of the VPC CIDR blocks for your EKS"
        },
        "remotePodNetworks": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/RemotePodNetwork"
          },
          "description": "The list of network CIDRs that can contain pods that run Kubernetes webhooks on hybrid nodes. These CIDR blocks are determined by configuring your Container Network Interface (CNI) plugin. We recommend the Calico CNI or Cilium CNI. Note that the Amazon VPC CNI plugin for Kubernetes isn't available for on-premises and edge locations. Enter one or more IPv4 CIDR blocks in decimal dotted-quad notation (for example, 10.2.0.0/16). It must satisfy the following requirements: Each block must be within an IPv4 RFC-1918 network range. Minimum allowed size is /32, maximum allowed size is /8. Publicly-ro"
        }
      }
    },
    "RemoteNodeNetwork": {
      "type": "object",
      "properties": {
        "cidrs": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "A network CIDR that can contain hybrid nodes. These CIDR blocks define the expected IP address range of the hybrid nodes that join the cluster. These blocks are typically determined by your network administrator. Enter one or more IPv4 CIDR blocks in decimal dotted-quad notation (for example, 10.2.0.0/16). It must satisfy the following requirements: Each block must be within an IPv4 RFC-1918 network range. Minimum allowed size is /32, maximum allowed size is /8. Publicly-routable addresses aren't supported. Each block cannot overlap with the range of the VPC CIDR blocks for your EKS resources,"
        }
      }
    },
    "RemotePodNetwork": {
      "type": "object",
      "properties": {
        "cidrs": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "A network CIDR that can contain pods that run Kubernetes webhooks on hybrid nodes. These CIDR blocks are determined by configuring your Container Network Interface (CNI) plugin. We recommend the Calico CNI or Cilium CNI. Note that the Amazon VPC CNI plugin for Kubernetes isn't available for on-premises and edge locations. Enter one or more IPv4 CIDR blocks in decimal dotted-quad notation (for example, 10.2.0.0/16). It must satisfy the following requirements: Each block must be within an IPv4 RFC-1918 network range. Minimum allowed size is /32, maximum allowed size is /8. Publicly-routable addr"
        }
      }
    },
    "ResourceWeight": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "description": "The name of the resource (for example, cpu or memory)."
        },
        "weight": {
          "type": "integer",
          "description": "The weight assigned to the resource for scoring. Must be between 1 and 100."
        }
      }
    },
    "ScoringStrategy": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "LeastAllocated",
            "MostAllocated"
          ],
          "description": "The scoring strategy type. Valid values are LeastAllocated or MostAllocated."
        },
        "resources": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/ResourceWeight"
          },
          "description": "The resource weights used for scoring nodes."
        }
      }
    },
    "ServiceNodePortRange": {
      "type": "object",
      "properties": {
        "minPort": {
          "type": "integer",
          "description": "The minimum port number in the range."
        },
        "maxPort": {
          "type": "integer",
          "description": "The maximum port number in the range."
        }
      }
    },
    "StorageConfigRequest": {
      "type": "object",
      "properties": {
        "blockStorage": {
          "$ref": "#/$defs/BlockStorage"
        }
      }
    },
    "UpgradePolicyRequest": {
      "type": "object",
      "properties": {
        "supportType": {
          "type": "string",
          "enum": [
            "STANDARD",
            "EXTENDED"
          ],
          "description": "If the cluster is set to EXTENDED, it will enter extended support at the end of standard support. If the cluster is set to STANDARD, it will be automatically upgraded at the end of standard support. Learn more about EKS Extended Support in the Amazon EKS User Guide."
        }
      }
    },
    "VpcConfigRequest": {
      "type": "object",
      "properties": {
        "subnetIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Specify subnets for your Amazon EKS nodes. Amazon EKS creates cross-account elastic network interfaces in these subnets to allow communication between your nodes and the Kubernetes control plane."
        },
        "securityGroupIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Specify one or more security groups for the cross-account elastic network interfaces that Amazon EKS creates to use that allow communication between your nodes and the Kubernetes control plane. If you don't specify any security groups, then familiarize yourself with the difference between Amazon EKS defaults for clusters deployed with Kubernetes. For more information, see Amazon EKS security group considerations in the Amazon EKS User Guide ."
        },
        "endpointPublicAccess": {
          "type": "boolean",
          "description": "Set this value to false to disable public access to your cluster's Kubernetes API server endpoint. If you disable public access, your cluster's Kubernetes API server can only receive requests from within the cluster VPC. The default value for this parameter is true, which enables public access for your Kubernetes API server. The endpoint domain name and IP address family depends on the value of the ipFamily for the cluster. For more information, see Cluster API server endpoint in the Amazon EKS User Guide ."
        },
        "endpointPrivateAccess": {
          "type": "boolean",
          "description": "Set this value to true to enable private access for your cluster's Kubernetes API server endpoint. If you enable private access, Kubernetes API requests from within your cluster's VPC use the private VPC endpoint. The default value for this parameter is false, which disables private access for your Kubernetes API server. If you disable private access and you have nodes or Fargate pods in the cluster, then ensure that publicAccessCidrs includes the necessary CIDR blocks for communication with the nodes or Fargate pods. For more information, see Cluster API server endpoint in the Amazon EKS User"
        },
        "publicAccessCidrs": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The CIDR blocks that are allowed access to your cluster's public Kubernetes API server endpoint. Communication to the endpoint from addresses outside of the CIDR blocks that you specify is denied. The default value is 0.0.0.0/0 and additionally ::/0 for dual-stack `IPv6` clusters. If you've disabled private endpoint access, make sure that you specify the necessary CIDR blocks for every node and Fargate Pod in the cluster. For more information, see Cluster API server endpoint in the Amazon EKS User Guide . Note that the public endpoints are dual-stack for only IPv6 clusters that are made after "
        },
        "controlPlaneEgressMode": {
          "type": "string",
          "enum": [
            "AWS_MANAGED",
            "CUSTOMER_ROUTED",
            "CUSTOMER_ISOLATED"
          ],
          "description": "Specifies the control plane egress routing mode for the cluster. If the cluster is set to AWS_MANAGED, Amazon EKS manages the egress path from the control plane and you don't need to configure NAT gateways or other routing infrastructure for control plane traffic. If the cluster is set to CUSTOMER_ROUTED, you manage the egress path from the control plane in your VPC subnets. You are responsible for ensuring that the control plane can reach required endpoints such as webhook servers and OIDC providers. The default value is AWS_MANAGED. Once set to CUSTOMER_ROUTED, this setting cannot be changed"
        }
      }
    },
    "ZonalShiftConfigRequest": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "If zonal shift is enabled, Amazon Web Services configures zonal autoshift for the cluster."
        }
      }
    }
  }
}