Use eksctl to learn and iterate; use infrastructure as code for anything that lasts.

All three create the same cluster. The difference is repeatability, review and how the cluster fits with the rest of your AWS estate.

eksctl: quick start

$ eksctl create cluster --name shop-eu --region eu-west-1 \
    --version 1.31 --nodegroup-name std --nodes 3
... 12 minutes later
EKS cluster "shop-eu" in "eu-west-1" region is ready
$ aws eks update-kubeconfig --name shop-eu --region eu-west-1
$ kubectl get nodes

Terraform (terraform-aws-modules/eks)

module "eks" {
  source          = "terraform-aws-modules/eks/aws"
  cluster_name    = "shop-eu"
  subnet_ids      = module.vpc.private_subnets
  authentication_mode = "API"
}

eksctl

Fast and approachable: creates the VPC, IAM roles and node group from a command or a ClusterConfig file. Great for labs and short-lived clusters.

Terraform or CloudFormation

Reviewable, repeatable, and part of the same codebase as the VPC, IAM and databases. Preferred for production.

Console

Useful to explore options. Avoid for anything you must reproduce, because it leaves no code to review.

Decide once, document it

Authentication mode, endpoint access, secrets encryption and logging are easier to set at creation than to retrofit.

Creating clusters: eksctl, Terraform or the console

eksctl is the de facto command-line tool for EKS. One command, or a ClusterConfig YAML file, creates the VPC, IAM roles, the control plane and a node group. It is excellent for learning, labs and short-lived clusters. For production, most teams use Terraform (the community terraform-aws-eks module is very widely used) or CloudFormation so that the cluster is defined next to the rest of the AWS account and goes through code review and a pipeline.

Whichever you use, a handful of settings are far easier to choose at creation. The authentication mode (use the API so access entries replace the aws-auth ConfigMap), the API endpoint access, KMS envelope encryption of Kubernetes Secrets, control plane log types, and which subnets the cluster uses. Reveal the four cards with the right arrow.

After creation, aws eks update-kubeconfig writes a kubeconfig entry whose credentials come from the AWS CLI (it calls aws eks get-token), so your IAM identity must be allowed. This is why a freshly created cluster often rejects the person who did not create it: only the creator or explicitly added identities have access. Module 1's access slide fixes this.

The terminal output is a representative reconstruction; real timings and messages vary. Versions in examples change often, so check which Kubernetes versions EKS currently offers.