# ClusterAttributes

Attributes for EKS clusters.

- Source: [`aws-eks-v2/lib/cluster.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-eks-v2/lib/cluster.ts#L209)
- Type last changed: v2.240.0 · 23 Feb 2026

## Example

```ts
const handlerRole = iam.Role.fromRoleArn(this, 'HandlerRole', 'arn:aws:iam::123456789012:role/lambda-role');
// get the serviceToken from the custom resource provider
const functionArn = lambda.Function.fromFunctionName(this, 'ProviderOnEventFunc', 'ProviderframeworkonEvent-XXX').functionArn;
const kubectlProvider = eks.KubectlProvider.fromKubectlProviderAttributes(this, 'KubectlProvider', {
  serviceToken: functionArn,
  role: handlerRole,
});

const cluster = eks.Cluster.fromClusterAttributes(this, 'Cluster', {
  clusterName: 'cluster',
  kubectlProvider,
});
```

## Properties

- `clusterCertificateAuthorityData`: string — The certificate-authority-data for your cluster.

  **Default:** if not specified `cluster.clusterCertificateAuthorityData` will throw an error

- `clusterEncryptionConfigKeyArn`: string — Amazon Resource Name (ARN) or alias of the customer master key (CMK).

  **Default:** if not specified `cluster.clusterEncryptionConfigKeyArn` will throw an error

- `clusterEndpoint`: string — The API Server endpoint URL.

  **Default:** if not specified `cluster.clusterEndpoint` will throw an error.

- `clusterName`: string (required) — The physical name of the Cluster.

- `clusterSecurityGroupId`: string — The cluster security group that was created by Amazon EKS for the cluster.

  **Default:** if not specified `cluster.clusterSecurityGroupId` will throw an error

- `ipFamily`: [IpFamily](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.IpFamily.html) = IpFamily.IP_V4 — Specify which IP family is used to assign Kubernetes pod and service IP addresses.

- `kubectlProvider`: [IKubectlProvider](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.IKubectlProvider.html) — KubectlProvider for issuing kubectl commands.

  **Default:** Default CDK provider

- `kubectlProviderOptions`: [KubectlProviderOptions](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.KubectlProviderOptions.html) — Options for creating the kubectl provider - a lambda function that executes `kubectl` and `helm` against the cluster.

  **Default:** kubectl provider will not be created by default.

  If defined, `kubectlLayer` is a required property.

- `openIdConnectProvider`: [IOpenIdConnectProvider](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IOpenIdConnectProvider.html) — An Open ID Connect provider for this cluster that can be used to configure service accounts.

  **Default:** if not specified `cluster.openIdConnectProvider` and `cluster.addServiceAccount` will throw an error.

  You can either import an existing provider using `iam.OpenIdConnectProvider.fromProviderArn`,
  or create a new provider using `new eks.OpenIdConnectProvider`

- `prune`: boolean = true — Indicates whether Kubernetes resources added through `addManifest()` can be automatically pruned.

  When this is enabled (default), prune labels will be
  allocated and injected to each resource. These labels will then be used
  when issuing the `kubectl apply` operation with the `--prune` switch.

- `securityGroupIds`: string[] — Additional security groups associated with this cluster.

  **Default:** if not specified, no additional security groups will be considered in `cluster.connections`.

- `vpc`: [IVpc](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IVpc.html) — The VPC in which this Cluster was created.

  **Default:** if not specified `cluster.vpc` will throw an error