Prerequisites
Authentication
The deletion process uses OpenTofu to destroy AWS resources, such as EKS clusters, IAM roles, S3 buckets, and KMS keys. The AWS credentials must be exported as environment variables to authenticate these operations.
Note: While using temporary credentials, such as, using AWS STS, ensure the session token is included and that the credentials have not expired before proceeding.
To export the AWS credentials, run the following commands.
export AWS_ACCESS_KEY_ID=<your-access-key-id>
export AWS_SECRET_ACCESS_KEY=<your-secret-access-key>
export AWS_SESSION_TOKEN=<your-session-token>
To verify that the credentials are valid and the correct AWS identity is being used, run the following command.
aws sts get-caller-identity
Required Permissions
The same IAM principal (or one with equivalent permissions) that installed the cluster, can delete the cluster. The principal must have cluster-creator admin access to the EKS Kubernetes API.
The required IAM Permissions are listed in the following table:
| Category | Permissions | Used by |
|---|---|---|
| S3 (state backend) | s3:ListBucket,s3:GetObject,s3:PutObject,s3:DeleteObject | All modules (backend state read/write) |
| KMS | kms:Decrypt,kms:Encrypt,kms:GenerateDataKey,kms:DescribeKey,kms:ScheduleKeyDeletion | S3 backend (SSE-KMS), module 00 destroy |
| EKS | eks:DescribeCluster,eks:DeleteCluster,eks:DeleteNodegroup,eks:DeleteAddon,eks:DeleteAccessEntry,eks:DeletePodIdentityAssociation | Modules 02–05 |
| IAM | iam:DeleteRole,iam:DetachRolePolicy,iam:DeletePolicy,iam:DeleteInstanceProfile,iam:RemoveRoleFromInstanceProfile | Module 01 |
| EC2 | ec2:DeleteSecurityGroup,ec2:RevokeSecurityGroupIngress,ec2:RevokeSecurityGroupEgress,ec2:DeleteLaunchTemplate,ec2:DeleteTags,ec2:TerminateInstances | Modules 02, 03, Karpenter cleanup |
| EKS Kubernetes API | Cluster admin (AmazonEKSClusterAdminPolicy or equivalent) | Modules 04, 05 (Helm releases, storage classes, namespaces) |
Required tools
The following tools must be installed and available on the machine before proceeding with deletion:
tofu(OpenTofu)kubectl(configured with cluster context)awsCLIhelm
Cleaning up the EKS Resources
There are two ways to destroy all created resources, including the EKS cluster and related components.
| Method 1: Bootstrap script | Method 2: OpenTofu modules | |
|---|---|---|
| Approach | Automated, single command | Manual, module-by-module |
| Control | Fully automated; no per-stage visibility | Full control and visibility over each stage |
| Best for | Standard teardowns where speed is preferred | Troubleshooting, partial cleanup, or auditing each deletion step |
| Effort | Minimal | Higher; requires navigating each module directory |
Method 1: Using the bootstrap script
From the folder where bootstrap script is present, run the following command:
./bootstrap.sh --cloud aws destroy
Method 2: Using OpenTofu to delete all modules
This method displays how to delete a PPC cluster on AWS by destroying the OpenTofu modules in reverse order. Destroying modules one at a time gives full control and visibility over each stage.
Warning: This process is irreversible. All cluster resources, data, and backups stored in the S3 bucket will be permanently deleted.
The modules are located at:
~/iac/aws/cluster/modules/
├── 00_backup_bucket
├── 01_iam_roles
├── 02_eks_cluster
├── 03_node_group
├── 04_eks_addons
└── 05_helm_releases
These modules must be destroyed in reverse order: 05 → 04 → 03 → 02 → 01 → 00.
To delete the modules, perform the following steps:
- To delete the helm releases resource, perform the following steps:
# Navigate to 05_helm_releases directory
cd /iac/aws/cluster/modules/05_helm_releases
# Initialize providers
tofu init
# Delete the helm release
tofu destroy # type "yes" when prompted
- To delete the EKS Addons resource, run the following command.
# Navigate to 04_eks_addons directory
cd /iac/aws/cluster/modules/04_eks_addons
# Initialize providers
tofu init
# Delete the eks addons
tofu destroy # type "yes" when prompted
- To delete the Node Group resource, run the following command.
# Navigate to 03_node_group directory
cd /iac/aws/cluster/modules/03_node_group
# Initialize providers
tofu init
# Delete the node group
tofu destroy # type "yes" when prompted
- To delete the EKS Cluster resource, run the following command.
# Navigate to 02_eks_cluster directory
cd /iac/aws/cluster/modules/02_eks_cluster
# Initialize providers
tofu init
# Delete the eks cluster
tofu destroy # type "yes" when prompted
- To delete the IAM Roles resource, run the following command.
# Navigate to 01_iam_roles directory
cd /iac/aws/cluster/modules/01_iam_roles
# Initialize providers
tofu init
# Delete the iam roles
tofu destroy # type "yes" when prompted
- To delete the Backup Bucket (S3 + KMS) resource, perform the following steps.
# 1.Navigate to 00_backup_bucket directory
cd /iac/aws/cluster/modules/00_backup_bucket
# 2. Download the state file from S3 (synced there during install)
aws s3 cp \
s3://<bucket-name>/infrastructure-manifest/<cluster-name>/states/00_backup_bucket.tfstate \
./terraform.tfstate
# 3. Initialize providers
tofu init
# 4. Enable force_destroy on the bucket (updates only the flag)
tofu apply -var="force_destroy_bucket=true"
# 5. Destroy all resources
tofu destroy -var="force_destroy_bucket=true" # type "yes" when prompted
Note: After destroying all the modules, delete the CloudWatch Logs group created by EKS control plane logging using the following command.
aws logs delete-log-group \ --log-group-name "/aws/eks/<cluster-name>/cluster" \ --region <region>