Set EKS node group desired size

For platform engineers deciding whether to apply eks_node_group_set_desired_size: what it changes, how to enable it, and how to check it worked.

Lets Terraform change a terraform-aws-eks managed node group's desired, min and max size after create, by calling aws eks update-nodegroup-config from terraform_data when the variables change.

What this rule does

Adds a lifecycle { ignore_changes = [...] } block to each matching resource. Terraform and OpenTofu will ignore external changes to the listed attributes on subsequent plans.

Ignored attributes: scaling_config[0].min_size, scaling_config[0].max_size

Affected resources

Before and after

Before (a module without the change):

resource "aws_eks_node_group" "this" {
  # ... resource configuration ...

  tags = var.tags
}

After (with Set EKS node group desired size applied):

resource "aws_eks_node_group" "this" {
  # ... resource configuration ...

  tags = var.tags

  lifecycle {
    ignore_changes = [scaling_config[0].min_size, scaling_config[0].max_size]
  }
}

The only change is the rule transformation. All existing arguments, outputs, and module behavior remain identical.

Why this rule exists

terraform-aws-eks ignores scaling_config[0].desired_size on purpose, so Cluster Autoscaler or Karpenter can own the node count. The other side of that choice: once a node group exists, changing desired_size plans no change, and raising min_size above the live desired size fails with InvalidParameterException: Minimum capacity 2 can't be greater than desired size 1.

The module FAQ points to eks-desired-size-hack, which runs aws eks update-nodegroup-config from a provisioner. This rule serves the same idea inside the module: it also ignores min_size and max_size on the node group resource, and adds two terraform_data resources that send the new sizes in one call when the variables change. Limits run first and keep the autoscaler's current desired size while it is still in range; the desired size is then sent on its own.

Limitations this rule answers

Per-module pages under Workarounds where this rule is the answer, each with the native workaround first and the diff the rule makes:

• EKS: Changing desired_size on an EKS node group does nothing, and raising min_size fails

Default configuration

This rule takes no parameters.

The HCL this rule is written in, with its parameters and the transformers it runs, is published at eks_node_group_set_desired_size.

How to enable

On a framework host, add the rule on top of your organization's Baseline with ?add_rules= in the HTTPS module source:

module "eks" {
  source = "https://soc2.compliance.tf/terraform-aws-modules/eks/aws?version=x.y.z&add_rules=eks_node_group_set_desired_size"
}

On your organization's host, an org admin adds the rule to the Baseline, which reaches every module served from that host, or to a named ruleset that a module selects with ?ruleset=:

module "eks" {
  source = "https://bobthecorp.compliance.tf/terraform-aws-modules/eks/aws?version=x.y.z&ruleset=<ruleset-name>"
}

Replace x.y.z with the release you use and bobthecorp with your organization's alias. Which parameters each host accepts, and which it refuses with a 400, is on Rulesets in the console.

How to check it worked

Read compliancetf-manifest.json in the module you received. Its entry for this rule carries an outcome: enforced means the change was made, not_applicable means nothing matched - no resource of a targeted type, or the module already carried the identical change. Do not infer enforcement from a successful terraform init; a rule that changes nothing also inits cleanly.

Known limits

• Managed node groups only. Self-managed node groups (desired_capacity on the Auto Scaling group) are out of scope.
• Applies only to modules shaped like terraform-aws-eks modules/eks-managed-node-group: aws_eks_node_group.this plus the create, min_size, max_size and desired_size variables. Anything else gets not_applicable.
• After enabling, Terraform no longer detects or reverts changes made outside it to min, max or desired size. It pushes a value only when the variable changes.
• Cannot be combined with provisioner_remove_blocks, which would strip the updater; the registry refuses the pair by name.
• Only .tf and .tofu files are read. Modules written in JSON syntax (.tf.json, .tofu.json) are left untouched.
• Only the module's own directory and its first-level modules/* submodules are processed. Modules that this module calls by source URL are separate downloads and are handled on their own request.
• Works with Terraform 1.x and OpenTofu 1.6 and later. The rule reads ordinary HCL, and anything it changes stays ordinary HCL.

Break-glass path

On a framework host, add ?rules=-eks_node_group_set_desired_size to the module source URL and run terraform init; the source changed, so Terraform installs a fresh copy without this rule. When you are done, remove the override and run terraform init again to restore it. On your organization's host the parameter is refused with a 400 rather than ignored. The rule comes from the organization's configuration: a Baseline rule applies to every module served from the bare organization form, so an admin disables it for the duration of the operation, or keeps it out of the Baseline and in a ruleset that only the modules needing it select. On a project environment the posture is the bound snapshot and its waivers. See Baseline rules and rulesets.

Failure modes

Related

• EKS workarounds
• Ignore scaling changes
• No provisioners
• Rulesets in the console - where an org admin adds this rule to the Baseline or a ruleset
• Rule catalog - every rule, with what each one changes