Unable to add a security group to eks_managed_node_group launch template

[tm-nadavsh]

Description

when creating an eks cluster with version 20.8.5, if trying to add an extra security group to the managed_node_group it does not add it

• ✋ I have searched the open/closed issues and my issue is not listed.

⚠️ Note

Before you submit an issue, please perform the following first:

1. Remove the local .terraform directory (! ONLY if state is stored remotely, which hopefully you are following that best practice!): rm -rf .terraform/
2. Re-initialize the project root to pull down modules: terraform init
3. Re-attempt your terraform plan or apply and check if the issue still persists

Versions

• Module version [Required]:

• Terraform version:

• Provider version(s):

Reproduction Code [Required]

Steps to reproduce the behavior:

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "20.8.5"

  cluster_name    = var.cluster_name
  cluster_version = var.cluster_version

  cluster_endpoint_public_access           = true
  cluster_endpoint_private_access          = true
  enable_irsa                              = true
  create_kms_key                           = true
  enable_cluster_creator_admin_permissions = true

  vpc_id                        = var.vpc_id
  subnet_ids                    = values(aws_subnet.eks_subnets)[*].id
  create_node_security_group    = false
  create_cluster_security_group = false
  cluster_security_group_id     = aws_security_group.eks_control_plane.id
  node_security_group_id        = aws_security_group.eks_managed_nodes_sg.id

  eks_managed_node_group_defaults = {
    vpc_security_group_ids = [aws_security_group.eks_managed_nodes_sg.id]
  }
  node_security_group_id = aws_security_group.eks_control_plane.id
  eks_managed_node_groups = {
    on-demand = {

      use_custom_launch_template            = false
      min_size                              = 1
      max_size                              = 1
      desired_size                          = 1
      ami_type                              = "AL2_ARM_64"
      instance_types                        = ["t4g.small"]
      capacity_type                         = "ON_DEMAND"
      remote_access = {
        ec2_ssh_key               = aws_key_pair.kp.key_name
        source_security_group_ids = [aws_security_group.remote_access.id]
      }
    }
  }

Expected behavior

security group will be added to the launch template as seen in the terraform module eks-managed-node-group
my code:

create_node_security_group    = false
node_security_group_id = aws_security_group.eks_managed_nodes_sg.id

eks node_group.tf code:

  locals:
  create_node_sg = var.create && var.create_node_security_group
  node_security_group_id = local.create_node_sg ? aws_security_group.node[0].id : var.node_security_group_id
  module "eks_managed_node_group" {
  
  vpc_security_group_ids            = compact(concat([local.node_security_group_id], try(each.value.vpc_security_group_ids, 
  var.eks_managed_node_group_defaults.vpc_security_group_ids, [])))
}

Actual behavior

security group is not added

Terminal Output Screenshot(s)

Additional context

[bryantbiggs]

please see the docs and also double check your code - node_security_group_id is specified twice which is incorrect, and you cannot modify security groups when you disable the use of the custom launch template