[Enhancement] Add config options to EKS Node Group node_repair_config

[james0209]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

Description

Adds support for node auto repair configuration fields to the aws_eks_node_group resource's node_repair_config block.

New fields added to node_repair_config:

1. max_parallel_nodes_repaired_count (Optional, Integer, min: 1) - Conflicts with max_parallel_nodes_repaired_percentage.

2. max_parallel_nodes_repaired_percentage (Optional, Integer, 1-100) - Conflicts with max_parallel_nodes_repaired_count.

3. max_unhealthy_node_threshold_count (Optional, Integer, min: 1) - Conflicts with max_unhealthy_node_threshold_percentage.

4. max_unhealthy_node_threshold_percentage (Optional, Integer, 1-100) - Conflicts with max_unhealthy_node_threshold_count.

5. node_repair_config_overrides (Optional, List) - Each override block requires:

   • min_repair_wait_time_mins (Required, Integer, min: 1)
   • node_monitoring_condition (Required, String)
   • node_unhealthy_reason (Required, String)
   • repair_action (Required, String, Valid Values: "Replace" | "Reboot" | "NoAction")

Relations

Closes #44603

References

• https://docs.aws.amazon.com/eks/latest/APIReference/API_NodeRepairConfig.html
• https://docs.aws.amazon.com/eks/latest/APIReference/API_NodeRepairConfigOverrides.html
• https://docs.aws.amazon.com/eks/latest/userguide/node-health.html#node-auto-repair

Output from Acceptance Testing

➜  terraform-provider-aws git:(f-aws_eks_node_group_node_repair-extra-config) make testacc TESTS=TestAccEKSNodeGroup_nodeRepairConfig PKG=eks
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 f-aws_eks_node_group_node_repair-extra-config 🌿...
TF_ACC=1 go1.24.8 test ./internal/service/eks/... -v -count 1 -parallel 20 -run='TestAccEKSNodeGroup_nodeRepairConfig'  -timeout 360m -vet=off
2025/10/31 17:42:31 Creating Terraform AWS Provider (SDKv2-style)...
2025/10/31 17:42:31 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccEKSNodeGroup_nodeRepairConfig_basic
=== PAUSE TestAccEKSNodeGroup_nodeRepairConfig_basic
=== RUN   TestAccEKSNodeGroup_nodeRepairConfig_counts
=== PAUSE TestAccEKSNodeGroup_nodeRepairConfig_counts
=== RUN   TestAccEKSNodeGroup_nodeRepairConfig_percentages
=== PAUSE TestAccEKSNodeGroup_nodeRepairConfig_percentages
=== RUN   TestAccEKSNodeGroup_nodeRepairConfig_overrides
=== PAUSE TestAccEKSNodeGroup_nodeRepairConfig_overrides
=== CONT  TestAccEKSNodeGroup_nodeRepairConfig_basic
=== CONT  TestAccEKSNodeGroup_nodeRepairConfig_percentages
=== CONT  TestAccEKSNodeGroup_nodeRepairConfig_counts
=== CONT  TestAccEKSNodeGroup_nodeRepairConfig_overrides
--- PASS: TestAccEKSNodeGroup_nodeRepairConfig_basic (1250.10s)
--- PASS: TestAccEKSNodeGroup_nodeRepairConfig_counts (1320.04s)
--- PASS: TestAccEKSNodeGroup_nodeRepairConfig_percentages (1344.75s)
--- PASS: TestAccEKSNodeGroup_nodeRepairConfig_overrides (1358.13s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/eks        1358.277s

Snippets from describing the Nodepools created by the Acceptance Tests:

➜  ~ aws eks describe-nodegroup \
  --cluster-name tf-acc-test-<id> \
  --nodegroup-name tf-acc-test-<id>

# TestAccEKSNodeGroup_nodeRepairConfig_counts
        "nodeRepairConfig": {
            "enabled": true,
            "maxUnhealthyNodeThresholdCount": 3,
            "maxParallelNodesRepairedCount": 2
        },

# TestAccEKSNodeGroup_nodeRepairConfig_basic
        "nodeRepairConfig": {
            "enabled": true
        },

# TestAccEKSNodeGroup_nodeRepairConfig_overrides
        "nodeRepairConfig": {
            "enabled": true,
            "nodeRepairConfigOverrides": [
                {
                    "nodeMonitoringCondition": "NodeNotReady",
                    "nodeUnhealthyReason": "NetworkUnavailable",
                    "minRepairWaitTimeMins": 30,
                    "repairAction": "Replace"
                },
                {
                    "nodeMonitoringCondition": "NodeNotReady",
                    "nodeUnhealthyReason": "AutoScalingGroupNotFound",
                    "minRepairWaitTimeMins": 60,
                    "repairAction": "Reboot"
                }
            ]
        },

# TestAccEKSNodeGroup_nodeRepairConfig_percentages
        "nodeRepairConfig": {
            "enabled": true,
            "maxUnhealthyNodeThresholdPercentage": 40,
            "maxParallelNodesRepairedPercentage": 25
        },

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[gdavison]

Thanks for submitting this PR, @james0209

--- PASS: TestAccEKSNodeGroup_nodeRepairConfig_basic (1133.65s)
--- PASS: TestAccEKSNodeGroup_nodeRepairConfig_percentages (1217.76s)
--- PASS: TestAccEKSNodeGroup_nodeRepairConfig_overrides (1219.89s)
--- PASS: TestAccEKSNodeGroup_nodeRepairConfig_counts (1248.28s)

[github-actions]

Warning

This Issue has been closed, meaning that any additional comments are much easier for the maintainers to miss. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.