Is it possible to add a control plane Security Group to an existing EKS cluster that was created by Pulumi Crosswalk (pulumi-eks)? It seems that the legacy library (aws/eks) could accept a

vpc_config

in which you can set the

security_group_ids

, but I was not able to find the same with Crosswalk... I tried messing with the underlying core.cluster object but was not successful.

You can attach additional security groups to EKS control plane only at cluster creation time via vpcConfig.securityGroupIds; you cannot mutate the control-plane SGs after the cluster is created. This is an AWS EKS limitation, not specific to Pulumi. Pulumi Crosswalk (pulumi-eks) doesn’t expose a post-create knob to add control-plane SGs because the underlying EKS API doesn’t support it.

I may have misunderstood your comment, But when I create an EKS cluster with the "core" aws.eks.Cluster object, I can later on modify the vpcConfig.securityGroupIds list with new Security Groups and it is applied successfully on the existing cluster... It is also possible to do it via the GUI by going to Network -> Manage -> VPC Resources, and adding SGs to the list of "Additional security groups".