Automate Kubernetes version monitoring and upgrades with Amazon EKS Auto Mode

AWSTemplateFormatVersion: '2010-09-09'
Description: 'EKS Version Checker and Upgrade Using Lambda with EventBridge Scheduler'

Parameters:
NotificationEmail:
Type: String
Description: Email address to receive EKS upgrade notifications
EnableAutoUpgrade:
Type: String
AllowedValues: ['true', 'false']
Default: 'false'
Description: Enable automatic upgrades for development clusters

Resources:
LambdaExecutionRole:
Type: AWS::IAM::Role
DeletionPolicy: Delete
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: lambda.amazonaws.com
Action: sts:AssumeRole
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
Policies:
- PolicyName: EKSReadAccess
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- eks:DescribeCluster
- eks:ListClusters
- eks:DescribeClusterVersions
- eks:UpdateClusterVersion
- eks:ListInsights
- sns:Publish
Resource: '*'

EKSVersionCheckerFunction:
Type: AWS::Lambda::Function
DeletionPolicy: Delete
Properties:
FunctionName: eks-version-checker
Runtime: python3.11
Handler: index.lambda_handler
Role: !GetAtt LambdaExecutionRole.Arn
Timeout: 120
Environment:
Variables:
CLUSTER_NAME: !Ref ClusterName
SNS_TOPIC_ARN: !Ref EKSUpgradeNotificationTopic
Code:
ZipFile: |
import boto3
import os

def lambda_handler(event, context):
eks = boto3.client('eks')
sns = boto3.client('sns')
sns_topic_arn = os.environ['SNS_TOPIC_ARN']

clusters = eks.list_clusters()['clusters']
latest_version = eks.describe_cluster_versions()['clusterVersions'][0]['clusterVersion']

results = []

for cluster_name in clusters:
cluster_info = eks.describe_cluster(name=cluster_name)['cluster']
current_version = cluster_info['version']
tags = cluster_info.get('tags', {})

# Check if dev cluster
env = tags.get('Environment') or tags.get('environment') or tags.get('Env')
is_dev = (env and ('dev' in env.lower() or 'development' in env.lower())) or \
('dev' in cluster_name.lower() or 'development' in cluster_name.lower())

if not is_dev:
continue

if latest_version <= current_version:
results.append({'cluster': cluster_name, 'status': 'up_to_date'})
continue

# Check upgrade insights
insights = eks.list_insights(
clusterName=cluster_name,
filter={'categories': ['UPGRADE_READINESS']}
)

non_passing = [i for i in insights['insights'] if i['insightStatus']['status'] != 'PASSING']

if non_passing:
message = f"EKS cluster '{cluster_name}' upgrade blocked: {len(non_passing)} failing insights\nCurrent version: {current_version}\nLatest version: {latest_version}"
sns.publish(
TopicArn=sns_topic_arn,
Subject=f"EKS Cluster Upgrade Blocked due to Potential Issue - {cluster_name}",
Message=message
)
results.append({'cluster': cluster_name, 'status': 'blocked', 'issues': len(non_passing)})
continue

# Upgrade if enabled
if os.environ.get('ENABLE_AUTO_UPGRADE') == 'true':
eks.update_cluster_version(name=cluster_name, version=latest_version)
message = f"EKS cluster '{cluster_name}' upgrade initiated: {current_version} → {latest_version}"
sns.publish(
TopicArn=sns_topic_arn,
Subject=f"EKS Cluster Upgrade Initiated - {cluster_name}",
Message=message
)
results.append({'cluster': cluster_name, 'status': 'upgrading'})
else:
message = f"EKS cluster '{cluster_name}' upgrade available: {current_version} → {latest_version}"
sns.publish(
TopicArn=sns_topic_arn,
Subject=f"EKS Cluster Upgrade Available for {cluster_name}",
Message=message
)
results.append({'cluster': cluster_name, 'status': 'available'})

return {'statusCode': 200, 'body': {'processed_dev_clusters': results}}

SchedulerRole:
Type: AWS::IAM::Role
DeletionPolicy: Delete
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: scheduler.amazonaws.com
Action: sts:AssumeRole
Policies:
- PolicyName: InvokeLambda
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action: lambda:InvokeFunction
Resource: !GetAtt EKSVersionCheckerFunction.Arn

EKSUpgradeNotificationTopic:
Type: AWS::SNS::Topic
DeletionPolicy: Delete
Properties:
TopicName: eks-upgrade-notifications

EmailSubscription:
Type: AWS::SNS::Subscription
DeletionPolicy: Delete
Properties:
Protocol: email
TopicArn: !Ref EKSUpgradeNotificationTopic
Endpoint: !Ref NotificationEmail

DailySchedule:
Type: AWS::Scheduler::Schedule
DeletionPolicy: Delete
Properties:
Name: eks-version-checker-daily
ScheduleExpression: 'cron(0 0 * * ? *)'
FlexibleTimeWindow:
Mode: 'OFF'
Target:
Arn: !GetAtt EKSVersionCheckerFunction.Arn
RoleArn: !GetAtt SchedulerRole.Arn

Outputs:
LambdaFunctionArn:
Description: ARN of the EKS Version Checker Lambda function
Value: !GetAtt EKSVersionCheckerFunction.Arn
ScheduleName:
Description: Name of the EventBridge Schedule
Value: !Ref DailySchedule
SNSTopicArn:
Description: ARN of the SNS notification topic
Value: !Ref EKSUpgradeNotificationTopic