Unable to create EKS cluster via AWS CLI

While the suggestions regarding trailing spaces and backslashes are decent general CLI troubleshooting steps, they miss the actual syntax and configuration errors causing this behavior. The reason the AWS CLI abruptly exits and only prints its version information is due to a fatal parsing error in your command arguments.

There are two distinct issues with your AWS CLI command that do not exist in your working Python script:

1. Broken Shorthand Syntax for Complex Object Arrays

When passing multiple key-value arrays (like combining both subnetIds and securityGroupIds) inside --resources-vpc-config, the AWS CLI parser requires explicit syntax delimiters.

• Commas (,) are used to separate items within the same list (e.g., multiple subnets).
• Semicolons (;) and wrapping quotes must be used to separate different keys (e.g., separating subnets from security groups).

Because your command used a comma before securityGroupIds=, the CLI incorrectly tried to parse your Security Group ID as a fifth subnet, causing the parser to fail entirely.

2. Unsupported EKS Version String

In your successful Python script, you targeted --version 1.33. However, in your CLI command, you specified --version 1.35. Amazon EKS does not support a version 1.35 yet. When the CLI encounters an invalid version token alongside unquoted or broken string parsing issues, it frequently misinterprets the input and falls back to displaying the CLI binary version string instead of throwing a structured API validation error.

Corrected CLI Command

Switch to a supported EKS version (e.g., 1.32 or 1.33 depending on your requirements) and pass the VPC configuration as a clean JSON string. This avoids brittle shell shorthand syntax parsing entirely:

aws eks create-cluster \
  --name css-bru-test \
  --version 1.32 \
  --region us-east-1 \
  --role-arn arn:aws:iam::000000000000:role/css-bru-prod-eks-cluster-role \
  --resources-vpc-config '{"subnetIds":["subnet-00f4d29a4c28fe257","subnet-026daab78111b72a9","subnet-0832cfe0f58dd614d","subnet-0ad74c7091580c76d"],"securityGroupIds":["sg-0476ccdb01c3bce1b"]}' \
  --output json

Hello.

I was checking the syntax of the AWS CLI's "create-cluster" command, and I noticed that the "--kubernetes-version" option is used to specify the Kubernetes version.
https://docs.aws.amazon.com/cli/latest/reference/eks/create-cluster.html

--kubernetes-version (string)
The desired Kubernetes version for your cluster. If you don’t specify a value here, the default version available in Amazon EKS is used.
Note The default version might not be the latest version available.

Therefore, please modify the command as follows:
I checked my AWS account and confirmed that a cluster can be created using "--kubernetes-version".

aws eks create-cluster \
  --name css-bru-test \
  --kubernetes-version 1.35 \
  --region us-east-1 \
  --role-arn arn:aws:iam::000000000000:role/css-bru-prod-eks-cluster-role \
  --resources-vpc-config subnetIds=subnet-00f4d29a4c28fe257,subnet-026daab78111b72a9,subnet-0832cfe0f58dd614d,subnet-0ad74c7091580c76d,securityGroupIds=sg-0476ccdb01c3bce1b \
  --output json

Incidentally, please note that the "--version" option in the AWS CLI is an option to display the AWS CLI version.
https://docs.aws.amazon.com/cli/latest/reference/eks/create-cluster.html#:~:text=config/env%20settings.-,%2D%2Dversion,-(string)

--version (string)
Display the version of this tool.

The behavior you're experiencing appears to be related to how the AWS CLI is interpreting your command rather than an authentication or permissions issue. Since the Python boto3 code works successfully, this confirms that your IAM credentials and the cluster configuration itself are valid.

The issue is likely caused by the --output json parameter placement or how the CLI is parsing your multi-line command. When you see only the CLI version being printed, it often indicates that the CLI is interpreting your command as a request for version information rather than executing the actual create-cluster command.

Here are some troubleshooting steps:

1. Try removing the --output json flag or place it immediately after the aws eks create-cluster command before other parameters.

2. Ensure proper line continuation: When using backslashes for multi-line commands, make sure there are no trailing spaces after the backslashes, as this can cause the command to be interpreted incorrectly.

3. Try running the command as a single line to eliminate any line continuation issues:

aws eks create-cluster --name css-bru-test --version 1.35 --region us-east-1 --role-arn arn:aws:iam::000000000000:role/css-bru-prod-eks-cluster-role --resources-vpc-config subnetIds=subnet-00f4d29a4c28fe257,subnet-026daab78111b72a9,subnet-0832cfe0f58dd614d,subnet-0ad74c7091580c76d,securityGroupIds=sg-0476ccdb01c3bce1b

4. Verify your AWS CLI configuration by running:

aws sts get-caller-identity

This will confirm your credentials are properly configured.

Since your Python script works, you can also consider using the AWS CLI with the --debug flag to see detailed information about what's happening during command execution, which may reveal parsing or interpretation issues.
Sources
Troubleshot IAM role issues in Amazon EKS | AWS re:Post