🤖 chore: upgrade terraform eks versions and document backend ref

Author: ThomasK33

AGENTS.md

@@ -44,6 +44,15 @@ You are an experienced, pragmatic software engineering AI agent. Do not over-eng
 - `vendor/`: checked-in module dependencies (required by project workflow).
 - `.mux/skills/coder-docs/`: Mux agent skill with offline coder/coder docs snapshot (update: `make update-coder-docs-skill`).
 
+### Terraform Backend Reference (Agents)
+- Keep Terraform backend values out of committed `.tf` code beyond shared backend settings in `terraform/versions.tf`.
+- Shared sandbox EKS state location:
+  - S3 bucket: `coder-k8s-tfstate-112158171837`
+  - State key: `terraform-ncp3/sandbox-eks/terraform.tfstate`
+- Initialize Terraform against that backend with explicit config flags (example):
+  - `nix develop -c terraform -chdir=terraform init -reconfigure -backend-config="bucket=coder-k8s-tfstate-112158171837" -backend-config="key=terraform-ncp3/sandbox-eks/terraform.tfstate"`
+- When AWS CLI access is needed, run commands through the Nix dev shell (`nix develop -c ...`).
+
 ### Architecture notes
 - `main` delegates to `run(...)`, which requires `--app=<controller|aggregated-apiserver>`.
 - `controller` mode registers core Kubernetes + `coder.com/v1alpha1` schemes, starts the controller-runtime manager, and wires health/readiness probes.

terraform/.terraform.lock.hcl

@@ -10,7 +10,7 @@ This directory provisions a cost-optimized Amazon EKS sandbox cluster in region
   - Internet Gateway
   - Single NAT Gateway (lower cost than one per AZ)
 - IAM roles for EKS control plane and worker nodes
-- EKS cluster (`sandbox-eks`, Kubernetes `1.31`) with public and private API endpoint access
+- EKS cluster (`sandbox-eks`, Kubernetes `1.35`) with public and private API endpoint access
 - One managed node group:
   - Instance type: `t3.medium`
   - Desired/min/max size: `2/1/3`
@@ -21,7 +21,7 @@ This directory provisions a cost-optimized Amazon EKS sandbox cluster in region
 
 ## Prerequisites
 
-- Terraform `>= 1.11`
+- Terraform `>= 1.14`
 - AWS CLI v2 installed
 - AWS identity with permissions to create VPC, IAM, EKS, and EC2 resources in your target account
 

terraform/README.md

@@ -19,7 +19,7 @@ variable "cluster_name" {
 variable "cluster_version" {
   description = "Kubernetes version for the EKS control plane."
   type        = string
-  default     = "1.31"
+  default     = "1.35"
 }
 
 variable "vpc_cidr" {

terraform/variables.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.11"
+  required_version = ">= 1.14"
 
   backend "s3" {
     region       = "eu-central-1"
@@ -11,7 +11,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 5.0"
+      version = "~> 6.0"
     }
   }
 }