What AWS runs and what you run. The control plane (API servers and etcd across three AZs) lives in an AWS account; your nodes live in your VPC, reached through ENIs EKS places in your subnets. Switch the endpoint between public and private, lose an AZ, add Fargate, or press ▶ Guided tour.
EKS runs the Kubernetes control plane for you: at least two API servers and three etcd members spread across Availability Zones in an AWS-owned account, patched, scaled and backed up by AWS. It reaches into your VPC through elastic network interfaces it creates in your subnets; the API server uses them to talk to kubelets, and with private endpoint access your nodes and tools use them to reach the API without leaving the VPC. Public access exposes the API through a load balancer, ideally limited to known CIDRs. Your pods run on managed node groups (EC2 instances EKS keeps updated), on Fargate (a micro-VM per pod), or on nodes from Karpenter or EKS Auto Mode, and core components such as the VPC CNI, kube-proxy, CoreDNS and the EBS CSI driver are installed as managed add-ons.