diff --git a/README.md b/README.md
index fb0b265..9ca9f01 100644
--- a/README.md
+++ b/README.md
@@ -99,10 +99,11 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no |
 | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no |
 | configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no |
-| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | list | `<list>` | no |
-| kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no |
-| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | map | `<map>` | no |
+| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume. ["-r", "MyEksRole"] | list | `<list>` | no |
+| kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials. | string | `heptio-authenticator-aws` | no |
+| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator. e.g. { AWS_PROFILE = "eks"} | map | `<map>` | no |
 | kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no |
+| manage_aws_auth | Whether to write and apply the aws-auth configmap file. | string | `true` | no |
 | subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes |
 | tags | A map of tags to add to all resources. | map | `<map>` | no |
 | vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes |
@@ -111,6 +112,7 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | worker_sg_ingress_from_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | string | `1025` | no |
 | workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `<map>` | no |
 | workstation_cidr | Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. | string | `` | no |
+| write_kubeconfig | Whether to write a kubeconfig file containing the cluster configuration | string | `true` | no |
 
 ## Outputs
 
@@ -126,4 +128,3 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | worker_iam_role_name | IAM role name attached to EKS workers |
 | worker_security_group_id | Security group ID attached to the EKS workers. |
 | workers_asg_arns | IDs of the autoscaling groups containing workers. |
-
diff --git a/aws_auth.tf b/aws_auth.tf
new file mode 100644
index 0000000..6038dc5
--- /dev/null
+++ b/aws_auth.tf
@@ -0,0 +1,17 @@
+resource "local_file" "config_map_aws_auth" {
+  content  = "${data.template_file.config_map_aws_auth.rendered}"
+  filename = "${var.config_output_path}/config-map-aws-auth.yaml"
+  count    = "${var.manage_aws_auth ? 1 : 0}"
+}
+
+resource "null_resource" "update_config_map_aws_auth" {
+  provisioner "local-exec" {
+    command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth.yaml --kubeconfig ${var.config_output_path}/kubeconfig"
+  }
+
+  triggers {
+    config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}"
+  }
+
+  count = "${var.manage_aws_auth ? 1 : 0}"
+}
diff --git a/kubectl.tf b/kubectl.tf
index 4c56a62..ec39963 100644
--- a/kubectl.tf
+++ b/kubectl.tf
@@ -1,24 +1,5 @@
 resource "local_file" "kubeconfig" {
   content  = "${data.template_file.kubeconfig.rendered}"
   filename = "${var.config_output_path}/kubeconfig_${var.cluster_name}"
-  count    = "${var.configure_kubectl_session ? 1 : 0}"
-}
-
-resource "local_file" "config_map_aws_auth" {
-  content  = "${data.template_file.config_map_aws_auth.rendered}"
-  filename = "${var.config_output_path}/config-map-aws-auth_${var.cluster_name}.yaml"
-  count    = "${var.configure_kubectl_session ? 1 : 0}"
-}
-
-resource "null_resource" "configure_kubectl" {
-  provisioner "local-exec" {
-    command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth_${var.cluster_name}.yaml --kubeconfig ${var.config_output_path}/kubeconfig_${var.cluster_name}"
-  }
-
-  triggers {
-    config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}"
-    kubeconfig_rendered = "${data.template_file.kubeconfig.rendered}"
-  }
-
-  count = "${var.configure_kubectl_session ? 1 : 0}"
+  count    = "${var.write_kubeconfig ? 1 : 0}"
 }
diff --git a/variables.tf b/variables.tf
index 63c09b7..35ccf90 100644
--- a/variables.tf
+++ b/variables.tf
@@ -22,8 +22,13 @@ variable "config_output_path" {
   default     = "./"
 }
 
-variable "configure_kubectl_session" {
-  description = "Configure the current session's kubectl to use the instantiated EKS cluster."
+variable "write_kubeconfig" {
+  description = "Whether to write a kubeconfig file containing the cluster configuration"
+  default     = true
+}
+
+variable "manage_aws_auth" {
+  description = "Whether to write and apply the aws-auth configmap file"
   default     = true
 }