Restrict EKS control plane endpoint access with private access and public CIDR allowlists

So wird geprüft

Prüfmethode: Shell-Befehl

out=$(aws eks describe-cluster --name "${EKS_CLUSTER:?set EKS_CLUSTER}" --query 'cluster.resourcesVpcConfig.[endpointPrivateAccess,endpointPublicAccess,join(`
`,publicAccessCidrs || `[]`)]' --output text) || exit 1
set -- $out
priv=$1; pub=$2; cidrs=${3:-}
if [ "$priv" != True ]; then echo "noncompliant: endpointPrivateAccess=$priv"
elif [ "$pub" = True ] && { [ -z "$cidrs" ] || printf '%s' "$cidrs" | grep -q '0\.0\.0\.0/0'; }; then echo "noncompliant: public endpoint open to $cidrs"
else echo compliant; fi

Erwartete Ausgabe

compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

By enabling private endpoint access to the Kubernetes API server, all communication between your nodes and the API server stays within your VPC. You can also limit the IP addresses that can access your API server from the internet, or completely disable internet access to the API server. With this in mind, you can update your cluster accordingly using the AWS CLI to ensure that Private Endpoint Access is enabled. If you choose to also enable Public Endpoint Access then you should also configure a list of allowable CIDR blocks, resulting in restricted access from the internet. If you specify no CIDR blocks, then the public API server endpoint is able to receive and process requests from all IP addresses by defaulting to ['0.0.0.0/0'].

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

tmaegis scan --target eks