Restrict EKS control plane endpoint access with private access and public CIDR allowlists

How it is checked

Audit method: Shell command

out=$(aws eks describe-cluster --name "${EKS_CLUSTER:?set EKS_CLUSTER}" --query 'cluster.resourcesVpcConfig.[endpointPrivateAccess,endpointPublicAccess,join(`
`,publicAccessCidrs || `[]`)]' --output text) || exit 1
set -- $out
priv=$1; pub=$2; cidrs=${3:-}
if [ "$priv" != True ]; then echo "noncompliant: endpointPrivateAccess=$priv"
elif [ "$pub" = True ] && { [ -z "$cidrs" ] || printf '%s' "$cidrs" | grep -q '0\.0\.0\.0/0'; }; then echo "noncompliant: public endpoint open to $cidrs"
else echo compliant; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

By enabling private endpoint access to the Kubernetes API server, all communication between your nodes and the API server stays within your VPC. You can also limit the IP addresses that can access your API server from the internet, or completely disable internet access to the API server. With this in mind, you can update your cluster accordingly using the AWS CLI to ensure that Private Endpoint Access is enabled. If you choose to also enable Public Endpoint Access then you should also configure a list of allowable CIDR blocks, resulting in restricted access from the internet. If you specify no CIDR blocks, then the public API server endpoint is able to receive and process requests from all IP addresses by defaulting to ['0.0.0.0/0'].

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target eks