Restrict EKS control plane endpoint access with private access and public CIDR allowlists

Cómo se verifica

Método de auditoría: Comando de shell

out=$(aws eks describe-cluster --name "${EKS_CLUSTER:?set EKS_CLUSTER}" --query 'cluster.resourcesVpcConfig.[endpointPrivateAccess,endpointPublicAccess,join(`
`,publicAccessCidrs || `[]`)]' --output text) || exit 1
set -- $out
priv=$1; pub=$2; cidrs=${3:-}
if [ "$priv" != True ]; then echo "noncompliant: endpointPrivateAccess=$priv"
elif [ "$pub" = True ] && { [ -z "$cidrs" ] || printf '%s' "$cidrs" | grep -q '0\.0\.0\.0/0'; }; then echo "noncompliant: public endpoint open to $cidrs"
else echo compliant; fi

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

By enabling private endpoint access to the Kubernetes API server, all communication between your nodes and the API server stays within your VPC. You can also limit the IP addresses that can access your API server from the internet, or completely disable internet access to the API server. With this in mind, you can update your cluster accordingly using the AWS CLI to ensure that Private Endpoint Access is enabled. If you choose to also enable Public Endpoint Access then you should also configure a list of allowable CIDR blocks, resulting in restricted access from the internet. If you specify no CIDR blocks, then the public API server endpoint is able to receive and process requests from all IP addresses by defaulting to ['0.0.0.0/0'].

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target eks