Enable private-only EKS control plane access and disable the public endpoint

AltaNível 1Automatizadaeks

Descrição

This recommendation is the strict private-only version of API endpoint hardening. The intended end state is that the Kubernetes API server is reachable only from inside the cluster VPC or from a connected private network, and there is no internet-reachable public API endpoint at all. This is a pure control-plane exposure decision. Requires the aws CLI with eks:DescribeCluster; the cluster comes from EKS_CLUSTER and the region from AWS_REGION/AWS_PROFILE.

Como é verificado

Método de auditoria: Comando shell

shell

out=$(aws eks describe-cluster --name "${EKS_CLUSTER:?set EKS_CLUSTER}" --query 'cluster.resourcesVpcConfig.[endpointPrivateAccess,endpointPublicAccess]' --output text) || exit 1
set -- $out
if [ "$1" = True ] && [ "$2" = False ]; then echo compliant; else echo "noncompliant: private=$1 public=$2"; fi

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

By enabling private endpoint access to the Kubernetes API server, all communication between your nodes and the API server stays within your VPC. With this in mind, you can update your cluster accordingly using the AWS CLI to ensure that Private Endpoint Access is enabled. For example, the following command would enable private access to the Kubernetes API and ensure that no public access is permitted: aws eks update-cluster-config \ --name $CLUSTER_NAME \ --region $REGION_CODE \ --resources-vpc-config endpointPrivateAccess=true,endpointPublicAccess=false Note: For more detailed information, see the EKS Cluster Endpoint documentation link in the references section.

Propriedades

Sistemas operacionais: Qualquer
Tags: eksmanaged-servicesnetwork
Referência: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 5.4.2 Enable private-only EKS control plane access and disable the public endpoint

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target eks