Restrict EKS control plane endpoint access with private access and public CIDR allowlists

Kako se proverava

Metod provere: Komanda ljuske

out=$(aws eks describe-cluster --name "${EKS_CLUSTER:?set EKS_CLUSTER}" --query 'cluster.resourcesVpcConfig.[endpointPrivateAccess,endpointPublicAccess,join(`
`,publicAccessCidrs || `[]`)]' --output text) || exit 1
set -- $out
priv=$1; pub=$2; cidrs=${3:-}
if [ "$priv" != True ]; then echo "noncompliant: endpointPrivateAccess=$priv"
elif [ "$pub" = True ] && { [ -z "$cidrs" ] || printf '%s' "$cidrs" | grep -q '0\.0\.0\.0/0'; }; then echo "noncompliant: public endpoint open to $cidrs"
else echo compliant; fi

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

By enabling private endpoint access to the Kubernetes API server, all communication between your nodes and the API server stays within your VPC. You can also limit the IP addresses that can access your API server from the internet, or completely disable internet access to the API server. With this in mind, you can update your cluster accordingly using the AWS CLI to ensure that Private Endpoint Access is enabled. If you choose to also enable Public Endpoint Access then you should also configure a list of allowable CIDR blocks, resulting in restricted access from the internet. If you specify no CIDR blocks, then the public API server endpoint is able to receive and process requests from all IP addresses by defaulting to ['0.0.0.0/0'].

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target eks