Enable private only EKS API access and disable public endpoint access

VisokaNivo 1Automatskaeks-auto

Opis

This recommendation is the strict private only version of API endpoint hardening. The intended end state is that the EKS Kubernetes API server endpoint is reachable only from inside the cluster VPC or from a connected private network, and there is no internet reachable public API endpoint. This is a Kubernetes API exposure decision, not an EKS Auto Mode workload networking setting. Requires the aws CLI with eks:DescribeCluster; the cluster comes from EKS_CLUSTER and the region from AWS_REGION/AWS_PROFILE.

Kako se proverava

Metod provere: Komanda ljuske

shell

out=$(aws eks describe-cluster --name "${EKS_CLUSTER:?set EKS_CLUSTER}" --query 'cluster.resourcesVpcConfig.[endpointPrivateAccess,endpointPublicAccess]' --output text) || exit 1
set -- $out
if [ "$1" = True ] && [ "$2" = False ]; then echo compliant; else echo "noncompliant: private=$1 public=$2"; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Enable private endpoint access and disable public endpoint access for the EKS Kubernetes API server. This removes direct internet reachability to the public API endpoint and requires cluster administration through the cluster VPC or a connected private network such as VPN, Transit Gateway, Direct Connect, or an approved management host inside the VPC. EKS allows public and private endpoint access to be configured separately, and the default for new clusters is public access enabled with private access disabled. Before applying this change, confirm that administrators, CI/CD runners, and operational tooling can reach the Kubernetes API through the private access path.

Svojstva

Operativni sistemi: Bilo koji
Oznake: eks-automanaged-servicesnetwork
Referenca: CIS Amazon Elastic Kubernetes Service (EKS) Auto Mode Benchmark v1.0.0 - 5.4.2 Enable private only EKS API access and disable public endpoint access

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target eks-auto