# Ensure EKS has No Public Endpoint Access

- Source: https://support.icompaas.com/support/solutions/articles/62000218692-ensure-eks-has-no-public-endpoint-access
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

Kubernetes is an open-source system for automating the deployment, scaling, and management of containerized applications. Elastic Kubernetes Service (EKS is a managed service that can run Kubernetes on AWS without installing, operating, and maintaining your own Kubernetes control plane or nodes.

  

## **Rationale:**

If endpoint public accessible from the internet it can access by anybody over the internet these type of cluster is more vulnerable, so avoid exposing private data and minimizing security risks. For security best practices we disable public access.

  

## **Impact:**

After making EKS not publicly accessible will reduce the malicious activities and attacks.

  

## **Default Value:**

By default, endpoint public access is enabled in EKS clusters and endpoint private access is disabled.

  

### **Pre-Requisite:**

-   Network configuration in EKS you must have a security group in aws do not assign default security group.  
    

  

## **Remediation:**

  

## **Test Plan:**

-   Login to AWS Management Console
    
-   Go to EKS dashboard at [https://console.aws.amazon.com/eks](https://console.aws.amazon.com/eks "https://console.aws.amazon.com/eks")
    
-   Choose a cluster you want to examine
    
-   Click on the Configuration tab
    
-   In configuration go to the Networking section
    
-   You see API server endpoint access is public or private in the Networking section  
    ![](https://support.icompaas.com/assets/kb/4dd0d862fbf10279.png)
    

  

**Using AWS  CLI:**

To check eks enable or disable endpoint access public or private

aws eks describe-cluster
  --region us-east-1
  --name <name of cluster>
  --query 'cluster.resourcesVpcConfig.{endpointPrivateAccess: endpointPrivateAccess, endpointPublicAccess: endpointPublicAccess}'

  

### **Implementation Steps:**

-   Login to AWS Management Console
    
-   Go to EKS dashboard at [https://console.aws.amazon.com/eks](https://console.aws.amazon.com/eks "https://console.aws.amazon.com/eks")
    
-   Choose a cluster to disable the public access
    
-   Click on the **Configuration** tab  
    ![](https://support.icompaas.com/assets/kb/473d918f038f79da.png)
    
-   In configuration go to the **Networking** section and click on **Manage Networking** to change API server endpoint access from public to private.  
    ![](https://support.icompaas.com/assets/kb/2c557baab4cd6d80.png)
    
-   In manage networking select the **Private** option and click on the **save changes** button.  
    ![](https://support.icompaas.com/assets/kb/f622a5cb3bbba3b7.png)
    
-   To save changes write the name of the Cluster in the name box and click on **Confirm** button  
    ![](https://support.icompaas.com/assets/kb/5782b2cdc09fa92d.png)
    

  

### **Using AWS CLI:**

To update cluster endpoint access

aws eks update-cluster-config --name <name of cluster> \\
--resources-vpc-config endpointPublicAccess=false,endpointPrivateAccess=true

  

## **Backout Plan:**

-   Login to AWS Management Console
    
-   Go to EKS dashboard at [https://console.aws.amazon.com/eks](https://console.aws.amazon.com/eks "https://console.aws.amazon.com/eks")
    
-   Choose a cluster
    
-   Click on the Configuration tab
    
-   In configuration go to the Networking section
    
-   Click on Manage Networking to change API server endpoint access change private to public. In manage, networking selects the Private option and click on the save changes button.  
    ![](https://support.icompaas.com/assets/kb/57888ea3d33811d6.png)
    
-   For confirmation in Cluster name box write the name of icompaasCluster and click on Confirm button
    

  

### **Using AWS CLI:**

To update cluster endpoint access

aws eks update-cluster-config --name <name of cluster> \\
--resources-vpc-config endpointPublicAccess=true,endpointPrivateAccess=false

  

## **Reference:**

1.  [![](https://support.icompaas.com/assets/kb/92dd35fa9a519697.png)](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html)[Amazon EKS cluster endpoint access control - Amazon EKS](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.