# Ensure EKS Cluster Has Private Endpoint Access Enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890035013166-ensure-eks-cluster-has-private-endpoint-access-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Amazon EKS clusters have the private API server endpoint enabled (endpointPrivateAccess), so that Kubernetes API requests originating from within the cluster's VPC are routed privately, and, where appropriate, that public endpoint access is disabled or restricted to specific trusted CIDR ranges.

**Rationale**

By default, or if misconfigured, the EKS Kubernetes API server endpoint may be reachable over the public internet, meaning that anyone who obtains valid cluster credentials (for example, through a leaked kubeconfig or compromised IAM identity) could potentially reach the API server from anywhere. Enabling private endpoint access ensures in-VPC traffic (including from worker nodes) uses AWS's private network path, and combined with disabling or restricting public access, significantly reduces the cluster control plane's exposure to the internet.

**Impact**

-   Reduces exposure of the Kubernetes API server to the public internet
    
-   Ensures in-VPC and on-premises (via Direct Connect/VPN) traffic can reach the API server privately
    
-   Fully private clusters require careful network planning (VPN, Direct Connect, or a bastion/jump host) for administrators who need to manage the cluster from outside the VPC
    

**Default Value**

By default, newly created EKS clusters have the public endpoint enabled and accessible from 0.0.0.0/0, with the private endpoint disabled unless explicitly configured otherwise at creation.

**Pre-Requisites**

-   VPC connectivity (VPN, Direct Connect, bastion host, or similar) for administrators who need to reach a fully private cluster from outside the VPC
    
-   IAM permissions to update cluster VPC configuration (eks:UpdateClusterConfig)
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon EKS > Clusters and select the cluster to review.
    
3.  Open the Networking tab.
    
4.  Verify that Private access shows as Enabled.
    
5.  Review Public access and, if enabled, verify it is restricted to specific, documented CIDR ranges rather than 0.0.0.0/0, unless a fully public endpoint is explicitly required and approved.
    
6.  If private access is disabled, or public access is unrestricted without justification, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon EKS > Clusters and select the cluster to update.
    
3.  Open the Networking tab and select Manage endpoint access.
    
4.  Enable Private access.
    
5.  If restricting public access, add specific, approved CIDR ranges under Advanced settings, or disable Public access entirely if no external access is required.
    
6.  Save the changes and verify existing worker nodes and administrators can still reach the API server as expected before removing broader access entirely.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon EKS > Clusters and select the affected cluster.
    
3.  Open the Networking tab and select Manage endpoint access.
    
4.  Disable Private access and/or restore Public access to 0.0.0.0/0, if reverting is required.
    
5.  Save the changes.
    

**Reference**

-   [https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.