Description

Ensure that every Amazon Elastic Kubernetes Service (EKS) cluster has private endpoint access enabled for its Kubernetes API server. With private access enabled, requests to the API server from within the cluster's VPC, such as from worker nodes, use a private endpoint that resolves to private IP addresses in the VPC.

Rationale

Without private endpoint access, all traffic to the Kubernetes API server, including traffic from the cluster's own nodes, must use the public endpoint on the Internet. This increases the attack surface: stolen credentials or overly broad allowed CIDR ranges can lead to unauthorized API calls, secret reads, malicious pod deployments and configuration changes. Private access should be enabled, and the public endpoint should be disabled or restricted to specific CIDR ranges, with administration done from private networks.

Impact

  • Keeps node-to-control-plane traffic inside the VPC

  • Enabling private access alone does not remove public access; disabling the public endpoint or limiting its CIDR ranges is a separate change that may block administrators and tools outside the VPC

  • The VPC must have DNS hostnames and DNS resolution enabled for the private endpoint to resolve

  • The update takes several minutes to complete

Default Value

When a cluster is created through the EKS API or AWS CLI without specifying endpoint access, the public endpoint is enabled and private endpoint access is disabled.

Pre-Requisites

  • IAM permissions: eks:ListClusters, eks:DescribeCluster and eks:UpdateClusterConfig

  • DNS hostnames and DNS resolution enabled on the cluster's VPC

  • If the public endpoint will be disabled, network access (VPN, AWS Direct Connect or a bastion host in the VPC) for administrators and CI/CD tools

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EKS console and select Clusters.

  3. Open each cluster and select the Networking tab.

  4. Check the API server endpoint access value.

  5. Repeat for each region in use.

  6. If the value is Public, follow the implementation steps.

CLI:

List the clusters in a region:

aws eks list-clusters --region <REGION>

Show the endpoint access settings of a cluster:

aws eks describe-cluster --name <CLUSTER_NAME> --region <REGION> --query "cluster.resourcesVpcConfig.[endpointPrivateAccess,endpointPublicAccess,publicAccessCidrs]"

A cluster fails if endpointPrivateAccess is false.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EKS console and select Clusters, then the cluster.

  3. On the Networking tab, choose to manage the endpoint access.

  4. Select Public and private, or Private if public access is not needed.

  5. If public access remains enabled, restrict it to trusted CIDR ranges in the advanced settings.

  6. Choose Save changes.

  7. Repeat for each affected cluster in each region in use.

CLI:

Enable private endpoint access for a cluster:

aws eks update-cluster-config --name <CLUSTER_NAME> --resources-vpc-config endpointPrivateAccess=true --region <REGION>

Check the progress of the update:

aws eks describe-update --name <CLUSTER_NAME> --update-id <UPDATE_ID> --region <REGION>

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EKS console and select the cluster.

  3. On the Networking tab, choose to manage the endpoint access.

  4. Select Public.

  5. Choose Save changes.

CLI:

aws eks update-cluster-config --name <CLUSTER_NAME> --resources-vpc-config endpointPublicAccess=true,endpointPrivateAccess=false --region <REGION>

Note: rolling back sends all API server traffic, including traffic from the nodes, over the public endpoint again.

Reference