# Ensure EKS cluster has private endpoint access enabled - Source: https://support.icompaas.com/support/solutions/articles/a_1793292241802226-ensure-eks-cluster-has-private-endpoint-access-enabled - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every Amazon Elastic Kubernetes Service (EKS) cluster has private endpoint access enabled for its Kubernetes API server. With private access enabled, requests to the API server from within the cluster's VPC, such as from worker nodes, use a private endpoint that resolves to private IP addresses in the VPC. **Rationale** Without private endpoint access, all traffic to the Kubernetes API server, including traffic from the cluster's own nodes, must use the public endpoint on the Internet. This increases the attack surface: stolen credentials or overly broad allowed CIDR ranges can lead to unauthorized API calls, secret reads, malicious pod deployments and configuration changes. Private access should be enabled, and the public endpoint should be disabled or restricted to specific CIDR ranges, with administration done from private networks. **Impact** - Keeps node-to-control-plane traffic inside the VPC - Enabling private access alone does not remove public access; disabling the public endpoint or limiting its CIDR ranges is a separate change that may block administrators and tools outside the VPC - The VPC must have DNS hostnames and DNS resolution enabled for the private endpoint to resolve - The update takes several minutes to complete **Default Value** When a cluster is created through the EKS API or AWS CLI without specifying endpoint access, the public endpoint is enabled and private endpoint access is disabled. **Pre-Requisites** - IAM permissions: eks:ListClusters, eks:DescribeCluster and eks:UpdateClusterConfig - DNS hostnames and DNS resolution enabled on the cluster's VPC - If the public endpoint will be disabled, network access (VPN, AWS Direct Connect or a bastion host in the VPC) for administrators and CI/CD tools **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EKS console and select **Clusters**. 3. Open each cluster and select the **Networking** tab. 4. Check the **API server endpoint access** value. 5. Repeat for each region in use. 6. If the value is **Public**, follow the implementation steps. **CLI:** List the clusters in a region: aws eks list-clusters --region Show the endpoint access settings of a cluster: aws eks describe-cluster --name --region --query "cluster.resourcesVpcConfig.\[endpointPrivateAccess,endpointPublicAccess,publicAccessCidrs\]" A cluster fails if endpointPrivateAccess is false. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EKS console and select **Clusters**, then the cluster. 3. On the **Networking** tab, choose to manage the endpoint access. 4. Select **Public and private**, or **Private** if public access is not needed. 5. If public access remains enabled, restrict it to trusted CIDR ranges in the advanced settings. 6. Choose **Save changes**. 7. Repeat for each affected cluster in each region in use. **CLI:** Enable private endpoint access for a cluster: aws eks update-cluster-config --name --resources-vpc-config endpointPrivateAccess=true --region Check the progress of the update: aws eks describe-update --name --update-id --region **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EKS console and select the cluster. 3. On the **Networking** tab, choose to manage the endpoint access. 4. Select **Public**. 5. Choose **Save changes**. **CLI:** aws eks update-cluster-config --name --resources-vpc-config endpointPublicAccess=true,endpointPrivateAccess=false --region Note: rolling back sends all API server traffic, including traffic from the nodes, over the public endpoint again. **Reference** - [https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html) - [https://docs.aws.amazon.com/eks/latest/userguide/private-clusters.html](https://docs.aws.amazon.com/eks/latest/userguide/private-clusters.html) - [https://docs.aws.amazon.com/cli/latest/reference/eks/update-cluster-config.html](https://docs.aws.amazon.com/cli/latest/reference/eks/update-cluster-config.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.