EKS cluster endpoint is not publicly accessible

Check ID: eks_cluster_not_publicly_accessible
Provider: AWS
Service: eks
Severity: HIGH
Categories: internet-exposed, cluster-security
Resource type: AwsEksCluster

What this check verifies

Amazon EKS cluster API server endpoint is evaluated for unrestricted Internet access, specifically when the public endpoint permits connections from 0.0.0.0/0 instead of private access or limited CIDR ranges.

Risk

An openly reachable API endpoint enables Internet-wide probing, brute force, and enumeration, increasing exposure to RBAC misconfigurations or API flaws. Successful access can drive secret exfiltration (confidentiality), workload tampering (integrity), and control-plane disruption or scaling abuse (availability, cost).

Recommendation

Prefer private endpoint access and avoid broad exposure. If public access is required, restrict to trusted admin CIDRs (not 0.0.0.0/0), reach the API via VPN/Direct Connect or bastions, and enforce least privilege with IAM/RBAC. Apply defense in depth through network segmentation and continuous monitoring.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws eks update-cluster-config --region <region_name> --name <cluster_name> --resources-vpc-config endpointPublicAccess=false,endpointPrivateAccess=true

# Terraform: Disable public endpoint and enable private endpoint
resource "aws_eks_cluster" "<example_resource_name>" {
  name     = "<example_resource_name>"
  role_arn = "<example_role_arn>"

  vpc_config {
    subnet_ids              = ["<example_subnet_id_1>", "<example_subnet_id_2>"]
    endpoint_public_access  = false  # critical: disables public API endpoint
    endpoint_private_access = true   # critical: enables private API endpoint
  }
}

# CloudFormation: Disable public endpoint and enable private endpoint
Resources:
  <example_resource_name>:
    Type: AWS::EKS::Cluster
    Properties:
      RoleArn: <example_role_arn>
      ResourcesVpcConfig:
        SubnetIds:
          - <example_subnet_id_1>
          - <example_subnet_id_2>
        EndpointPublicAccess: false  # critical: disables public API endpoint
        EndpointPrivateAccess: true  # critical: enables private API endpoint

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = eks_cluster_not_publicly_accessible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

EKS cluster has network policy enabled EKS cluster has private endpoint access enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires