EKS cluster has private endpoint access enabled

Check ID: eks_cluster_private_nodes_enabled
Provider: AWS
Service: eks
Severity: HIGH
Categories: internet-exposed, trust-boundaries
Resource type: AwsEksCluster

What this check verifies

Amazon EKS cluster has private endpoint access enabled for the Kubernetes API server, allowing control plane traffic to use a VPC-resolved private endpoint. The check evaluates the cluster’s endpointPrivateAccess setting.

Risk

Without private endpoint access, the API server is exposed on the public internet. This expands attack surface and weakens confidentiality and integrity: stolen creds or mis-scoped CIDRs can enable unauthorized API calls, secret reads, pod deployments, and config changes. Availability also depends on internet egress, increasing failure modes.

Recommendation

Enable private endpoint access and disable or tightly restrict the public endpoint. Require administration from private networks, enforce least privilege with IAM/RBAC, and apply defense in depth via segmentation and logging. If external access is needed, allow only specific CIDRs and monitor API activity.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws eks update-cluster-config --region <REGION> --name <CLUSTER_NAME> --resources-vpc-config endpointPrivateAccess=true

# Terraform: Enable private endpoint access for an EKS cluster
resource "aws_eks_cluster" "<example_resource_name>" {
  name     = "<example_resource_name>"
  role_arn = "<example_resource_id>"

  vpc_config {
    subnet_ids              = ["<example_resource_id>"]
    endpoint_private_access = true  # Critical: enables private API endpoint access to pass the check
  }
}

# CloudFormation: Enable private endpoint access for an EKS cluster
Resources:
  <example_resource_name>:
    Type: AWS::EKS::Cluster
    Properties:
      RoleArn: <example_resource_id>
      ResourcesVpcConfig:
        SubnetIds:
          - <example_resource_id>
        EndpointPrivateAccess: true  # Critical: enables private endpoint access to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = eks_cluster_private_nodes_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

EKS cluster endpoint is not publicly accessible EKS cluster uses a supported Kubernetes version

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires