EKS cluster uses a supported Kubernetes version

Check ID: eks_cluster_uses_a_supported_version
Provider: AWS
Service: eks
Severity: HIGH
Categories: vulnerabilities
Resource type: AwsEksCluster

What this check verifies

Amazon EKS clusters use a supported Kubernetes version at or above the defined baseline (e.g., 1.28+). The evaluation compares each cluster’s Kubernetes minor version to the minimum supported level and highlights clusters running below that baseline.

Risk

Running an unsupported Kubernetes version removes upstream and EKS security fixes, exposing clusters to known CVEs and privilege escalation bugs (confidentiality/integrity). Deprecated or removed APIs can break controllers and add-ons, causing outages (availability).

Recommendation

Adopt a version management policy: keep clusters on a supported minor version, schedule regular upgrades, and test workloads for API deprecations. Upgrade nodes and add-ons with the control plane. Track EKS releases, automate drift alerts, and favor defense in depth over deprecated features.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws eks update-cluster-version —name <cluster_name> —kubernetes-version <supported_version>

# Terraform: update EKS cluster to a supported Kubernetes version
resource "aws_eks_cluster" "<example_resource_name>" {
  name     = "<example_resource_name>"
  role_arn = "<example_role_arn>"

  version = "<supported_version>" # Critical: set a supported Kubernetes version to pass the check

  vpc_config {
    subnet_ids = ["<example_subnet_id>"]
  }
}

# CloudFormation: update EKS cluster to a supported Kubernetes version
Resources:
  <example_resource_name>:
    Type: AWS::EKS::Cluster
    Properties:
      Name: <example_resource_name>
      RoleArn: <example_role_arn>
      ResourcesVpcConfig:
        SubnetIds: ["<example_subnet_id>"]
      Version: "<supported_version>"  # Critical: set a supported Kubernetes version to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = eks_cluster_uses_a_supported_version. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

EKS cluster has private endpoint access enabled EKS cluster has all control plane log types enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires