EKS Cluster Endpoint Public Access

Sign in to the AWS Management Console.

Navigate to Amazon EKS console at https://console.aws.amazon.com/eks/.

In the main navigation panel, under Amazon Elastic Kubernetes Service, choose Clusters.

Click on the name (link) of the Amazon EKS cluster that you want to examine.

Select the Networking tab to access the networking settings available for the selected cluster.

Check the API server endpoint access and Public access source allowlist attributes to determine if the cluster endpoint is exposed to the Internet. If the API server endpoint access does NOT include Private (i.e., is set to Public only), or if Private endpoint access is not enabled, the cluster is non-compliant. Additionally, if the API server endpoint access is set to Public or Public and Private and the Public access source allowlist is set to 0.0.0.0/0 (open to all traffic), the selected Amazon EKS cluster API server endpoint is publicly accessible to any source address and prone to security risks.

Repeat steps no. 4 – 6 for each Amazon EKS cluster deployed within the current AWS region.

Change the AWS cloud region from the navigation bar and repeat the Audit process for other regions.

Run list-clusters command (OSX/Linux/UNIX) with custom query filters to list the names of all Amazon EKS clusters available in the selected AWS region:

aws eks list-clusters
	--region us-east-1
	--output table
	--query 'clusters'

The command output should return a table with the requested EKS cluster identifiers:

-------------------------
|     ListClusters      |
+-----------------------+
|  cc-eks-mobile-app    |
|  cc-eks-kube-stack    |
+-----------------------+

Run describe-cluster command (OSX/Linux/UNIX) using the name of the Amazon EKS cluster that you want to examine as the identifier parameter and custom query filters to describe the Kubernetes API server endpoint access configuration and public access allowlist values available for the selected cluster:

aws eks describe-cluster
	--region us-east-1
	--name cc-eks-mobile-app
	--query 'cluster.resourcesVpcConfig.{endpointPublicAccess: endpointPublicAccess, endpointPrivateAccess: endpointPrivateAccess, publicAccessCidrs: publicAccessCidrs}'

The command output should return the requested endpoint access configuration information:

{
	"endpointPublicAccess": true,
	"endpointPrivateAccess": false,
	"publicAccessCidrs": [
		"0.0.0.0/0"
	]
}

If the "endpointPrivateAccess" attribute value is set to false, or the "endpointPublicAccess" attribute value is set to true and the "publicAccessCidrs" attribute value includes "0.0.0.0/0", as shown in the output example above, the selected Amazon EKS cluster is non-compliant.

Repeat steps no. 3 and 4 for each Amazon EKS cluster deployed in the selected AWS region.

Change the AWS cloud region by updating the --region command parameter value and repeat the Audit process for other regions.

Sign in to the AWS Management Console.

Navigate to Amazon EKS console at https://console.aws.amazon.com/eks/.

In the main navigation panel, under Amazon Elastic Kubernetes Service, choose Clusters.

Click on the name (link) of the Amazon EKS cluster that you want to reconfigure.

Select the Networking tab and choose Manage networking to edit the networking configuration settings for the selected cluster.

For Cluster endpoint access, choose one of the following options:

1. Select Private to ensure that the cluster endpoint access and worker node traffic stays within your VPC only, thus minimizing the security risks. Enabling private endpoint access is mandatory for CIS Amazon EKS Benchmark v1.8.0 (5.4.1) compliance (Recommended). Choose Save changes to apply the changes.
2. Select Public and private to enable the cluster endpoint public access from certain source addresses outside your VPC, but also retain worker node traffic inside your VPC. Choose Advanced settings and enter the specific source IP address(es) you wish to allow access. Ensure that you configure the rule settings to safelist your chosen source IP address(es) on your Trend Cloud One™ – Conformity account console. Choose Save changes to apply the changes.
3. While not recommended, if your use case requires to allow public access to specific source addresses and direct work node traffic to a public endpoint, select Public. Choose Advanced settings and enter the specific source IP address(es) you wish to allow access. Ensure that you configure the rule settings to safelist your chosen source IP address(es) on your Conformity account console. Choose Save changes to apply the changes.

Repeat steps no. 4 – 6 for each Amazon EKS cluster available within the current AWS region.

Change the AWS cloud region from the navigation bar and repeat the Remediation process for other regions.

Run update-cluster-config command (OSX/Linux/UNIX) using the name of the Amazon EKS cluster that you want to reconfigure as the identifier parameter, to disable the public access for the selected EKS cluster Kubernetes API server endpoint and enable private access so that the API server can be accessed only from within your VPC:

aws eks update-cluster-config
	--region us-east-1
	--name cc-eks-mobile-app
	--resources-vpc-config endpointPublicAccess=false,endpointPrivateAccess=true,publicAccessCidrs=["123.123.123.123/32"]

The command output should return the information available for the new API server endpoint access configuration:

{
	"update": {
		"status": "InProgress",
		"errors": [],
		"params": [
			{
				"type": "EndpointPublicAccess",
				"value": "false"
			},
			{
				"type": "EndpointPrivateAccess",
				"value": "true"
			},
			{
				"type": "PublicAccessCidrs",
				"value": "[\"123.123.123.123/32\"]"
			}
		],
		"type": "EndpointAccessUpdate",
		"id": "abcd1234-abcd-abcd-abcd-1234abcd1234",
		"createdAt": 1567589177.445
	}
}

Run describe-update command (OSX/Linux/UNIX) to confirm the configuration changes performed at the previous step. The EKS cluster API server endpoint access configuration update is complete when the update process status is set to "Successful":

aws eks describe-update
	--region us-east-1
	--name cc-eks-mobile-app
	--update-id abcd1234-abcd-abcd-abcd-1234abcd1234
	--query 'update.status'

The command output should return the requested update status:

"Successful"

Repeat steps no. 1 – 4 for each Amazon EKS cluster available in the selected AWS region.

Change the AWS cloud region by updating the --region command parameter value and repeat the Remediation process for other regions.