EKS clusters endpoint public access should be restricted¶

EKS clusters endpoint with private access allows communication between your nodes and the API server stays within. This control is non-compliant if clusters endpoint public access is enabled as cluster API server is accessible from the internet.

How to fix¶

Attribute vpc_config[0].endpoint_public_access of aws_eks_cluster must be false.

Implementation options¶

Choose the option that matches how you manage Terraform. All options satisfy this control.

Option 1: Open source module (terraform-aws-modules)¶

If you use terraform-aws-modules/eks/aws, configure the required module inputs to satisfy this control. You can later migrate to the compliance.tf module with minimal changes because it is compatible by design.

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = ">=21.0.0"

  cluster_name = "abc123"
  subnet_ids   = ["subnet-abc123", "subnet-def456"]
  vpc_id       = "vpc-12345678"

  endpoint_public_access = false
}

Option 2: Terraform AWS provider resources¶

If you manage resources directly, configure the relevant Terraform AWS provider resources to meet this control. See docs for the resources involved: aws_eks_cluster.

resource "aws_eks_cluster" "this" {
  enabled_cluster_log_types = ["api", "audit", "authenticator", "controllerManager", "scheduler"]

  encryption_config {
    provider {
      key_arn = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
    }
    resources = ["secrets"]
  }

  name     = "pofix-example"
  role_arn = "arn:aws:iam::123456789012:role/example-role"

  vpc_config {
    endpoint_public_access = false
    subnet_ids             = ["subnet-abc123", "subnet-def456"]
  }
}

Tool mappings¶

Use these identifiers to cross-reference this control across tools, reports, and evidence.

• Compliance.tf (CTF) Control: eks_cluster_endpoint_public_access_restricted

• AWS Config Managed Rule: EKS_ENDPOINT_NO_PUBLIC_ACCESS

• Powerpipe Controls: aws_compliance.control.eks_cluster_endpoint_public_access_restricted, aws_compliance.control.eks_cluster_endpoint_restrict_public_access