Back to Checks
alibabacloud

Kubernetes cluster is created with private cluster enabled

cs_kubernetes_private_cluster_enabled
Service: csSeverity: medium
OfficialBuilt-inVerified
Categories:cluster-security
Resource Type:ALIYUN::CS::ManagedKubernetesCluster

Alibaba Cloud Kubernetes Engine clusters should be configured as private clusters so the API server endpoint is not publicly accessible. In a private cluster, nodes lack public IPs and all node-to-master communication occurs through VPC peering. This reduces the attack surface by eliminating direct internet exposure of the control plane and worker nodes.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

A public API server endpoint allows attackers to probe for vulnerabilities, perform brute force attacks, or exploit misconfigurations. Automated scanners and botnets can target it, increasing risk of unauthorized access. This impacts confidentiality and integrity by potentially allowing attackers to execute commands, deploy malicious workloads, or exfiltrate data.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks cs_kubernetes_private_cluster_enabled

Recommendation

Disable Public Access during cluster creation to ensure the API server is not exposed to the public internet. For existing clusters, remove the public endpoint if one was configured.

Remediation

CLI

aliyun cs GET /clusters/<cluster_id> --header 'Content-Type=application/json' | jq '.external_loadbalancer_id'

Other

1Log on to the **ACK Console**.
2Select the target cluster name and go to the cluster detail page.
3Check if there is no `API Server Public Network Endpoint` under Cluster Information.
4When creating a new cluster, make sure **Public Access** is not enabled.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.cs.cs_client import cs_client


class cs_kubernetes_private_cluster_enabled(Check):
    """Check if Kubernetes Cluster is created with Private cluster enabled."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for cluster in cs_client.clusters:
            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource=cluster)
            report.region = cluster.region
            report.resource_id = cluster.id
            report.resource_arn = f"acs:cs:{cluster.region}:{cs_client.audited_account}:cluster/{cluster.id}"

            if cluster.private_cluster_enabled:
                report.status = "PASS"
                report.status_extended = f"Kubernetes cluster {cluster.name} is a private cluster (no public API endpoint)."
            else:
                report.status = "FAIL"
                report.status_extended = f"Kubernetes cluster {cluster.name} has a public API endpoint exposed."

            findings.append(report)

        return findings

References