Back to Checks
aws

EKS cluster endpoint is not publicly accessible from 0.0.0.0/0

eks_cluster_not_publicly_accessible
Service: eksSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedcluster-security
Resource Type:AwsEksCluster

Amazon EKS cluster API server endpoint is evaluated for unrestricted Internet access, specifically when the public endpoint permits connections from 0.0.0.0/0 instead of private access or limited CIDR ranges.

Prowler logoProwlerprowler-provider-aws

Risk

An openly reachable API endpoint enables Internet-wide probing, brute force, and enumeration, increasing exposure to RBAC misconfigurations or API flaws. Successful access can drive secret exfiltration (confidentiality), workload tampering (integrity), and control-plane disruption or scaling abuse (availability, cost).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks eks_cluster_not_publicly_accessible

Recommendation

Prefer private endpoint access and avoid broad exposure. If public access is required, restrict to trusted admin CIDRs (not 0.0.0.0/0), reach the API via VPN/Direct Connect or bastions, and enforce least privilege with IAM/RBAC. Apply defense in depth through network segmentation and continuous monitoring.

Remediation

CLI

aws eks update-cluster-config --region <region_name> --name <cluster_name> --resources-vpc-config endpointPublicAccess=false,endpointPrivateAccess=true

Terraform

# Terraform: Disable public endpoint and enable private endpoint
resource "aws_eks_cluster" "<example_resource_name>" {
  name     = "<example_resource_name>"
  role_arn = "<example_role_arn>"

  vpc_config {
    subnet_ids              = ["<example_subnet_id_1>", "<example_subnet_id_2>"]
    endpoint_public_access  = false  # critical: disables public API endpoint
    endpoint_private_access = true   # critical: enables private API endpoint
  }
}

NativeIaC

# CloudFormation: Disable public endpoint and enable private endpoint
Resources:
  <example_resource_name>:
    Type: AWS::EKS::Cluster
    Properties:
      RoleArn: <example_role_arn>
      ResourcesVpcConfig:
        SubnetIds:
          - <example_subnet_id_1>
          - <example_subnet_id_2>
        EndpointPublicAccess: false  # critical: disables public API endpoint
        EndpointPrivateAccess: true  # critical: enables private API endpoint

Other

1Open the Amazon EKS console
2Select your cluster
3Go to the Networking tab and click Manage endpoint access
4Enable Private access and Disable Public access
5Click Update/Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.eks.eks_client import eks_client


class eks_cluster_not_publicly_accessible(Check):
    def execute(self):
        findings = []
        for cluster in eks_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "PASS"
            report.status_extended = (
                f"EKS cluster {cluster.name} is not publicly accessible."
            )
            if (
                cluster.endpoint_public_access
                and "0.0.0.0/0" in cluster.public_access_cidrs
            ):
                report.status = "FAIL"
                report.status_extended = (
                    f"EKS cluster {cluster.name} is publicly accessible."
                )
            findings.append(report)

        return findings

References