Back to Checks
aws

EKS cluster has private endpoint access enabled

eks_cluster_private_nodes_enabled
Service: eksSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedtrust-boundaries
Resource Type:AwsEksCluster

Amazon EKS cluster has private endpoint access enabled for the Kubernetes API server, allowing control plane traffic to use a VPC-resolved private endpoint.

The check evaluates the cluster's endpointPrivateAccess setting.

Prowler logoProwlerprowler-provider-aws

Risk

Without private endpoint access, the API server is exposed on the public internet. This expands attack surface and weakens confidentiality and integrity: stolen creds or mis-scoped CIDRs can enable unauthorized API calls, secret reads, pod deployments, and config changes. Availability also depends on internet egress, increasing failure modes.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks eks_cluster_private_nodes_enabled

Recommendation

Enable private endpoint access and disable or tightly restrict the public endpoint.

Require administration from private networks, enforce least privilege with IAM/RBAC, and apply defense in depth via segmentation and logging. If external access is needed, allow only specific CIDRs and monitor API activity.

Remediation

CLI

aws eks update-cluster-config --region <REGION> --name <CLUSTER_NAME> --resources-vpc-config endpointPrivateAccess=true

Terraform

# Terraform: Enable private endpoint access for an EKS cluster
resource "aws_eks_cluster" "<example_resource_name>" {
  name     = "<example_resource_name>"
  role_arn = "<example_resource_id>"

  vpc_config {
    subnet_ids              = ["<example_resource_id>"]
    endpoint_private_access = true  # Critical: enables private API endpoint access to pass the check
  }
}

NativeIaC

# CloudFormation: Enable private endpoint access for an EKS cluster
Resources:
  <example_resource_name>:
    Type: AWS::EKS::Cluster
    Properties:
      RoleArn: <example_resource_id>
      ResourcesVpcConfig:
        SubnetIds:
          - <example_resource_id>
        EndpointPrivateAccess: true  # Critical: enables private endpoint access to pass the check

Other

1In the AWS Console, open Amazon EKS and select your cluster
2Go to the Networking tab
3Click Edit next to Cluster endpoint access
4Enable Private access
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.eks.eks_client import eks_client


class eks_cluster_private_nodes_enabled(Check):
    def execute(self):
        findings = []
        for cluster in eks_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "PASS"
            report.status_extended = (
                f"EKS cluster {cluster.name} is created with private nodes."
            )
            if not cluster.endpoint_private_access:
                report.status = "FAIL"
                report.status_extended = f"Cluster endpoint private access is not enabled for EKS cluster {cluster.name}."
            findings.append(report)

        return findings

References