Back to Checks
aws

EKS cluster uses a supported Kubernetes version

eks_cluster_uses_a_supported_version
Service: eksSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:AwsEksCluster

Amazon EKS clusters use a supported Kubernetes version at or above the defined baseline (e.g., 1.28+). The evaluation compares each cluster's Kubernetes minor version to the minimum supported level and highlights clusters running below that baseline.

Prowler logoProwlerprowler-provider-aws

Risk

Running an unsupported Kubernetes version removes upstream and EKS security fixes, exposing clusters to known CVEs and privilege escalation bugs (confidentiality/integrity). Deprecated or removed APIs can break controllers and add-ons, causing outages (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks eks_cluster_uses_a_supported_version

Recommendation

Adopt a version management policy: keep clusters on a supported minor version, schedule regular upgrades, and test workloads for API deprecations. Upgrade nodes and add-ons with the control plane. Track EKS releases, automate drift alerts, and favor defense in depth over deprecated features.

Remediation

CLI

aws eks update-cluster-version --name <cluster_name> --kubernetes-version <supported_version>

Terraform

# Terraform: update EKS cluster to a supported Kubernetes version
resource "aws_eks_cluster" "<example_resource_name>" {
  name     = "<example_resource_name>"
  role_arn = "<example_role_arn>"

  version = "<supported_version>" # Critical: set a supported Kubernetes version to pass the check

  vpc_config {
    subnet_ids = ["<example_subnet_id>"]
  }
}

NativeIaC

# CloudFormation: update EKS cluster to a supported Kubernetes version
Resources:
  <example_resource_name>:
    Type: AWS::EKS::Cluster
    Properties:
      Name: <example_resource_name>
      RoleArn: <example_role_arn>
      ResourcesVpcConfig:
        SubnetIds: ["<example_subnet_id>"]
      Version: "<supported_version>"  # Critical: set a supported Kubernetes version to pass the check

Other

1Open the AWS Management Console and go to Amazon EKS
2Select your cluster (<cluster_name>)
3Click Update (or Edit) next to Kubernetes version
4Choose a supported version (>= required) and confirm the update
5Wait for the control plane update to complete

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.eks.eks_client import eks_client


class eks_cluster_uses_a_supported_version(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []

        eks_cluster_oldest_version_supported = eks_client.audit_config.get(
            "eks_cluster_oldest_version_supported", "1.28"
        )
        eks_version_major, eks_version_minor = map(
            int, eks_cluster_oldest_version_supported.split(".")
        )

        for cluster in eks_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)

            # Handle case where cluster.version might be None (edge case during cluster creation/deletion)
            if not cluster.version:
                continue

            cluster_version_major, cluster_version_minor = map(
                int, cluster.version.split(".")
            )

            if (cluster_version_major < eks_version_major) or (
                cluster_version_major == eks_version_major
                and cluster_version_minor < eks_version_minor
            ):
                report.status = "FAIL"
                report.status_extended = f"EKS cluster {cluster.name} is using version {cluster.version}. It should be one of the supported versions: {eks_cluster_oldest_version_supported} or higher."
            else:
                report.status = "PASS"
                report.status_extended = f"EKS cluster {cluster.name} is using version {cluster.version} that is supported by AWS."

            findings.append(report)

        return findings

References