EKS cluster API server endpoint should not be publicly accessible

What it checks

EKS cluster API server endpoint should not be publicly accessible

Where it applies

Terraform: aws_eks_cluster

CloudFormation: AWS::EKS::Cluster

How to fix it

1. Set endpoint_public_access = false and endpoint_private_access = true. Access the API from within the VPC via a bastion, VPN, or AWS Client VPN.
2. If public access is required (remote developers), restrict public_access_cidrs to your corporate IP ranges instead of 0.0.0.0/0.

Frameworks

• AWS FSBP EKS.1
• SOC 2 CC6.6
• PCI-DSS v4.0.1/1.4.4

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules