No Public Cluster Access To Cidr | Vulnerability Database

EKS cluster should not have open CIDR range for public access

EKS Clusters have public access cidrs set to 0.0.0.0/0 by default which is wide open to the internet. This should be explicitly set to a more specific private CIDR range

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Don’t enable public access to EKS Clusters

1
2
3
4
5
6
7
8


Resources:
  EKSCluster:
    Type: AWS::EKS::Cluster
    Properties:
      ResourcesVpcConfig:
        EndpointPublicAccess: false
        PublicAccessCidrs:
          - 10.2.0.0/8

Remediation Links

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-eks-cluster-resourcesvpcconfig.html

Don’t enable public access to EKS Clusters

1
2
3
4
5
6
7


resource "aws_eks_cluster" "good_example" {
  name = "good_example_cluster"
  vpc_config {
    endpoint_public_access = false
    public_access_cidrs    = ["0.0.0.0/0"]
  }
}

1
2
3
4
5
6
7


resource "aws_eks_cluster" "good_example" {
  name = "good_example_cluster"
  vpc_config {
    endpoint_public_access = true
    public_access_cidrs    = ["10.2.0.0/8"]
  }
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster#vpc_config