{
  "Provider": "aws",
  "CheckID": "eks_endpoints_not_publicly_accessible",
  "CheckTitle": "Ensure EKS Clusters are created with Private Endpoint Enabled and Public Access Disabled",
  "CheckType": [
    "Protect",
    "Secure network configuration",
    "Resources not publicly accessible"
  ],
  "ServiceName": "eks",
  "SubServiceName": "",
  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
  "Severity": "high",
  "ResourceType": "AwsEksCluster",
  "Description": "Ensure EKS Clusters are created with Private Endpoint Enabled and Public Access Disabled",
  "Risk": "Publicly accessible services could expose sensitive data to bad actors.",
  "RelatedUrl": "",
  "Remediation": {
    "Code": {
      "CLI": "aws eks update-cluster-config --region <region_name> --name <cluster_name> --resources-vpc-config endpointPublicAccess=false,endpointPrivateAccess=true,publicAccessCidrs=[\"123.123.123.123/32\"]",
      "NativeIaC": "",
      "Other": "https://github.com/cloudmatos/matos/tree/master/remediations/aws/eks/eks-disable-public-endpoint",
      "Terraform": ""
    },
    "Recommendation": {
      "Text": "Enable private access to the Kubernetes API server so that all communication between your nodes and the API server stays within your VPC. Disable internet access to the API server.",
      "Url": "https://docs.aws.amazon.com/eks/latest/userguide/infrastructure-security.html"
    }
  },
  "Categories": [
    "internet-exposed"
  ],
  "Tags": {
    "Tag1Key": "value",
    "Tag2Key": "value"
  },
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": ""
}
