{
  "Provider": "aws",
  "CheckID": "eks_control_plane_endpoint_access_restricted",
  "CheckTitle": "Restrict Access to the EKS Control Plane Endpoint",
  "CheckType": [
    "Infrastructure Security"
  ],
  "ServiceName": "eks",
  "SubServiceName": "",
  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
  "Severity": "medium",
  "ResourceType": "AwsEksCluster",
  "Description": "Restrict Access to the EKS Control Plane Endpoint",
  "Risk": "By default; this API server endpoint is public to the internet; and access to the API server is secured using a combination of AWS Identity and Access Management (IAM) and native Kubernetes Role Based Access Control (RBAC).",
  "RelatedUrl": "",
  "Remediation": {
    "Code": {
      "CLI": "aws eks update-cluster-config --region <region_name> --name <cluster_name> --resources-vpc-config endpointPublicAccess=false,endpointPrivateAccess=true,publicAccessCidrs=[\"123.123.123.123/32\"]",
      "NativeIaC": "",
      "Other": "",
      "Terraform": ""
    },
    "Recommendation": {
      "Text": "You should enable private access to the Kubernetes API server so that all communication between your nodes and the API server stays within your VPC. You can limit the IP addresses that can access your API server from the internet; or completely disable internet access to the API server.",
      "Url": "https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html"
    }
  },
  "Categories": [
    "internet-exposed"
  ],
  "Tags": {
    "Tag1Key": "value",
    "Tag2Key": "value"
  },
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": ""
}
