EKS cluster endpoints should not be publicly accessible

How to fix it

• Can break clients: Anything reaching the API over the internet, such as CI runners and kubectl on laptops, is cut off, so first give it a route into the VPC and allow 443 on the cluster security group.

In the console

EKS → Clusters → the cluster → Networking → Cluster endpoint access

Cluster endpoint access

Private; the cluster's VPC needs DNS hostnames and DNS resolution turned on

With the AWS CLI

aws eks update-cluster-config --name <cluster-name> --resources-vpc-config endpointPublicAccess=false,endpointPrivateAccess=true --region <region>

With Terraform

resource "aws_eks_cluster" "this" {
  name     = "example"
  role_arn = aws_iam_role.eks_cluster.arn

  vpc_config {
    subnet_ids              = var.private_subnet_ids
    endpoint_public_access  = false
    endpoint_private_access = true
  }
}