Find EKS Clusters With a Public API Endpoint

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListRegionsAndClusters",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeRegions",
        "eks:ListClusters"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DescribeClusters",
      "Effect": "Allow",
      "Action": "eks:DescribeCluster",
      "Resource": "arn:aws:eks:*:123456789012:cluster/*"
    }
  ]
}

// find-eks-clusters-with-public-endpoint.ts
// Lists every EKS cluster in each Region with its API server endpoint settings: public access,
// public access CIDRs (flagging 0.0.0.0/0, ::/0 and very broad ranges), private access and the
// authentication mode. Report-only: it never calls UpdateClusterConfig.
// Usage: npx tsx find-eks-clusters-with-public-endpoint.ts [--regions=us-east-1,eu-west-1]
import { EC2Client, DescribeRegionsCommand } from "@aws-sdk/client-ec2";
import { EKSClient, DescribeClusterCommand, paginateListClusters, type Cluster } from "@aws-sdk/client-eks";

const regionArg = process.argv
  .slice(2)
  .find((a) => a.startsWith("--regions="))
  ?.split("=")[1]
  ?.split(",")
  .map((s) => s.trim())
  .filter(Boolean);

interface Row {
  Region: string;
  Cluster: string;
  Version: string;
  Public: boolean;
  Private: boolean;
  PublicCidrs: string;
  AuthMode: string;
  Verdict: string;
}

// An IPv4 CIDR shorter than /16 covers 65,536+ addresses: treat it as broad enough to review.
function isBroad(cidr: string): boolean {
  if (cidr === "0.0.0.0/0" || cidr === "::/0") return true;
  const [ip, bits] = cidr.split("/");
  const len = Number(bits);
  return !!ip && !ip.includes(":") && Number.isFinite(len) && len < 16;
}

function verdict(c: Cluster): string {
  const vpc = c.resourcesVpcConfig;
  const pub = vpc?.endpointPublicAccess === true;
  const priv = vpc?.endpointPrivateAccess === true;
  const cidrs = vpc?.publicAccessCidrs ?? [];
  if (!pub) return priv ? "ok: private endpoint only" : "check: no endpoint access reported";
  if (cidrs.includes("0.0.0.0/0") || cidrs.includes("::/0")) {
    return priv ? "OPEN: public to any IP (private also on)" : "OPEN: public to any IP, nodes use public endpoint";
  }
  if (cidrs.some(isBroad)) return "BROAD: public, a CIDR shorter than /16";
  return priv ? "RESTRICTED: public to listed CIDRs" : "RESTRICTED: public only, nodes must be in the CIDRs";
}

async function listRegions(): Promise<string[]> {
  if (regionArg) return regionArg;
  const out = await new EC2Client({}).send(new DescribeRegionsCommand({}));
  return (out.Regions ?? []).map((r) => r.RegionName ?? "").filter(Boolean).sort();
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  for (const region of await listRegions()) {
    const eks = new EKSClient({ region });
    try {
      for await (const page of paginateListClusters({ client: eks }, {})) {
        for (const name of page.clusters ?? []) {
          const { cluster } = await eks.send(new DescribeClusterCommand({ name }));
          if (!cluster) continue;
          const vpc = cluster.resourcesVpcConfig;
          rows.push({
            Region: region,
            Cluster: name,
            Version: cluster.version ?? "?",
            Public: vpc?.endpointPublicAccess === true,
            Private: vpc?.endpointPrivateAccess === true,
            PublicCidrs: vpc?.endpointPublicAccess ? (vpc.publicAccessCidrs ?? []).join(", ") || "-" : "-",
            AuthMode: cluster.accessConfig?.authenticationMode ?? "?",
            Verdict: verdict(cluster),
          });
        }
      }
    } catch (err) {
      rows.push({ Region: region, Cluster: "?", Version: "?", Public: false, Private: false, PublicCidrs: "?", AuthMode: "?", Verdict: `error: ${err instanceof Error ? err.name : String(err)}` });
    }
  }

  console.table(rows);
  const open = rows.filter((r) => r.Verdict.startsWith("OPEN")).length;
  const broad = rows.filter((r) => r.Verdict.startsWith("BROAD")).length;
  console.log(`${rows.length} cluster(s) checked; ${open} open to any IP, ${broad} with a broad CIDR. Nothing was changed.`);
  if (open || broad) process.exitCode = 2; // lets CI or a scheduled job fail on a finding
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-eks @aws-sdk/client-ec2
npm install --save-dev tsx typescript

# Every cluster in every enabled Region
AWS_PROFILE=security-audit npx tsx find-eks-clusters-with-public-endpoint.ts

# Two Regions only
AWS_PROFILE=security-audit npx tsx find-eks-clusters-with-public-endpoint.ts --regions=us-east-1,us-west-2

┌─────────┬─────────────┬─────────────────┬─────────┬────────┬─────────┬────────────────────────────────────┬──────────────────────┬─────────────────────────────────────────────────────┐
│ (index) │ Region      │ Cluster         │ Version │ Public │ Private │ PublicCidrs                        │ AuthMode             │ Verdict                                             │
├─────────┼─────────────┼─────────────────┼─────────┼────────┼─────────┼────────────────────────────────────┼──────────────────────┼─────────────────────────────────────────────────────┤
│ 0       │ 'eu-west-1' │ 'data-platform' │ '1.32'  │ false  │ true    │ '-'                                │ 'API'                │ 'ok: private endpoint only'                         │
│ 1       │ 'us-east-1' │ 'prod-apps'     │ '1.33'  │ true   │ true    │ '203.0.113.0/24, 198.51.100.17/32' │ 'API_AND_CONFIG_MAP' │ 'RESTRICTED: public to listed CIDRs'                │
│ 2       │ 'us-east-1' │ 'staging'       │ '1.33'  │ true   │ false   │ '0.0.0.0/0'                        │ 'CONFIG_MAP'         │ 'OPEN: public to any IP, nodes use public endpoint' │
│ 3       │ 'us-west-2' │ 'ml-batch'      │ '1.31'  │ true   │ true    │ '10.0.0.0/8'                       │ 'API'                │ 'BROAD: public, a CIDR shorter than /16'            │
└─────────┴─────────────┴─────────────────┴─────────┴────────┴─────────┴────────────────────────────────────┴──────────────────────┴─────────────────────────────────────────────────────┘
4 cluster(s) checked; 1 open to any IP, 1 with a broad CIDR. Nothing was changed.

# Turn on the private endpoint and limit the public one to two ranges
aws eks update-cluster-config --region us-east-1 --name staging \
  --resources-vpc-config endpointPrivateAccess=true,endpointPublicAccess=true,publicAccessCidrs="203.0.113.0/24,198.51.100.17/32"

# Track the update with the id from the response
aws eks describe-update --region us-east-1 --name staging --update-id 71abb011-b524-4983-b17f-c30baa1b5530