Description

Detects Amazon EKS clusters that are configured with public endpoint access enabled but private endpoint access disabled. This configuration exposes the Kubernetes API server to the internet, potentially allowing unauthorized access to the cluster control plane if not properly secured with additional authentication mechanisms.

Detection Strategy

• Scans all EKS clusters in the specified AWS region

• Checks if a cluster has endpointPublicAccess set to true

• Checks if the same cluster has endpointPrivateAccess set to false

• Reports a vulnerability when both conditions are met (public access enabled and private access disabled)