Skip to content

no-public-cluster-access-to-cidr

Explanation

EKS Clusters have public access cidrs set to 0.0.0.0/0 by default which is wide open to the internet. This should be explicitly set to a more specific CIDR range

Possible Impact

EKS can be access from the internet

Suggested Resolution

Don't enable public access to EKS Clusters

Insecure Example

The following example will fail the aws-eks-no-public-cluster-access-to-cidr check.

resource "aws_eks_cluster" "bad_example" {
    // other config 

    name = "bad_example_cluster"
    role_arn = var.cluster_arn
    vpc_config {
        endpoint_public_access = true
    }
}

Secure Example

The following example will pass the aws-eks-no-public-cluster-access-to-cidr check.

resource "aws_eks_cluster" "good_example" {
    // other config 

    name = "good_example_cluster"
    role_arn = var.cluster_arn
    vpc_config {
        endpoint_public_access = true
        public_access_cidrs = ["10.2.0.0/8"]
    }
}