> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Endpoints Should Not Be Publicly Accessible ### More Info: Your Amazon EKS cluster API server endpoints should not be publicly accessible from the Internet in order to avoid exposing private data and minimizing security risks. The level of access to your Kubernetes API server endpoints depends on your EKS application use cases. It is recommended that the API server endpoints should be accessible only from within your AWS VPC. ### Risk Level Low ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CIS EKS * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * HITRUST CSF * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Sure, here are the step-by-step instructions on how to remediate the "Endpoints Should Not Be Publicly Accessible" misconfiguration in AWS using the AWS console: 1. Log in to the AWS Management Console. 2. Go to the Amazon VPC service. 3. Click on "Endpoints" in the left navigation pane. 4. Select the endpoint that you want to remediate. 5. Click on the "Actions" button and select "Modify Endpoint". 6. In the "Modify Endpoint" dialog box, select the "Private" option for the endpoint. 7. Click "Save Changes" to apply the changes. After following these steps, the endpoint will no longer be publicly accessible and will only be accessible through the VPC. # To remediate this misconfiguration in AWS using AWS CLI, follow these steps: 1. Open the AWS CLI on your local machine. 2. Run the following command to list all VPC endpoints in your AWS account: ``` aws ec2 describe-vpc-endpoints ``` 3. Identify the VPC endpoint that is publicly accessible. 4. Run the following command to modify the VPC endpoint to make it not publicly accessible: ``` aws ec2 modify-vpc-endpoint --vpc-endpoint-id --no-public-dns-enabled --policy-document '{"Statement":[{"Effect":"Deny","Principal":"*","Action":"*","Resource":"*"}],"Version":"2012-10-17"}' ``` Replace `` with the ID of the VPC endpoint that you identified in step 3. 5. Verify that the VPC endpoint is no longer publicly accessible by running the following command: ``` aws ec2 describe-vpc-endpoints --vpc-endpoint-ids ``` This command should return an output that includes `"PrivateDnsEnabled": true` and `"PolicyDocument": {"Statement": [{"Effect": "Deny", "Principal": "*", "Action": "*", "Resource": "*"}], "Version": "2012-10-17"}` for the VPC endpoint that you modified. 6. Repeat steps 3-5 for any other publicly accessible VPC endpoints in your AWS account. To remediate the misconfiguration "Endpoints Should Not Be Publicly Accessible" for AWS using Python, follow these steps: 1. Identify the endpoints that are publicly accessible. You can use the AWS CLI command `aws ec2 describe-security-groups` to list all security groups and their associated rules. 2. For each security group that has a rule allowing public access to an endpoint, you will need to remove the rule. You can use the AWS CLI command `aws ec2 revoke-security-group-ingress` to remove the rule. 3. To automate this process using Python, you can use the Boto3 library, which is the AWS SDK for Python. Here is an example code snippet that will remove all rules allowing public access to endpoints for a specific security group: ```python theme={null} import boto3 # Replace with the actual ID of the security group security_group_id = '' # Create an EC2 client ec2 = boto3.client('ec2') # Describe the security group to get its current rules response = ec2.describe_security_groups(GroupIds=[security_group_id]) security_group = response['SecurityGroups'][0] # Remove all rules allowing public access to endpoints for rule in security_group['IpPermissions']: if rule['IpRanges'][0]['CidrIp'] == '0.0.0.0/0': ec2.revoke_security_group_ingress( GroupId=security_group_id, IpPermissions=[rule] ) ``` 4. You can run this Python script as a Lambda function and schedule it to run periodically to ensure that any new endpoints that are publicly accessible are remediated automatically. You can also modify the script to remediate all security groups in your AWS account, not just a specific one. ```hcl theme={null} resource "aws_eks_cluster" "THIS_CLUSTER" { name = "EKS_CLUSTER_NAME" # replace with your cluster name role_arn = "EKS_CLUSTER_ROLE_ARN" # replace with your cluster IAM role ARN version = "EKS_VERSION" # e.g., "1.29" vpc_config { subnet_ids = [ "PRIVATE_SUBNET_ID_1", "PRIVATE_SUBNET_ID_2", # add all relevant subnets ] endpoint_public_access = false endpoint_private_access = true } # ... any other required arguments (e.g., encryption_config, loggings, etc.) } ``` This change is an in‑place update of the cluster endpoint configuration; it does not force cluster replacement, but it will disconnect any existing connections to the public endpoint while updating.\ CRITICAL: Before applying, ensure you have a way to access the cluster from within its VPC (bastion host, VPN, Direct Connect, etc.), or you will lose access to the control plane. Verification: `terraform plan` should show `endpoint_public_access` changing from `true` to `false` and `endpoint_private_access` changing from `false` to `true` in the `vpc_config` of `aws_eks_cluster.THIS_CLUSTER`. ### Additional Reading: * [https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html)