Control: EKS clusters endpoint should restrict public access

Description

Ensure whether Amazon Elastic Kubernetes Service (Amazon EKS) endpoint is not publicly accessible. The rule is complaint if the endpoint is publicly accessible.

Usage

Run the control in your terminal:

powerpipe control run terraform_aws_compliance.control.eks_cluster_endpoint_restrict_public_access

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_aws_compliance.control.eks_cluster_endpoint_restrict_public_access --share

SQL

This control uses a named query:

select
  address as resource,
  case
    -- In case both endpoint_public_access & public_access_cidrs are not configured in vpc_config then default setting is true and public_access_cidrs accessible to internet
    when (attributes_std -> 'vpc_config' ->> 'endpoint_public_access') is null and (attributes_std -> 'vpc_config' -> 'public_access_cidrs') is null then 'alarm'
    when (attributes_std -> 'vpc_config' ->> 'endpoint_public_access')::boolean and (attributes_std -> 'vpc_config' -> 'public_access_cidrs') is null then 'alarm'
    when (attributes_std -> 'vpc_config' ->> 'endpoint_public_access')::boolean and (attributes_std -> 'vpc_config' -> 'public_access_cidrs') @> '["0.0.0.0/0"]' then 'alarm'
    when (attributes_std -> 'vpc_config' ->> 'endpoint_public_access') is null and (attributes_std -> 'vpc_config' -> 'public_access_cidrs') @> '["0.0.0.0/0"]' then 'alarm'
    else 'ok'
  end status,
  split_part(address, '.', 2) || case
    when (attributes_std -> 'vpc_config' ->> 'endpoint_public_access') is null and (attributes_std -> 'vpc_config' -> 'public_access_cidrs') is null then ' endpoint publicly accessible'
    when (attributes_std -> 'vpc_config' ->> 'endpoint_public_access')::boolean and (attributes_std -> 'vpc_config' -> 'public_access_cidrs') is null then ' endpoint publicly accessible'
    when (attributes_std -> 'vpc_config' ->> 'endpoint_public_access')::boolean and (attributes_std -> 'vpc_config' -> 'public_access_cidrs') @> '["0.0.0.0/0"]' then ' endpoint publicly accessible'
    when (attributes_std -> 'vpc_config' ->> 'endpoint_public_access') is null and (attributes_std -> 'vpc_config' -> 'public_access_cidrs') @> '["0.0.0.0/0"]' then ' endpoint publicly accessible'
    else ' endpoint not publicly accessible'
  end || '.' reason
  
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'aws_eks_cluster';

Control: EKS clusters endpoint should restrict public access

Description

Usage

SQL

Tags