Ensure Clusters Are Created With Private Nodes

#!/usr/bin/env bash
#
# Report EKS cluster API endpoint exposure and node public IP usage.
# Requirements:
#   - aws CLI configured with at least read-only EKS/EC2/VPC permissions
#   - kubectl configured (used only to verify the cluster is reachable)
#
# Usage:
#   ./eks_private_nodes_report.sh <region> <cluster-name>
#
# Run from: any machine with aws + kubectl access

set -euo pipefail

REGION="${1:-}"
CLUSTER_NAME="${2:-}"

if [[ -z "$REGION" || -z "$CLUSTER_NAME" ]]; then
  echo "Usage: $0 <region> <cluster-name>" >&2
  exit 1
fi

echo "=== Verifying kubectl access to cluster '${CLUSTER_NAME}' in region '${REGION}' ==="
aws eks update-kubeconfig --region "$REGION" --name "$CLUSTER_NAME" >/dev/null
kubectl get nodes -o wide || {
  echo "ERROR: Unable to reach cluster with kubectl." >&2
  exit 1
}

echo
echo "=== EKS Cluster Endpoint Configuration (control plane) ==="
aws eks describe-cluster \
  --region "$REGION" \
  --name "$CLUSTER_NAME" \
  --query 'cluster.resourcesVpcConfig.{endpointPublicAccess:endpointPublicAccess,endpointPrivateAccess:endpointPrivateAccess,publicAccessCidrs:publicAccessCidrs}' \
  --output table

echo
echo "=== Interpretation (control plane) ==="
cat <<'EOF'
- endpointPublicAccess = true  AND publicAccessCidrs includes 0.0.0.0/0
    -> RISK: API server is exposed to the entire internet.
- endpointPublicAccess = true  AND publicAccessCidrs is a broad range (e.g. /0, /8, /16)
    -> RISK: API server is exposed to large address ranges.
- endpointPrivateAccess = false
    -> RISK: No private endpoint; all access must go through the public endpoint.

Recommended pattern (per control intent):
- endpointPrivateAccess = true
- endpointPublicAccess = false
  OR
- endpointPublicAccess = true with tightly scoped publicAccessCidrs to specific admin IPs/VPN.
EOF

echo
echo "=== Nodegroup Public IP Configuration (whether nodes may get public IPs) ==="
aws eks list-nodegroups \
  --region "$REGION" \
  --cluster-name "$CLUSTER_NAME" \
  --query 'nodegroups' \
  --output text | tr '\t' '\n' | while read -r NG; do
  [[ -z "$NG" ]] && continue
  echo
  echo "Nodegroup: $NG"
  aws eks describe-nodegroup \
    --region "$REGION" \
    --cluster-name "$CLUSTER_NAME" \
    --nodegroup-name "$NG" \
    --query 'nodegroup.{subnets:subnets,remoteAccess:remoteAccess,launchTemplate:launchTemplate}' \
    --output json

  echo "  -> Auto-assign public IP on subnets (indicates potential for public nodes):"
  SUBNETS=$(aws eks describe-nodegroup \
    --region "$REGION" \
    --cluster-name "$CLUSTER_NAME" \
    --nodegroup-name "$NG" \
    --query 'nodegroup.subnets' \
    --output text | tr '\t' '\n')

  for SN in $SUBNETS; do
    MAP_PUBLIC_IP=$(aws ec2 describe-subnets \
      --region "$REGION" \
      --subnet-ids "$SN" \
      --query 'Subnets[0].MapPublicIpOnLaunch' \
      --output text)
    echo "    Subnet $SN: MapPublicIpOnLaunch=${MAP_PUBLIC_IP}"
  done
done

echo
echo "=== Interpretation (nodegroups/subnets) ==="
cat <<'EOF'
- For any subnet with MapPublicIpOnLaunch = true:
    -> RISK: EC2 instances (including worker nodes) in this subnet will receive public IPs
       unless overridden by the launch template or other settings.
- To meet the intent of "private nodes":
    -> Worker nodes should be in subnets with MapPublicIpOnLaunch = false (private subnets),
       behind NAT gateways or similar, with NO direct public IPs assigned.

You must review:
- Whether any nodegroup subnets have MapPublicIpOnLaunch = true.
- Whether that configuration is acceptable for your risk profile.
EOF

echo
echo "=== (Optional) Live Node Public IP Check via EC2 ==="
echo "Gathering node instance IDs from cluster..."
NODE_INSTANCE_IDS=$(kubectl get nodes -o jsonpath='{range .items[*]}{.spec.providerID}{"\n"}{end}' \
  | sed -n 's|^aws:///[^/]*/||p' | sort -u)

if [[ -z "$NODE_INSTANCE_IDS" ]]; then
  echo "No node instance IDs found from kubectl; skipping EC2 IP check."
  exit 0
fi

echo "Checking public IPs for current worker nodes..."
aws ec2 describe-instances \
  --region "$REGION" \
  --instance-ids $NODE_INSTANCE_IDS \
  --query 'Reservations[].Instances[].{InstanceId:InstanceId,PrivateIpAddress:PrivateIpAddress,PublicIpAddress:PublicIpAddress,SubnetId:SubnetId}' \
  --output table

cat <<'EOF'

Interpretation (live nodes):
- Any node with a non-empty PublicIpAddress
    -> RISK: That worker node is directly reachable from the internet (subject to security groups).
- For strict "private nodes":
    -> All worker nodes should show PublicIpAddress as blank/null.

This script only reports state. Decisions and remediation (changing endpoint access,
moving nodegroups to private subnets, adjusting subnet attributes, or recreating
nodegroups) must be made manually based on your security requirements.
EOF