Ensure Clusters Are Created With Private Endpoint Enabled And Public Access Disabled

#!/usr/bin/env bash
#
# Report EKS cluster endpoint exposure for multiple clusters (MANUAL review).
#
# Requirements:
#   - aws CLI v2 configured with appropriate credentials
#   - jq installed
#
# Usage examples:
#   ./eks-endpoint-audit.sh                  # all regions in account
#   AWS_REGION=us-east-1 ./eks-endpoint-audit.sh
#   AWS_REGIONS="us-east-1 eu-west-1" ./eks-endpoint-audit.sh
#
# Interpretation (problem indicators):
#   - endpointPublicAccess == true          => RISK: public API endpoint is enabled
#   - endpointPrivateAccess == false        => RISK: no private access from VPC
#   - Both conditions together              => HIGHEST RISK
#
# This script ONLY reports state; changing endpoint settings must be done
# deliberately per cluster via AWS CLI/console/IaC after review.

set -euo pipefail

# Discover regions
if [[ -n "${AWS_REGIONS:-}" ]]; then
  REGIONS="${AWS_REGIONS}"
elif [[ -n "${AWS_REGION:-}" ]]; then
  REGIONS="${AWS_REGION}"
else
  REGIONS="$(aws ec2 describe-regions --all-regions --query 'Regions[].RegionName' --output text)"
fi

echo "Timestamp: $(date -u +"%Y-%m-%dT%H:%M:%SZ")"
echo "Account ID: $(aws sts get-caller-identity --query 'Account' --output text)"
echo "Regions: ${REGIONS}"
echo

# Header
printf "%-15s %-35s %-8s %-8s %-60s\n" \
  "REGION" "CLUSTER" "PUB" "PRIV" "PUBLIC_ACCESS_CIDRS"
printf "%0.s-" {1..140}; echo

for region in ${REGIONS}; do
  clusters=$(aws eks list-clusters --region "${region}" --query 'clusters[]' --output text 2>/dev/null || true)
  if [[ -z "${clusters}" ]]; then
    continue
  fi

  for cluster in ${clusters}; do
    desc_json=$(aws eks describe-cluster --region "${region}" --name "${cluster}" --output json)

    pub=$(echo "${desc_json}"  | jq -r '.cluster.resourcesVpcConfig.endpointPublicAccess')
    priv=$(echo "${desc_json}" | jq -r '.cluster.resourcesVpcConfig.endpointPrivateAccess')
    cidrs=$(echo "${desc_json}" | jq -r '.cluster.resourcesVpcConfig.publicAccessCidrs | join(",")')

    printf "%-15s %-35s %-8s %-8s %-60s\n" \
      "${region}" "${cluster}" "${pub}" "${priv}" "${cidrs}"
  done
done

cat <<'EOF'

Interpretation guidance (MANUAL review required):

- Desired (per CIS EKS 5.4.2):
    PUB=false  and  PRIV=true

- Problematic states:
    1) PUB=true and PRIV=false
       - API server only reachable via public endpoint from the internet CIDRs.
       - ACTION: Strongly consider switching to private-only, with controlled jump/bastion or VPN.

    2) PUB=true and PRIV=true
       - Private access exists, but public endpoint is still exposed.
       - Review 'PUBLIC_ACCESS_CIDRS':
           * 0.0.0.0/0 or very broad CIDRs => high risk; restrict or disable.
           * Narrow CIDRs may be acceptable based on your risk appetite and access model.

    3) PUB=false and PRIV=false
       - Misconfigured / unusable state for normal operation.
       - Investigate immediately; cluster access may be broken.

Decisions to make per cluster:
  - Is any public endpoint exposure (PUB=true) acceptable in this environment?
  - If yes, are PUBLIC_ACCESS_CIDRS tightly restricted to necessary corporate IP ranges?
  - Can you operate with PRIV-only access (recommended) using VPN/Direct Connect/VPC peering/bastion?

To change settings after review (example, NOT executed by this script):

  aws eks update-cluster-config \
    --region <region> \
    --name <cluster-name> \
    --resources-vpc-config endpointPrivateAccess=true,endpointPublicAccess=false

Apply changes via your standard change-management / IaC process.
EOF