Amazon EKS

3.9: Amazon EKS Cluster's Kubernetes API Server Endpoint is Publicly Accessible from the Internet

📘 Having the Amazon EKS cluster's Kubernetes API server endpoint publicly accessible poses significant security risks, including unauthorized access and potential data breaches. Implementing strict access controls is essential to protect these endpoints from external threats.

Section: Public Exposure
Severity: Critical
CWE: CWE-668 Exposure of Resource to the Wrong Sphere
Assurance Scope: PCI, NIST
Threat Modeling Principal: Information Disclosure, Tampering
Rule Set: Threat Modeling - Cloud Configuration Check

4.9: AWS EKS Security Groups Allow Access on Ports Other Than TCP Port 443

📘 Allowing access on ports other than TCP port 443 in AWS EKS security groups can lead to unsecured data transmissions and vulnerabilities. Ensuring secure communication through encrypted channels like TCP port 443 is crucial for maintaining data security and integrity.

Section: Compute
Severity: High
CWE: CWE-319 Cleartext Transmission of Sensitive Information
Assurance Scope: PCI, NIST
Threat Modeling Principal: Information Disclosure, Spoofing, Tampering
Rule Set: Threat Modeling - Cloud Configuration Check