EKS cluster endpoints should not be publicly accessible

How to fix it

Set endpointPublicAccess off and endpointPrivateAccess on; that is the only combination AWS accepts once the public endpoint is off. Turning the public endpoint off before a private path works locks every operator out of the cluster API, so confirm a route into the VPC, VPC DNS, 443 on the cluster security group and your IAM cluster access first. Narrowing publicAccessCidrs does not clear this: it fails on the public endpoint being enabled at all.

In the console

EKS → Clusters → the cluster → Networking → Cluster endpoint access

With the AWS CLI

aws eks update-cluster-config --name <cluster-name> --resources-vpc-config endpointPublicAccess=false,endpointPrivateAccess=true --region <region>

With Terraform

resource "aws_eks_cluster" "this" {
  name     = "example"
  role_arn = aws_iam_role.eks_cluster.arn

  vpc_config {
    subnet_ids              = var.private_subnet_ids
    endpoint_public_access  = false
    endpoint_private_access = true
  }
}