Choose how far the Kubernetes API is exposed, and who can get to it.

IAM authentication protects every mode, but a smaller exposure shrinks the attack surface. The cost is operational friction.

Public only (default)

Reachable from the internet

Authenticated by IAM and RBAC, but anyone can try. Acceptable for labs, rarely for production.

Public + private with allowlist

VPC direct, internet by CIDR

Nodes use the private path inside the VPC; engineers and CI come in from publicAccessCidrs only. The common production choice.

Private only

Only from the VPC

Smallest exposure. You need VPN, Direct Connect, a bastion or in-VPC CI runners for every kubectl call.

restrict the public endpoint

$ aws eks update-cluster-config --name shop-eu \
    --resources-vpc-config \
    endpointPublicAccess=true,endpointPrivateAccess=true,\
publicAccessCidrs="203.0.113.0/24"

Private clusters need more plumbing

With no internet path, nodes need VPC endpoints (PrivateLink) for ECR, S3, STS and EC2, or a NAT gateway, to pull images and call AWS APIs.

Who can reach the API server: public, restricted or private

Every EKS cluster has a Kubernetes API endpoint. By default it is public: reachable from the internet, but still requiring IAM authentication and Kubernetes authorization. You can also enable a private endpoint reachable from inside the VPC, and you can restrict the public endpoint to a list of CIDR ranges.

The three configurations are a trade-off between exposure and convenience. Public only is simple and the least secure. Public plus private with an allowlist is the most common production design: nodes and in-VPC workloads talk to the API privately, while engineers and CI systems come from known IP ranges. Private only minimises exposure but requires network paths into the VPC for every human and pipeline: VPN, AWS Direct Connect, a bastion host, or runners inside the VPC.

Private clusters have another requirement: nodes must be able to pull images and call AWS APIs without internet access. That means VPC interface endpoints (AWS PrivateLink) for services such as ECR, STS and EC2, a gateway endpoint for S3, or a NAT gateway.

Reveal the modes with the right arrow. Gotcha: if you switch to private only on a running cluster before your CI can reach it, you lock the pipeline out. Change endpoint access in a planned window and test connectivity first.