aquasecurity / aquasecurity/cloudsploit
The "EKS private endpoint" plugin can result in a False-Negative
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
The EKS endpoint setting can have endpointPublicAccess as true, and endpointPrivateAccess as **true** too. So, just checking if endpointPrivateAccess is true can result in a false-negative.
The right way to check it is to find **endpointPublicAccess as true**. Or if **endpointPrivateAccess is enabled AND endpointPublicAccess is disabled**.
Contributor guide
Research direction
Start at the EKS private endpoint plugin and inspect how it evaluates endpointPublicAccess and endpointPrivateAccess. Done means the check no longer reports a false negative when both settings are true, while accepting private-only access when public access is disabled; add or update the relevant test if the plugin has one.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, javascript
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100