aquasecurity / aquasecurity/cloudsploit

The "EKS private endpoint" plugin can result in a False-Negative

Open
#823 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

The EKS endpoint setting can have endpointPublicAccess as true, and endpointPrivateAccess as **true** too. So, just checking if endpointPrivateAccess is true can result in a false-negative.

The right way to check it is to find **endpointPublicAccess as true**. Or if **endpointPrivateAccess is enabled AND endpointPublicAccess is disabled**.

Contributor guide

Open the contributing guide

Research direction

Start at the EKS private endpoint plugin and inspect how it evaluates endpointPublicAccess and endpointPrivateAccess. Done means the check no longer reports a false negative when both settings are true, while accepting private-only access when public access is disabled; add or update the relevant test if the plugin has one.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, javascript
Domain
cloud, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.