IBM Cloud Kubernetes clusters are accessible by using public endpoint in Terraform misconfiguration

Rule Details

Cortex AppSec Rule ID	APPSEC2_IBM_7
Category - Subcategory	Public Exposure - Database Endpoints
Provider	IBM
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule detects whether Kubernetes clusters are accessible via public endpoints rather than private endpoints. Exposing clusters through public endpoints increases the risk of unauthorized access and potential vulnerabilities being exploited. By restricting access to private endpoints, sensitive workloads and data are protected from external threats, thereby enhancing the overall security of the Kubernetes environment.

How to Fix

Resource: ibm_container_cluster

• Arguments: private_service_endpoint, public_service_endpoint

Ensure the IBM Kubernetes cluster is only accessible via a private endpoint by setting the private_service_endpoint to true, and either omitting the public_service_endpoint attribute, or setting it to false.

In this example, the public_service_endpoint attribute is set to false and the private_service_endpoint attribute is set to true in the ibm_container_cluster resource to configure access to the Kubernetes cluster via a private endpoint only. [source,go]

resource "ibm_container_cluster" "secure_cluster" { ...

• public_service_endpoint = false
• private_service_endpoint = true }

---