<p>I am wondering if it is possible to configure the “public access source allowlist” from CDK. I can see and manage this in the console under the networking tab, but can’t find anything in <a href="https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_eks.Cluster.html" rel="nofollow noreferrer">the CDK docs</a> about setting the allowlist during deploy. I tried creating and assigning a security group (code sample below), but this didn't work. Also the security group was created as an &quot;additional&quot; security group, rather than the &quot;cluster&quot; security group.</p>
<pre class="lang-ts prettyprint-override"><code>declare const vpc: ec2.Vpc;
declare const adminRole: iam.Role;

const securityGroup = new ec2.SecurityGroup(this, 'my-security-group', {
    vpc,
    allowAllOutbound: true,
    description: 'Created in CDK',
    securityGroupName: 'cluster-security-group'
});

securityGroup.addIngressRule(
    ec2.Peer.ipv4('&lt;vpn CIDR block&gt;'),
    ec2.Port.tcp(8888),
    'allow frontend access from the VPN'
);

const cluster = new eks.Cluster(this, 'my-cluster', {
    vpc,
    clusterName: 'cluster-cdk',
    version: eks.KubernetesVersion.V1_21,
    mastersRole: adminRole,
    defaultCapacity: 0,
    securityGroup
});
</code></pre>
<p><strong>Update:</strong> I attempted the following, and it updated the <em>cluster</em> security group, but I'm still able to access the frontend when I'm not on the VPN:</p>
<pre class="lang-ts prettyprint-override"><code>cluster.connections.allowFrom(
  ec2.Peer.ipv4('&lt;vpn CIDER block&gt;'),
  ec2.Port.tcp(8888)
);
</code></pre>
<p><strong>Update 2:</strong> I tried this as well, and I can still access my application's frontend even when I'm not on the VPN. However I can now only use <code>kubectl</code> when I'm on the VPN, which is good! It's a step forward that I've at least improved the cluster's security in a useful manner.</p>
<pre class="lang-ts prettyprint-override"><code>const cluster = new eks.Cluster(this, 'my-cluster', {
    vpc,
    clusterName: 'cluster-cdk',
    version: eks.KubernetesVersion.V1_21,
    mastersRole: adminRole,
    defaultCapacity: 0,
    endpointAccess: eks.EndpointAccess.PUBLIC_AND_PRIVATE.onlyFrom('&lt;vpn CIDER block&gt;')
});
</code></pre>

James Kelleher
<p>In general EKS has two relevant security groups:</p>
<ol>
<li><p>The one used by nodes, which AWS calls &quot;cluster security group&quot;. It's setup automatically by EKS. You shouldn't need to mess with it unless you want (a) more restrictive rules the defaults (b) open your nodes to maintenance taks (e.g.: ssh access). This is what you are acessing via <code>cluster.connections</code>.</p>
</li>
<li><p>The Ingress Load Balancer security group. This is an Application Load balancer created and managed by EKS. In CDK, it can be created like so:</p>
</li>
</ol>
<pre class="lang-js prettyprint-override"><code>const cluster = new eks.Cluster(this, 'HelloEKS', {
  version: eks.KubernetesVersion.V1_22,
  albController: {
    version: eks.AlbControllerVersion.V2_4_1,
  },
});
</code></pre>
<p>This will will serve as a gateway for all internal services that need an Ingress. You can access it via the <code>cluster.albController</code> propriety and add rules to it like a regular Application Load Balancer. I have no idea how EKS deals with task communication when an Ingress ALB is not present.</p>
<p>Relevant docs:</p>
<ul>
<li><a href="https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html" rel="nofollow noreferrer">Amazon EKS security group considerations</a></li>
<li><a href="https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_eks-readme.html#alb-controller" rel="nofollow noreferrer">Alb Controller on CDK docs</a></li>
<li><a href="https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_eks.Cluster.html#albcontroller-1" rel="nofollow noreferrer">The ALB propriety for EKS Cluster objects</a></li>
</ul>
