Why can kube-bench not report control-plane checks on an EKS or GKE cluster?

Why this is the answer

kube-bench reads the API server, scheduler and controller-manager settings from files on the host, and the docs state plainly that inspecting the master nodes of managed clusters is impossible because you have no access to them — worker-node checks still work, which is why separate EKS and GKE job manifests exist. Nothing forbids running the tool. The benchmark does contain control-plane recommendations; they are simply unreachable. And Automated versus Manual status is unrelated to who owns the node.