Check provider logo

EC2 instance is not internet-facing with an instance profile attached

ec2_instance_internet_facing_with_instance_profile

Severityhigh
Serviceec2
by Prowler
internet-exposedidentity-access

EC2 instances with a public IP address and an attached instance profile (IAM role) are identified.

Instances lacking public exposure or without an instance profile are excluded.

Risk

Publicly reachable instances with IAM role credentials expand the blast radius. Remote exploits or misconfigurations can steal credentials via the instance metadata service, enabling unauthorized API calls, data exfiltration, and lateral movement, impacting confidentiality, integrity, and availability.

Run this check with Prowler CLI

prowler aws --checks ec2_instance_internet_facing_with_instance_profile

Run in Prowler Cloud

Recommendation

Avoid direct Internet exposure. Place workloads behind an Application Load Balancer and protect HTTP apps with WAF. Remove public IPs or restrict ingress to trusted sources. Apply least privilege to instance profiles and enforce IMDSv2. Use bastion hosts or Session Manager for admin access.

Remediation

CLI

aws ec2 disassociate-iam-instance-profile --association-id <ASSOCIATION_ID>

Native IaC
Terraform
Other
  1. In the AWS Console, go to EC2 > Instances and select the instance
  2. Choose Actions > Security > Modify IAM role
  3. Set IAM role to None and click Update IAM role
  4. Verify the instance no longer lists an IAM role (instance profile)

Alternative (if you need the role): remove internet exposure

  1. Select the instance > Networking tab
  2. If an Elastic IP is attached, choose Disassociate Elastic IP
  3. For auto-assigned public IPv4, stop the instance and relaunch without a public IP or in a subnet without auto-assign public IPv4

Source Code

Resource Type

AwsEc2Instance

References