EC2 instance does not allow ingress from the Internet to Elasticsearch and Kibana ports (TCP 9200, 9300, 5601)
ec2_instance_port_elasticsearch_kibana_exposed_to_internet
EC2 instances with Elasticsearch/Kibana ports (9200, 9300, 5601) exposed to the Internet through inbound security group rules.
Assesses reachability considering instance public IP and subnet to reflect real exposure.
Risk
Public access to Elasticsearch/Kibana can lead to:
- Unauthorized queries or dashboard viewing confidentiality loss
- Index changes or cluster control via
9300integrity impact - Scans and bulk queries availability degradation
Enables data exfiltration and lateral movement.
prowler aws --checks ec2_instance_port_elasticsearch_kibana_exposed_to_internet
prowler aws --checks ec2_instance_port_elasticsearch_kibana_exposed_to_internet --fixer
Recommendation
Apply least privilege to network exposure:
- Restrict
9200,9300,5601to trusted sources or keep them private - Use private subnets, VPN/peering, or bastion/SSM for admin access
- Enforce authentication and TLS on Elasticsearch/Kibana
- Avoid public IPs unless strictly required
Remediation
aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":9200,"ToPort":9200,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]},{"IpProtocol":"tcp","FromPort":9300,"ToPort":9300,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]},{"IpProtocol":"tcp","FromPort":5601,"ToPort":5601,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]}]'
- Open the AWS Console and go to EC2 > Security Groups
- Select the security group attached to the instance
- In Inbound rules, find any rule allowing TCP 9200, 9300, or 5601 from 0.0.0.0/0 or ::/0
- Edit inbound rules and either delete those rules or change the source to a restricted CIDR (e.g., your internal network)
- Save rules
Source Code
Resource Type
AwsEc2Instance