EC2 instance does not allow ingress from the Internet to TCP ports 20 or 21 (FTP)
ec2_instance_port_ftp_exposed_to_internet
EC2 instances with security groups permitting inbound FTP on TCP 20-21 from any address (e.g., 0.0.0.0/0 or ::/0) are identified.
Exposure is contextualized by the instance's public reachability (public IP and subnet).
Risk
Exposed FTP invites Internet brute force and transmits in cleartext, enabling credential theft and packet sniffing (confidentiality).
Attackers can upload/alter files (integrity) and abuse services for malware staging or DoS (availability). Publicly reachable hosts are rapidly probed by scanners.
prowler aws --checks ec2_instance_port_ftp_exposed_to_internet
prowler aws --checks ec2_instance_port_ftp_exposed_to_internet --fixer
Recommendation
Deny public ingress to FTP ports 20-21 following least privilege. Prefer SFTP or FTPS; if transfers are required, restrict to trusted sources and use private access (VPN or dedicated network). Apply defense in depth with tightened security groups and network ACLs, and monitor authentication and access.
Remediation
aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions 'IpProtocol=tcp,FromPort=20,ToPort=21,IpRanges=[{CidrIp=0.0.0.0/0}]'
- In the AWS Console, go to EC2 > Security Groups
- Select the security group attached to the instance
- Open the Inbound rules tab and click Edit inbound rules
- Find any rule allowing TCP ports 20-21 from 0.0.0.0/0 or ::/0
- Delete the rule, or change Source to a trusted CIDR (e.g., your office IP)
- Click Save rules
Source Code
Resource Type
AwsEc2Instance