EC2 instance does not allow ingress from the Internet to TCP port 11211 (Memcached)
ec2_instance_port_memcached_exposed_to_internet
EC2 instances are evaluated for open Memcached access: inbound TCP 11211 allowed from any address (0.0.0.0/0 or ::/0) via their security groups, considering the instance's public exposure.
Risk
Internet-exposed Memcached weakens:
- Availability: abuse for reflection/amplification and resource exhaustion
- Confidentiality: unauthorized reads of cached objects and metadata
- Integrity: manipulation of cache entries influencing app behavior
Public reachability also aids reconnaissance and lateral movement.
prowler aws --checks ec2_instance_port_memcached_exposed_to_internet
prowler aws --checks ec2_instance_port_memcached_exposed_to_internet --fixer
Recommendation
Apply least privilege on network access:
- Restrict
TCP 11211to trusted sources or internal subnets only - Place instances in private subnets; avoid public IPs
- Layer defense in depth with NACLs and routing to block Internet paths
- Prefer private connectivity (peering/VPN) and implement service-level authentication where available
Remediation
aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 11211 --cidr 0.0.0.0/0
- In the AWS Console, go to EC2 > Security Groups
- Select the security group attached to the affected instance
- In Inbound rules, find the rule allowing TCP 11211 from 0.0.0.0/0 or ::/0
- Delete the rule or edit the Source to a restricted range (e.g., a private CIDR or a specific security group)
- Save rules
Source Code
Resource Type
AwsEc2Instance