Check provider logo

EC2 instance does not allow ingress from the Internet to TCP port 6379 (Redis)

ec2_instance_port_redis_exposed_to_internet

Severitycritical
Serviceec2
by Prowler
internet-exposed

EC2 instances with security groups permitting Internet access to Redis on TCP 6379 are identified.

Exposure is assessed using public IP assignment and subnet reachability to reflect how broadly the service can be contacted.

Risk

Exposed Redis allows remote access to cached data and secrets, reducing confidentiality. Unauthorized commands (SET, DEL, FLUSHALL, config changes) can corrupt or erase data, harming integrity. Internet scanning and abuse can exhaust memory and disrupt service, degrading availability and enabling lateral movement.

Run this check with Prowler CLI

prowler aws --checks ec2_instance_port_redis_exposed_to_internet

Run in Prowler Cloud
Fix finding with Prowler CLI

prowler aws --checks ec2_instance_port_redis_exposed_to_internet --fixer

Recommendation

Apply least privilege network access: restrict Redis to trusted sources or VPC-only, place instances in private subnets, and avoid public IPs.

Layer controls with NACLs and host firewalls, enforce authentication and TLS on Redis, and use VPN/bastion or proxies to broker access.

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 6379 --cidr 0.0.0.0/0

Native IaC
Terraform
Other
  1. In the AWS Console, go to EC2 > Security Groups
  2. Select the security group attached to the affected instance
  3. Open the Inbound rules tab and click Edit inbound rules
  4. Find any rule allowing TCP port 6379 from 0.0.0.0/0 or ::/0
  5. Delete the rule, or change the source to a specific trusted CIDR or security group
  6. Click Save rules

Source Code

Resource Type

AwsEc2Instance

References