Check provider logo

EC2 instance does not allow ingress from the Internet to TCP ports 1433 or 1434 (SQL Server)

ec2_instance_port_sqlserver_exposed_to_internet

Severitycritical
Serviceec2
by Prowler
internet-exposed

EC2 instances with security groups permitting any source to TCP 1433 or 1434 (SQL Server) are identified, considering the instance's public reachability based on IP and subnet exposure.

Risk

Internet-reachable SQL services enable:

  • Brute-force and credential-stuffing of DB logins
  • Exploitation of SQL Server flaws for remote code execution
  • Unauthorized queries and data exfiltration This threatens confidentiality and integrity, and facilitates lateral movement from the database host.
Run this check with Prowler CLI

prowler aws --checks ec2_instance_port_sqlserver_exposed_to_internet

Run in Prowler Cloud
Fix finding with Prowler CLI

prowler aws --checks ec2_instance_port_sqlserver_exposed_to_internet --fixer

Recommendation

Enforce least privilege and defense in depth:

  • Remove 0.0.0.0/0 and ::/0 to 1433-1434
  • Allow only trusted IPs or app tiers via security group references
  • Keep databases in private subnets without public IPs; access via VPN or bastion
  • Require TLS and strong authentication; monitor access.

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":1433,"ToPort":1434,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]}]'

Native IaC
Terraform
Other
  1. In the AWS Console, go to VPC > Security Groups
  2. Select the security group attached to the affected EC2 instance
  3. In the Inbound rules tab, click Edit inbound rules
  4. Delete any rule allowing TCP 1433 or 1434 from 0.0.0.0/0 or ::/0
  5. If access is required, add a rule for TCP 1433-1434 with a specific trusted source (e.g., your office IP or another security group)
  6. Click Save rules

Source Code

Resource Type

AwsEc2Instance

References