EC2 instances are assessed for the presence of a public IPv4 address and public DNS. A public IP indicates the instance is directly reachable from the Internet; no public IP implies access only through private networking paths such as load balancers, gateways, or proxies.
Risk
Publicly addressed instances are Internet-scannable, enabling direct probing and brute-force of exposed services and management ports. This increases risks of unauthorized access, remote code execution, and data exfiltration (confidentiality, integrity), and allows direct DDoS targeting, degrading availability.
prowler aws --checks ec2_instance_public_ip
Recommendation
Avoid assigning public IPs unless strictly required. Place workloads in private subnets and expose only via load balancers with WAF; use bastions or Session Manager for administration. Enforce least privilege security groups, prefer private endpoints, and route egress via NAT for defense in depth.
Remediation
- In the AWS Console, go to EC2 > Instances and select the instance with a public IPv4 address
- Check the Networking tab to see if an Elastic IP is attached
- If an Elastic IP is attached:
- Go to EC2 > Elastic IPs, select the address, choose Actions > Disassociate Elastic IP
- If the public IPv4 is auto-assigned (no Elastic IP shown):
- Create a new instance (or an AMI from the current one) and, during launch, in Network settings, set Auto-assign public IP to Disable
- Verify the new instance has no public IPv4, then migrate and terminate the old instance
Source Code
Resource Type
AwsEc2Instance