Security group does not allow ingress from 0.0.0.0/0 or ::/0 to high-risk TCP ports
ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports
EC2 security groups are assessed for inbound rules that allow Internet sources (0.0.0.0/0 or ::/0) to high-risk TCP ports: 25, 110, 135, 143, 445, 3000, 4333, 5000, 5500, 8080, 8088.
Findings highlight groups exposing any of these ports to the public network.
Risk
Public exposure of these ports enables:
- RCE via SMB/RPC and weak admin consoles (
445,135,3000,5000,8080) - Credential theft/data leakage via mail protocols (
25,110,143) - Spam relay on
25Impacts: confidentiality, integrity, and availability through exploitation and mass scanning.
Run this check with Prowler CLI
prowler aws --checks ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports
Fix finding with Prowler CLI
prowler aws --checks ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports --fixer
Recommendation
Restrict these ports using least privilege:
- Deny Internet ingress; allow only trusted CIDRs or private connectivity
- Place services behind VPN, bastion, or proxies/WAF; prefer private endpoints
- Disable unnecessary services; require auth and TLS on exposed apps Apply defense in depth with security groups and network ACLs.
Remediation
Native IaC
Terraform
Other
- In the AWS console, go to EC2 > Network & Security > Security Groups
- Select the security group in the finding and click Inbound rules > Edit inbound rules
- For each high-risk TCP port (25, 110, 135, 143, 445, 3000, 4333, 5000, 5500, 8080, 8088) with Source 0.0.0.0/0 or ::/0, delete the rule or change Source to a specific trusted CIDR (for example, your VPC CIDR)
- Save rules
Source Code
Resource Type
AwsEc2SecurityGroup