Security group does not allow ingress from the Internet to TCP port 3389 (RDP)
ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389
EC2 security groups restrict inbound RDP on TCP 3389 to trusted sources, avoiding Internet-wide (0.0.0.0/0, ::/0) exposure.
Risk
Internet-exposed RDP enables brute force and credential stuffing and increases the chance of remote code execution via RDP flaws.
Adversaries can gain interactive access, exfiltrate data (confidentiality), tamper with systems (integrity), and trigger ransomware or service disruption (availability).
prowler aws --checks ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389
Recommendation
Apply least privilege: disallow 0.0.0.0/0 and ::/0 to 3389; permit only specific IPs or private networks.
Prefer Session Manager, VPN, or a hardened bastion with MFA and just-in-time access. Use private subnets and add defense in depth with network controls and monitoring.
Remediation
aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 3389 --cidr 0.0.0.0/0
- In AWS Console, go to EC2 > Security Groups
- Select the security group attached to the instance
- In the Inbound rules tab, click Edit inbound rules
- Find any rule with Type RDP (TCP 3389) and Source 0.0.0.0/0 or ::/0
- Delete the rule or change Source to a specific trusted CIDR (e.g., your office IP)
- Click Save rules
Source Code
Resource Type
AwsEc2SecurityGroup