Check provider logo

Security group does not allow ingress from 0.0.0.0/0 or ::/0 to FTP ports 20 or 21

ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21

Severityhigh
Serviceec2
by Prowler
internet-exposed

EC2 security groups are evaluated for Internet-exposed FTP: any inbound rule allowing tcp ports 20 or 21 from 0.0.0.0/0 or ::/0.

Risk

Exposed FTP weakens CIA:

  • Confidentiality: cleartext credentials/files enable interception and brute force.
  • Integrity: unauthorized uploads or tampering enable malware staging.
  • Availability: mass scans and login attempts can exhaust resources and disrupt services.
Run this check with Prowler CLI

prowler aws --checks ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21

Run in Prowler Cloud

Recommendation

Apply least privilege and defense in depth:

  • Remove 0.0.0.0/0 and ::/0 to 20/21; allow only trusted IPs or private access (VPN/peering).
  • Prefer SFTP/FTPS or HTTPS; disable anonymous FTP.
  • Segment transfer hosts, monitor access, and enforce rate limits and strong authentication.

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":20,"ToPort":20,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]},{"IpProtocol":"tcp","FromPort":21,"ToPort":21,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]}]'

Native IaC
Terraform
Other
  1. Open the AWS Console and go to EC2 > Security Groups
  2. Select the security group attached to the affected resource
  3. In Inbound rules, find any rules for TCP ports 20 or 21 with Source 0.0.0.0/0 or ::/0
  4. Delete those rules (or edit them to a specific trusted CIDR only)
  5. Save rules

Source Code

Resource Type

AwsEc2SecurityGroup

References