Security group does not allow ingress from 0.0.0.0/0 or ::/0 to TCP port 9092 (Kafka)
ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092
EC2 security groups are evaluated for ingress rules that expose Kafka on TCP 9092 to the Internet via 0.0.0.0/0 or ::/0
Risk
Public Kafka 9092 access allows arbitrary clients to connect, enabling topic enumeration, data exfiltration, and producer/consumer impersonation (C/I). Brokers can be flooded or exploited, disrupting clusters (A). Exposure gives attackers a foothold for lateral movement inside the VPC.
prowler aws --checks ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092
Recommendation
Apply least privilege: restrict 9092 to required subnets or IPs; avoid 0.0.0.0/0 and ::/0. Place brokers on private networks and use peering or VPN for access. Enforce mutual TLS/SASL and topic ACLs, and add defense in depth with segmentation and NACLs.
Remediation
aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":9092,"ToPort":9092,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]}]'
- In AWS Console, go to EC2 > Security Groups
- Select the group attached to the resource
- Inbound rules > Edit inbound rules
- Find any rule for TCP port 9092 with Source 0.0.0.0/0 or ::/0
- Delete the rule or change Source to a specific trusted CIDR or security group
- Save rules
Source Code
Resource Type
AwsEc2SecurityGroup