Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Memcached TCP port 11211
ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211
EC2 security groups are evaluated for inbound rules that permit Internet-sourced access to TCP 11211 (Memcached) from 0.0.0.0/0 or ::/0.
Risk
Exposed Memcached enables unauthenticated access, impacting CIA:
- Confidentiality: read cached data (sessions, secrets)
- Integrity: modify or poison entries
- Availability: flush or overload cache, degrading apps
Open 11211 is widely scanned, enabling unauthorized access and lateral movement.
Run this check with Prowler CLI
prowler aws --checks ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211
Recommendation
Apply least privilege and segmentation:
- Restrict
TCP 11211to trusted CIDRs or security groups - Keep Memcached on private subnets; avoid public IPs
- Add defense in depth with NACLs/firewalls; disable unused protocols
- Use private connectivity (VPN/peering) and monitor access
Remediation
Native IaC
Terraform
Other
- In the AWS Console, go to EC2 > Security Groups
- Select the affected security group and open the Inbound rules tab
- Click Edit inbound rules
- Delete any rule allowing TCP 11211 from 0.0.0.0/0 or ::/0, or change its Source to a specific trusted CIDR
- Click Save rules
Source Code
Resource Type
AwsEc2SecurityGroup