Security group does not allow ingress from 0.0.0.0/0 or ::/0 to MongoDB TCP ports 27017 and 27018
ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018
EC2 security groups are inspected for inbound rules that expose MongoDB on TCP 27017-27018 to the Internet via 0.0.0.0/0 or ::/0.
It identifies groups where these ports are reachable from any address.
Risk
Public MongoDB ports invite unauthenticated probing, brute force, and misuse of weak configs. Attackers can read/alter data, drop collections, or deploy ransomware, compromising confidentiality and integrity.
Exposure also enables enumeration and lateral movement, threatening availability.
prowler aws --checks ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018
Recommendation
Apply least privilege to MongoDB access:
- Block
0.0.0.0/0and::/0 - Allow only trusted IPs or private networks
- Prefer private connectivity and SG-to-SG references
- Enforce authentication and TLS
- Segment east-west traffic and monitor access for defense in depth
Remediation
aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":27017,"ToPort":27018,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]}]'
- In the AWS Console, go to EC2 > Security Groups
- Select the security group attached to your resource
- Open the Inbound rules tab and click Edit inbound rules
- Find rules for TCP ports 27017 or 27018 with Source 0.0.0.0/0 or ::/0
- Delete those rules or change Source to a specific trusted CIDR (e.g., 10.0.0.0/8)
- Click Save rules
Source Code
Resource Type
AwsEc2SecurityGroup