Security group does not allow ingress from 0.0.0.0/0 or ::/0 to MySQL port 3306
ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306
EC2 security groups are assessed for inbound exposure of MySQL on TCP 3306 from 0.0.0.0/0 or ::/0.
The finding reflects whether this port is reachable from any IPv4 or IPv6 address.
Risk
Public MySQL access lets anyone reach the service, enabling credential brute force and vulnerability exploitation. This threatens:
- Confidentiality: data exfiltration
- Integrity: unauthorized writes or schema changes
- Availability: DoS from abuse or scans
prowler aws --checks ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306
Recommendation
Apply least privilege: restrict 3306 to specific sources or peer security groups only. Keep databases in private subnets and use VPN, bastion, or application proxies for admin access. Enable defense in depth with TLS and strong auth. Never allow 0.0.0.0/0 or ::/0 ingress.
Remediation
- In AWS Console, go to EC2 > Security Groups
- Select the security group in use by the instance
- In Inbound rules, click Edit inbound rules
- Remove any rule for TCP port 3306 with source 0.0.0.0/0 or ::/0
- Add a rule for TCP 3306 only from a trusted source (e.g., specific IP/CIDR or a security group)
- Click Save rules
Source Code
Resource Type
AwsEc2SecurityGroup