Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Postgres TCP port 5432
ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432
EC2 security groups are evaluated for inbound rules that expose Postgres on TCP 5432 to the Internet. Rules permitting 0.0.0.0/0 or ::/0 to this port, or policies that open all ports publicly, are identified.
Risk
Exposing 5432 to the Internet enables credential stuffing and Postgres exploits, risking data disclosure (confidentiality), unauthorized changes (integrity), and service disruption via brute force or DoS (availability).
prowler aws --checks ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432
Recommendation
Apply least privilege on security groups: remove 0.0.0.0/0 and ::/0 for 5432, allow only trusted CIDRs or private peers. Prefer private access (VPC-only) via VPN, bastion, or proxy. Add defense in depth with SG references and network ACLs, and enforce TLS and strong authentication.
Remediation
aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 5432 --cidr 0.0.0.0/0
- In the AWS Console, go to VPC > Security Groups
- Select the affected security group
- Open the Inbound rules tab and click Edit inbound rules
- Locate any rule for PostgreSQL (port 5432) with Source 0.0.0.0/0 or ::/0
- Delete the rule or change Source to a specific CIDR or security group
- Click Save rules
Source Code
Resource Type
AwsEc2SecurityGroup