Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Redis TCP port 6379
ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379
EC2 security groups permitting Internet sources (0.0.0.0/0 or ::/0) to TCP 6379 are identified, indicating Redis is reachable from public networks
Risk
Public Redis access undermines confidentiality, integrity, and availability:
- Read keys and secrets
- Modify or flush data and configs
- Exhaust memory for DoS
Attackers can brute-force
AUTH, exploit replication or modules for code execution, and pivot within the VPC.
Run this check with Prowler CLI
prowler aws --checks ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379
Recommendation
Restrict Redis to private connectivity and apply least privilege:
- Allow
6379only from required app hosts, security groups, or CIDRs - Prefer VPC/private networks or VPN over public IPs
- Enforce Redis
AUTHand TLS, bind to private interfaces - Use segmentation and monitoring for defense in depth
Remediation
CLI
aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 6379 --cidr 0.0.0.0/0
Native IaC
Terraform
Other
- In the AWS Console, go to EC2 > Security Groups
- Select the affected security group
- Open the Inbound rules tab and click Edit inbound rules
- Find any rule allowing TCP port 6379 with Source 0.0.0.0/0 or ::/0
- Delete that rule (or change Source to a trusted CIDR or security group)
- Click Save rules
Source Code
Resource Type
AwsEc2SecurityGroup