EC2 Elastic IP address is not listed in Shodan

​

What this check verifies

EC2 Elastic IPs are compared with Shodan’s index to identify publicly reachable addresses that have been scanned and cataloged, including metadata such as open ports, ISP, and geolocation

​

Risk

Being listed on Shodan confirms Internet exposure and reveals open services, versions, and banners. Adversaries can rapidly target these hosts for credential attacks and CVE exploits, threatening confidentiality (data access), integrity (system takeover), and availability (service disruption).

​

Recommendation

Reduce attack surface with defense in depth:

• Avoid public exposure; use private networking or proxies
• Enforce least-privilege ingress rules; close unused ports
• Patch and harden services; limit verbose banners
• Rotate exposed IPs and continuously monitor external visibility

​

Remediation

Dashboard steps

1. In the AWS Console, go to EC2
2. In the left pane, select Network & Security > Elastic IPs
3. Select the flagged Elastic IP
4. If it is associated: click Actions > Disassociate Elastic IP address > Disassociate
5. Click Actions > Release Elastic IP address > Release

​

References

• https://www.shodan.io/
• https://support.icompaas.com/support/solutions/articles/62000229484-ensure-any-of-the-elastic-or-public-ip-are-in-shodan

​

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_elastic_ip_shodan. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to AWS checks