Check ID: ec2_instance_port_cassandra_exposed_to_internet
Provider: AWS
Service: ec2
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsEc2Instance
What this check verifies
EC2 instances have Cassandra service ports (7000, 7001, 7199, 9042, 9160) reachable from the Internet through security group ingress.
Public IP presence and subnet exposure are considered to assess external reachability.
Risk
Internet-exposed Cassandra enables unauthorized queries on 9042, remote management via 7199 (JMX), and tampering with inter-node channels on 7000/7001 and 9160.
Attackers can read/modify data (confidentiality, integrity), disrupt or take over the cluster (availability), and pivot within the VPC.
Recommendation
Apply least privilege network access:
- Remove
0.0.0.0/0 and ::/0 to Cassandra ports
- Allow only trusted subnets or VPN/bastion
- Keep nodes in private subnets; segment inter-node traffic
- Enforce authentication and TLS/mTLS for clients and JMX
- Add defense in depth with NACLs and monitoring
CLI
Terraform
Native IaC
Dashboard steps
aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":7000,"ToPort":7000,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]},{"IpProtocol":"tcp","FromPort":7001,"ToPort":7001,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]},{"IpProtocol":"tcp","FromPort":7199,"ToPort":7199,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]},{"IpProtocol":"tcp","FromPort":9042,"ToPort":9042,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]},{"IpProtocol":"tcp","FromPort":9160,"ToPort":9160,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]]'
# Security group with Cassandra ports not open to the Internet
resource "aws_security_group" "<example_resource_name>" {
name = "<example_resource_name>"
vpc_id = "<example_resource_id>"
# FIX: restrict these ports; do not use 0.0.0.0/0
ingress { from_port = 7000 to_port = 7000 protocol = "tcp" cidr_blocks = ["10.0.0.0/8"] }
ingress { from_port = 7001 to_port = 7001 protocol = "tcp" cidr_blocks = ["10.0.0.0/8"] }
ingress { from_port = 7199 to_port = 7199 protocol = "tcp" cidr_blocks = ["10.0.0.0/8"] }
ingress { from_port = 9042 to_port = 9042 protocol = "tcp" cidr_blocks = ["10.0.0.0/8"] }
ingress { from_port = 9160 to_port = 9160 protocol = "tcp" cidr_blocks = ["10.0.0.0/8"] }
}
# Restrict Cassandra ports so they are not open to the Internet
Resources:
<example_resource_name>:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Restrict Cassandra ports
VpcId: <example_resource_id>
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 7000
ToPort: 7000
CidrIp: 10.0.0.0/8 # FIX: not 0.0.0.0/0; restricts Internet access
- IpProtocol: tcp
FromPort: 7001
ToPort: 7001
CidrIp: 10.0.0.0/8 # FIX
- IpProtocol: tcp
FromPort: 7199
ToPort: 7199
CidrIp: 10.0.0.0/8 # FIX
- IpProtocol: tcp
FromPort: 9042
ToPort: 9042
CidrIp: 10.0.0.0/8 # FIX
- IpProtocol: tcp
FromPort: 9160
ToPort: 9160
CidrIp: 10.0.0.0/8 # FIX
- Open the AWS Console > EC2 > Instances and select the instance
- In the Security tab, click the attached Security Group(s)
- Click Edit inbound rules
- Remove or change any rule allowing TCP 7000, 7001, 7199, 9042, or 9160 from Anywhere (0.0.0.0/0 or ::/0)
- If needed, re-add those ports with a specific trusted source CIDR or security group
- Save rules
References
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_port_cassandra_exposed_to_internet. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks
