Check ID: ec2_instance_port_ldap_exposed_to_internet
Provider: AWS
Service: ec2
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsEc2Instance
What this check verifies
EC2 instances with security groups permitting Internet-sourced access to LDAP on TCP 389 or LDAPS on TCP 636 are identified.
Public exposure context (presence of public IP and subnet reachability) is considered to gauge how broadly these ports can be accessed.
Risk
Publicly reachable LDAP/LDAPS enables:
- Directory enumeration and weak/anonymous bind attempts
- Password spraying and credential theft (cleartext on
389)
- Unauthorized queries causing data exfiltration
Abuse may lead to privilege escalation and availability impact via account lockouts.
Recommendation
Limit LDAP to trusted networks:
- Allowlist specific source CIDRs in security groups (least privilege)
- Use private connectivity (peering/VPN) instead of Internet
- Require LDAPS, strong certificates, and disable insecure binds
- Add NACLs and monitoring for defense in depth
If external access is required, place a proxy and enforce rate limits.
CLI
Terraform
Native IaC
Dashboard steps
aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":389,"ToPort":389,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]},{"IpProtocol":"tcp","FromPort":636,"ToPort":636,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]}]'
# Restrict LDAP/LDAPS from the Internet
resource "aws_security_group" "<example_resource_name>" {
name = "restricted-ldap"
vpc_id = "<example_resource_id>"
ingress {
from_port = 389
to_port = 389
protocol = "tcp"
cidr_blocks = ["10.0.0.0/8"] # CRITICAL: not 0.0.0.0/0; restricts LDAP (389)
}
ingress {
from_port = 636
to_port = 636
protocol = "tcp"
cidr_blocks = ["10.0.0.0/8"] # CRITICAL: not 0.0.0.0/0; restricts LDAPS (636)
}
}
# CloudFormation: restrict LDAP/LDAPS from the Internet
Resources:
<example_resource_name>:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Restricted LDAP access
VpcId: "<example_resource_id>"
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 389
ToPort: 389
CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0; restricts LDAP (389) to internal range
- IpProtocol: tcp
FromPort: 636
ToPort: 636
CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0; restricts LDAPS (636) to internal range
- In the AWS Console, go to EC2 > Security Groups
- Select the security group attached to the affected instance
- In Inbound rules, find rules for TCP 389 or 636 with Source set to Anywhere (0.0.0.0/0 or ::/0)
- Delete those rule(s)
- (If access is required) Add inbound rules for TCP 389 and/or 636 scoped to specific trusted CIDR(s) only
- Save rules
References
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_port_ldap_exposed_to_internet. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks
