EC2 instance blocks Internet ingress to Memcached port

Check ID: ec2_instance_port_memcached_exposed_to_internet
Provider: AWS
Service: ec2
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsEc2Instance

What this check verifies

EC2 instances are evaluated for open Memcached access: inbound TCP 11211 allowed from any address (0.0.0.0/0 or ::/0) via their security groups, considering the instance’s public exposure.

Risk

Internet-exposed Memcached weakens:

Availability: abuse for reflection/amplification and resource exhaustion
Confidentiality: unauthorized reads of cached objects and metadata
Integrity: manipulation of cache entries influencing app behavior

Public reachability also aids reconnaissance and lateral movement.

Recommendation

Apply least privilege on network access:

Restrict TCP 11211 to trusted sources or internal subnets only
Place instances in private subnets; avoid public IPs
Layer defense in depth with NACLs and routing to block Internet paths
Prefer private connectivity (peering/VPN) and implement service-level authentication where available

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 revoke-security-group-ingress —group-id <SECURITY_GROUP_ID> —protocol tcp —port 11211 —cidr 0.0.0.0/0

# Security group with Memcached (11211) not exposed to the Internet
resource "aws_security_group" "<example_resource_name>" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 11211
    to_port     = 11211
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # FIX: not 0.0.0.0/0; restricts access to internal range
  }
}

# CloudFormation: restrict Memcached (11211) from Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict Memcached access
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 11211
          ToPort: 11211
          CidrIp: 10.0.0.0/8  # FIX: not 0.0.0.0/0; limits access to internal range to avoid Internet exposure

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_port_memcached_exposed_to_internet. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires