EC2 instance does not expose Oracle DB ports to the Internet

Check ID: ec2_instance_port_oracle_exposed_to_internet
Provider: AWS
Service: ec2
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsEc2Instance

What this check verifies

EC2 instances with security groups allowing inbound TCP from any address to Oracle listener ports 1521, 2483, or 2484

Risk

Exposed Oracle listener ports enable SID enumeration, credential brute force, and TNS abuse. A successful intrusion can grant database access, causing data exfiltration (C), unauthorized changes (I), and outages via exploits or DoS (A). Internet scanning quickly finds these endpoints, enlarging the attack surface.

Recommendation

Restrict Oracle ports to trusted sources; remove 0.0.0.0/0 and ::/0. Place databases in private subnets without public IPs. Use VPN/Direct Connect or bastions for access. Enable TLS on 2484, strong auth, and apply least privilege rules with defense in depth using NACLs and monitoring.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 revoke-security-group-ingress —group-id <SECURITY_GROUP_ID> —protocol tcp —port 1521 —cidr 0.0.0.0/0

# Security group with Oracle port restricted from Internet
resource "aws_security_group" "<example_resource_name>" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 1521
    to_port     = 1521
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/16"] # FIX: restrict source; do not use 0.0.0.0/0 or ::/0
  }
}

# CloudFormation: Restrict Oracle port from Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict Oracle port access
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 1521
          ToPort: 1521
          CidrIp: 10.0.0.0/16  # FIX: do not use 0.0.0.0/0 or ::/0; limits access to a trusted CIDR to block Internet

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_port_oracle_exposed_to_internet. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires