EC2 instance blocks Internet ingress to PostgreSQL port

Check ID: ec2_instance_port_postgresql_exposed_to_internet
Provider: AWS
Service: ec2
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsEc2Instance

What this check verifies

EC2 instances with security group rules allowing inbound PostgreSQL on TCP 5432 from the Internet (0.0.0.0/0 or ::/0) are identified, considering the instance’s public reachability via IP and subnet.

Risk

Exposed TCP 5432 enables unauthenticated Internet probes and brute-force attempts against PostgreSQL, risking database confidentiality, integrity, and availability. Attackers could dump data, alter schemas, create backdoor accounts, pivot within the VPC, or exploit unpatched flaws at scale.

Recommendation

Restrict PostgreSQL to trusted sources only:

Remove 0.0.0.0/0 and ::/0 rules
Apply least privilege security groups (allow from app tier or VPN)
Place instances in private subnets without public IPs
Enforce TLS and strong auth; disable unused listeners
Layer with NACLs and monitoring for defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 revoke-security-group-ingress —group-id <SECURITY_GROUP_ID> —protocol tcp —port 5432 —cidr 0.0.0.0/0

# Restrict PostgreSQL (5432) from Internet
resource "aws_security_group" "<example_resource_name>" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 5432
    to_port     = 5432
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # CRITICAL: not 0.0.0.0/0; prevents Internet exposure
  }
}

# CloudFormation: restrict PostgreSQL (5432) from Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict PostgreSQL
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 10.0.0.0/8  # CRITICAL: not 0.0.0.0/0; limits access to internal range

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_port_postgresql_exposed_to_internet. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires