EC2 instance blocks Internet ingress to TCP port 3389 (RDP)

Check ID: ec2_instance_port_rdp_exposed_to_internet
Provider: AWS
Service: ec2
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsEc2Instance

What this check verifies

EC2 instances whose security groups allow Internet-wide inbound RDP on TCP 3389 (0.0.0.0/0 or ::/0). The instance’s public IP and subnet routing are considered to determine external reachability.

Risk

Internet-exposed RDP allows:

Brute force and credential reuse on Windows logons
Exploitation of RDP flaws for remote code execution
Lateral movement and data exfiltration This threatens confidentiality, integrity, and availability through data theft, tampering, account lockouts, or ransomware.

Recommendation

Remove Internet-wide RDP. Apply least privilege:

Restrict TCP 3389 to trusted IPs
Prefer private access via VPN or a hardened bastion; consider Session Manager
Use just-in-time access and short-lived rules
Enforce strong auth (e.g., NLA) and monitor logs Adopt defense in depth with layered network controls.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 revoke-security-group-ingress —group-id <SECURITY_GROUP_ID> —protocol tcp —port 3389 —cidr 0.0.0.0/0

# Restrict RDP so it's not open to the Internet
resource "aws_security_group" "<example_resource_name>" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 3389
    to_port     = 3389
    protocol    = "tcp"
    cidr_blocks = ["<TRUSTED_CIDR>"]  # CRITICAL: restrict RDP to a specific CIDR; not 0.0.0.0/0 or ::/0
  }
}

# CloudFormation: restrict RDP so it's not open to the Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict RDP access
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3389
          ToPort: 3389
          CidrIp: <TRUSTED_CIDR>  # CRITICAL: limit RDP to a specific CIDR to avoid 0.0.0.0/0 (::/0)

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_port_rdp_exposed_to_internet. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires