EC2 instance does not expose SQL Server ports publicly

Check ID: ec2_instance_port_sqlserver_exposed_to_internet
Provider: AWS
Service: ec2
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsEc2Instance

What this check verifies

EC2 instances with security groups permitting any source to TCP 1433 or 1434 (SQL Server) are identified, considering the instance’s public reachability based on IP and subnet exposure.

Risk

Internet-reachable SQL services enable:

Brute-force and credential-stuffing of DB logins
Exploitation of SQL Server flaws for remote code execution
Unauthorized queries and data exfiltration This threatens confidentiality and integrity, and facilitates lateral movement from the database host.

Recommendation

Enforce least privilege and defense in depth:

Remove 0.0.0.0/0 and ::/0 to 1433-1434
Allow only trusted IPs or app tiers via security group references
Keep databases in private subnets without public IPs; access via VPN or bastion
Require TLS and strong authentication; monitor access.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":1433,"ToPort":1434,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]}]'

# Restrict SQL Server ports to non-Internet sources
resource "aws_security_group" "<example_resource_name>" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 1433
    to_port     = 1434
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # FIX: do not use 0.0.0.0/0; restricts access to prevent Internet exposure
  }
}

# CloudFormation: restrict SQL Server ports to non-Internet sources
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict SQL ports
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 1433
          ToPort: 1434
          CidrIp: 10.0.0.0/8  # FIX: do not use 0.0.0.0/0; limits access to internal range to close Internet exposure

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_port_sqlserver_exposed_to_internet. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires