Check ID: ec2_instance_public_ip
Provider: AWS
Service: ec2
Severity: MEDIUM
Categories: internet-exposed
Resource type: AwsEc2Instance

​
What this check verifies

EC2 instances are assessed for the presence of a public IPv4 address and public DNS. A public IP indicates the instance is directly reachable from the Internet; no public IP implies access only through private networking paths such as load balancers, gateways, or proxies.

​
Risk

Publicly addressed instances are Internet-scannable, enabling direct probing and brute-force of exposed services and management ports. This increases risks of unauthorized access, remote code execution, and data exfiltration (confidentiality, integrity), and allows direct DDoS targeting, degrading availability.

​
Recommendation

Avoid assigning public IPs unless strictly required. Place workloads in private subnets and expose only via load balancers with WAF; use bastions or Session Manager for administration. Enforce least privilege security groups, prefer private endpoints, and route egress via NAT for defense in depth.

​
Remediation

# Terraform: Launch EC2 without a public IP
resource "aws_instance" "example" {
  ami           = "<ami_id>"
  instance_type = "<instance_type>"
  subnet_id     = "<example_subnet_id>"

  associate_public_ip_address = false  # CRITICAL: ensures no public IPv4 is assigned
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_public_ip. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks