Check ID: ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2SecurityGroup

​
What this check verifies

EC2 security groups are assessed for inbound rules that allow Internet sources (0.0.0.0/0 or ::/0) to high-risk TCP ports: 25, 110, 135, 143, 445, 3000, 4333, 5000, 5500, 8080, 8088. Findings highlight groups exposing any of these ports to the public network.

​
Risk

Public exposure of these ports enables:
  • RCE via SMB/RPC and weak admin consoles (445, 135, 3000, 5000, 8080)
  • Credential theft/data leakage via mail protocols (25, 110, 143)
  • Spam relay on 25 Impacts: confidentiality, integrity, and availability through exploitation and mass scanning.

​
Recommendation

Restrict these ports using least privilege:
  • Deny Internet ingress; allow only trusted CIDRs or private connectivity
  • Place services behind VPN, bastion, or proxies/WAF; prefer private endpoints
  • Disable unnecessary services; require auth and TLS on exposed apps Apply defense in depth with security groups and network ACLs.

​
Remediation

# Terraform: restrict high-risk TCP port from Internet
resource "aws_security_group" "example" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # CRITICAL: do not use 0.0.0.0/0 or ::/0; restrict source to non-Internet to pass the check
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks