Security group blocks Internet ingress to Cassandra ports

Check ID: ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2SecurityGroup

What this check verifies

EC2 security groups are evaluated for inbound rules that allow the Internet (0.0.0.0/0 or ::/0) to reach Cassandra ports 7199, 9160, or 8888. Focuses on tcp rules that expose these ports to public sources.

Risk

Exposed Cassandra interfaces (7199 JMX, 9160 Thrift, 8888 tools) enable:

Unauthorized reads of data/metrics (confidentiality)
Schema and cluster changes (integrity)
Remote operations causing outages (availability)

Public reachability also increases brute-force and exploit attempts.

Recommendation

Restrict ingress on 7199, 9160, 8888 to trusted sources:

Enforce least privilege allow-lists; avoid 0.0.0.0/0 and ::/0
Place nodes in private subnets; use VPN or a bastion for admin
Prefer strong auth and mTLS; bind management to internal interfaces
Apply defense in depth with segmentation (north-south and east-west)

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions IpProtocol=tcp,FromPort=7199,ToPort=7199,IpRanges='[{CidrIp=0.0.0.0/0}]',Ipv6Ranges='[{CidrIpv6=::/0}]' IpProtocol=tcp,FromPort=9160,ToPort=9160,IpRanges='[{CidrIp=0.0.0.0/0}]',Ipv6Ranges='[{CidrIpv6=::/0}]' IpProtocol=tcp,FromPort=8888,ToPort=8888,IpRanges='[{CidrIp=0.0.0.0/0}]',Ipv6Ranges='[{CidrIpv6=::/0}]'

# Restrict Cassandra ports from Internet
resource "aws_security_group" "example" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 7199
    to_port     = 7199
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/16"]  # Critical: not 0.0.0.0/0; restricts IPv4 source
  }
  ingress {
    from_port   = 9160
    to_port     = 9160
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/16"]  # Critical: not 0.0.0.0/0; restricts IPv4 source
  }
  ingress {
    from_port   = 8888
    to_port     = 8888
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/16"]  # Critical: not 0.0.0.0/0; restricts IPv4 source
  }
}

# CloudFormation: restrict Cassandra ports from Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict Cassandra ports
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 7199
          ToPort: 7199
          CidrIp: 10.0.0.0/16  # Critical: not 0.0.0.0/0; restricts IPv4 source
        - IpProtocol: tcp
          FromPort: 9160
          ToPort: 9160
          CidrIp: 10.0.0.0/16  # Critical: not 0.0.0.0/0; restricts IPv4 source
        - IpProtocol: tcp
          FromPort: 8888
          ToPort: 8888
          CidrIp: 10.0.0.0/16  # Critical: not 0.0.0.0/0; restricts IPv4 source

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Security group blocks Internet ingress to RDP port 3389 Security group blocks Internet ingress to Elasticsearch

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires