Security group blocks Internet ingress to Elasticsearch

Check ID: ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2SecurityGroup

What this check verifies

EC2 security groups restrict public ingress to Elasticsearch/Kibana ports 9200, 9300, and 5601, denying sources 0.0.0.0/0 and ::/0

Risk

Open Elasticsearch/Kibana ports to the Internet erode CIA:

Confidentiality: unauthorized queries and data exfiltration
Integrity: index tampering/deletion, cluster control via 9300
Availability: API abuse, exploit-based outages, and Kibana 5601 brute-force

Recommendation

Limit ingress to 9200, 9300, and 5601 to trusted CIDRs or private connectivity; never allow 0.0.0.0/0 or ::/0. Prefer private access via VPN, bastion, or private endpoints. Apply least privilege, network segmentation, and defense in depth (NACLs/WAF). Require strong auth and TLS on Elasticsearch/Kibana.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":9200,"ToPort":9200,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]},{"IpProtocol":"tcp","FromPort":9300,"ToPort":9300,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]},{"IpProtocol":"tcp","FromPort":5601,"ToPort":5601,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]}]'

resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  # CRITICAL: Do not use 0.0.0.0/0 or ::/0; restrict these ports to trusted CIDRs
  ingress {
    from_port   = 9200
    to_port     = 9200
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # CRITICAL: restricts 9200 from Internet
  }
  ingress {
    from_port   = 9300
    to_port     = 9300
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # CRITICAL: restricts 9300 from Internet
  }
  ingress {
    from_port   = 5601
    to_port     = 5601
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # CRITICAL: restricts 5601 (Kibana) from Internet
  }
}

# CloudFormation: restrict Elasticsearch/Kibana ports from Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Block Internet access to 9200, 9300, 5601
      VpcId: vpc-<example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 9200
          ToPort: 9200
          CidrIp: 10.0.0.0/8  # CRITICAL: not 0.0.0.0/0 or ::/0; restricts 9200 to trusted CIDR
        - IpProtocol: tcp
          FromPort: 9300
          ToPort: 9300
          CidrIp: 10.0.0.0/8  # CRITICAL: restricts 9300 from Internet
        - IpProtocol: tcp
          FromPort: 5601
          ToPort: 5601
          CidrIp: 10.0.0.0/8  # CRITICAL: restricts 5601 (Kibana) from Internet

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Security group blocks Internet ingress to Cassandra ports Security group blocks Internet ingress to FTP ports 20 or 21

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires