Security group blocks Internet ingress to FTP ports 20 or 21

Check ID: ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2SecurityGroup

What this check verifies

EC2 security groups are evaluated for Internet-exposed FTP: any inbound rule allowing tcp ports 20 or 21 from 0.0.0.0/0 or ::/0.

Risk

Exposed FTP weakens CIA:

Confidentiality: cleartext credentials/files enable interception and brute force.
Integrity: unauthorized uploads or tampering enable malware staging.
Availability: mass scans and login attempts can exhaust resources and disrupt services.

Recommendation

Apply least privilege and defense in depth:

Remove 0.0.0.0/0 and ::/0 to 20/21; allow only trusted IPs or private access (VPN/peering).
Prefer SFTP/FTPS or HTTPS; disable anonymous FTP.
Segment transfer hosts, monitor access, and enforce rate limits and strong authentication.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":20,"ToPort":20,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]},{"IpProtocol":"tcp","FromPort":21,"ToPort":21,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]}]'

# Terraform: restrict FTP (20,21) from Internet
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 20
    to_port     = 20
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # Critical: not 0.0.0.0/0; restricts IPv4
  }

  ingress {
    from_port   = 21
    to_port     = 21
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # Critical: not 0.0.0.0/0; restricts IPv4
  }
}

# CloudFormation: restrict FTP (20,21) from Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict FTP from Internet
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 20
          ToPort: 20
          CidrIp: 10.0.0.0/8  # Critical: not 0.0.0.0/0; limits IPv4 to a private range
        - IpProtocol: tcp
          FromPort: 21
          ToPort: 21
          CidrIp: 10.0.0.0/8  # Critical: not 0.0.0.0/0; limits IPv4 to a private range

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires