Check ID: ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2SecurityGroup

​
What this check verifies

EC2 security groups are evaluated for inbound rules that permit Internet-sourced access to TCP 11211 (Memcached) from 0.0.0.0/0 or ::/0.

​
Risk

Exposed Memcached enables unauthenticated access, impacting CIA:
  • Confidentiality: read cached data (sessions, secrets)
  • Integrity: modify or poison entries
  • Availability: flush or overload cache, degrading apps
Open 11211 is widely scanned, enabling unauthorized access and lateral movement.

​
Recommendation

Apply least privilege and segmentation:
  • Restrict TCP 11211 to trusted CIDRs or security groups
  • Keep Memcached on private subnets; avoid public IPs
  • Add defense in depth with NACLs/firewalls; disable unused protocols
  • Use private connectivity (VPN/peering) and monitor access

​
Remediation

# Restrict Memcached (11211) from Internet
resource "aws_security_group" "<example_resource_name>" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 11211
    to_port     = 11211
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # FIX: avoid 0.0.0.0/0 to prevent Internet exposure
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks