Security group blocks Internet ingress to MongoDB ports

Check ID: ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2SecurityGroup

What this check verifies

EC2 security groups are inspected for inbound rules that expose MongoDB on TCP 27017-27018 to the Internet via 0.0.0.0/0 or ::/0. It identifies groups where these ports are reachable from any address.

Risk

Public MongoDB ports invite unauthenticated probing, brute force, and misuse of weak configs. Attackers can read/alter data, drop collections, or deploy ransomware, compromising confidentiality and integrity. Exposure also enables enumeration and lateral movement, threatening availability.

Recommendation

Apply least privilege to MongoDB access:

Block 0.0.0.0/0 and ::/0
Allow only trusted IPs or private networks
Prefer private connectivity and SG-to-SG references
Enforce authentication and TLS
Segment east-west traffic and monitor access for defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":27017,"ToPort":27018,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]}]'

# Restrict MongoDB ports from Internet
resource "aws_security_group" "secure" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 27017
    to_port     = 27018
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # FIX: not 0.0.0.0/0 or ::/0; restricts Internet access
  }
}

# CloudFormation: restrict MongoDB ports from Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict MongoDB ports
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 27017
          ToPort: 27018
          CidrIp: 10.0.0.0/8  # FIX: not 0.0.0.0/0 or ::/0; limits access to internal range

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires