Check ID: ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2SecurityGroup

​
What this check verifies

EC2 security groups are assessed for inbound exposure of MySQL on TCP 3306 from 0.0.0.0/0 or ::/0. The finding reflects whether this port is reachable from any IPv4 or IPv6 address.

​
Risk

Public MySQL access lets anyone reach the service, enabling credential brute force and vulnerability exploitation. This threatens:
  • Confidentiality: data exfiltration
  • Integrity: unauthorized writes or schema changes
  • Availability: DoS from abuse or scans

​
Recommendation

Apply least privilege: restrict 3306 to specific sources or peer security groups only. Keep databases in private subnets and use VPN, bastion, or application proxies for admin access. Enable defense in depth with TLS and strong auth. Never allow 0.0.0.0/0 or ::/0 ingress.

​
Remediation

# Restrict MySQL (3306) from Internet
resource "aws_security_group" "example_resource_name" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 3306
    to_port     = 3306
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # Critical: not 0.0.0.0/0 or ::/0; restricts MySQL access
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks