Check ID: ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2SecurityGroup

​
What this check verifies

EC2 security groups are evaluated for inbound rules that permit public sources (0.0.0.0/0 or ::/0) to TCP 1521 or TCP 2483-Oracle listener ports. The focus is on rules that make these ports reachable from the Internet over IPv4 or IPv6.

​
Risk

Public Oracle listener exposure enables attackers to:
  • Brute force credentials and enumerate services
  • Exploit listener flaws for remote access
  • Run unauthorized queries causing data exfiltration
  • Launch DoS on the listener
This jeopardizes database confidentiality, integrity, and availability.

​
Recommendation

Apply least privilege and defense in depth: disallow public ingress to TCP 1521 and TCP 2483. Restrict access to trusted CIDRs or peer security groups, keep databases on private networks, and require VPN, bastion, or proxy access. Enforce TLS and segment east-west and north-south traffic.

​
Remediation

# Restrict Oracle ports 1521 and 2483 from Internet
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 1521
    to_port     = 1521
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # Critical: do not use 0.0.0.0/0; restrict to internal range
  }

  ingress {
    from_port   = 2483
    to_port     = 2483
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # Critical: restrict Oracle port 2483 from Internet
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks