Security group blocks Internet ingress to Redis port

Check ID: ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2SecurityGroup

What this check verifies

EC2 security groups permitting Internet sources (0.0.0.0/0 or ::/0) to TCP 6379 are identified, indicating Redis is reachable from public networks

Risk

Public Redis access undermines confidentiality, integrity, and availability:

Read keys and secrets
Modify or flush data and configs
Exhaust memory for DoS Attackers can brute-force AUTH, exploit replication or modules for code execution, and pivot within the VPC.

Recommendation

Restrict Redis to private connectivity and apply least privilege:

Allow 6379 only from required app hosts, security groups, or CIDRs
Prefer VPC/private networks or VPN over public IPs
Enforce Redis AUTH and TLS, bind to private interfaces
Use segmentation and monitoring for defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 revoke-security-group-ingress —group-id <SECURITY_GROUP_ID> —protocol tcp —port 6379 —cidr 0.0.0.0/0

# Security group with Redis limited to trusted sources
resource "aws_security_group" "secure" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 6379
    to_port     = 6379
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # Critical: do NOT use 0.0.0.0/0 or ::/0; restrict to trusted CIDR
  }
}

# CloudFormation: restrict Redis (6379) from Internet
Resources:
  SecureSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict Redis access
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 6379
          ToPort: 6379
          CidrIp: 10.0.0.0/8  # Critical: do NOT use 0.0.0.0/0 or ::/0; restrict to trusted CIDR

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires