Security group blocks Internet ingress to SQL Server ports

Check ID: ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2SecurityGroup

What this check verifies

EC2 security groups with inbound rules that allow Internet sources (0.0.0.0/0, ::/0) to reach Microsoft SQL Server on TCP 1433 or TCP 1434

Risk

Internet-exposed SQL ports enable credential brute force, service enumeration, and remote exploitation. Compromise can lead to unauthorized queries, data exfiltration or tampering, and outages via destructive commands, degrading confidentiality, integrity, and availability.

Recommendation

Apply least privilege on network access:

Restrict SQL ingress to trusted IPs or via VPN/bastion
Place databases in private subnets; allow only app-tier sources
Avoid 0.0.0.0/0 and ::/0
Use defense in depth with network ACLs/firewalls
Monitor auth failures and rate-limit repeated attempts

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":1433,"ToPort":1433,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]},{"IpProtocol":"tcp","FromPort":1434,"ToPort":1434,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]]'

# Restrict SQL Server ports from Internet
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 1433
    to_port     = 1433
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # CRITICAL: not 0.0.0.0/0; restricts Internet access
  }

  ingress {
    from_port   = 1434
    to_port     = 1434
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # CRITICAL: not 0.0.0.0/0; blocks Internet exposure
  }
}

# CloudFormation: restrict SQL Server ports from Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict SQL ports
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 1433
          ToPort: 1433
          CidrIp: 10.0.0.0/8  # CRITICAL: not 0.0.0.0/0; limits exposure to internal range
        - IpProtocol: tcp
          FromPort: 1434
          ToPort: 1434
          CidrIp: 10.0.0.0/8  # CRITICAL: not 0.0.0.0/0; blocks Internet access

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires