Back to Checks
aws

EC2 instance does not have Cassandra ports (TCP 7000, 7001, 7199, 9042, 9160) open to the Internet

ec2_instance_port_cassandra_exposed_to_internet
Service: ec2Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2Instance

EC2 instances have Cassandra service ports (7000, 7001, 7199, 9042, 9160) reachable from the Internet through security group ingress.

Public IP presence and subnet exposure are considered to assess external reachability.

Prowler logoProwlerprowler-provider-aws

Risk

Internet-exposed Cassandra enables unauthorized queries on 9042, remote management via 7199 (JMX), and tampering with inter-node channels on 7000/7001 and 9160.

Attackers can read/modify data (confidentiality, integrity), disrupt or take over the cluster (availability), and pivot within the VPC.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_port_cassandra_exposed_to_internet

Recommendation

Apply least privilege network access:

  • Remove 0.0.0.0/0 and ::/0 to Cassandra ports
  • Allow only trusted subnets or VPN/bastion
  • Keep nodes in private subnets; segment inter-node traffic
  • Enforce authentication and TLS/mTLS for clients and JMX
  • Add defense in depth with NACLs and monitoring

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":7000,"ToPort":7000,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]},{"IpProtocol":"tcp","FromPort":7001,"ToPort":7001,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]},{"IpProtocol":"tcp","FromPort":7199,"ToPort":7199,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]},{"IpProtocol":"tcp","FromPort":9042,"ToPort":9042,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]},{"IpProtocol":"tcp","FromPort":9160,"ToPort":9160,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]]'

Terraform

# Security group with Cassandra ports not open to the Internet
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  # FIX: restrict these ports; do not use 0.0.0.0/0
  ingress { from_port = 7000 to_port = 7000 protocol = "tcp" cidr_blocks = ["10.0.0.0/8"] }
  ingress { from_port = 7001 to_port = 7001 protocol = "tcp" cidr_blocks = ["10.0.0.0/8"] }
  ingress { from_port = 7199 to_port = 7199 protocol = "tcp" cidr_blocks = ["10.0.0.0/8"] }
  ingress { from_port = 9042 to_port = 9042 protocol = "tcp" cidr_blocks = ["10.0.0.0/8"] }
  ingress { from_port = 9160 to_port = 9160 protocol = "tcp" cidr_blocks = ["10.0.0.0/8"] }
}

NativeIaC

# Restrict Cassandra ports so they are not open to the Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict Cassandra ports
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 7000
          ToPort: 7000
          CidrIp: 10.0.0.0/8  # FIX: not 0.0.0.0/0; restricts Internet access
        - IpProtocol: tcp
          FromPort: 7001
          ToPort: 7001
          CidrIp: 10.0.0.0/8  # FIX
        - IpProtocol: tcp
          FromPort: 7199
          ToPort: 7199
          CidrIp: 10.0.0.0/8  # FIX
        - IpProtocol: tcp
          FromPort: 9042
          ToPort: 9042
          CidrIp: 10.0.0.0/8  # FIX
        - IpProtocol: tcp
          FromPort: 9160
          ToPort: 9160
          CidrIp: 10.0.0.0/8  # FIX

Other

1Open the AWS Console > EC2 > Instances and select the instance
2In the Security tab, click the attached Security Group(s)
3Click Edit inbound rules
4Remove or change any rule allowing TCP 7000, 7001, 7199, 9042, or 9160 from Anywhere (0.0.0.0/0 or ::/0)
5If needed, re-add those ports with a specific trusted source CIDR or security group
6Save rules

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.instance import get_instance_public_status
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class ec2_instance_port_cassandra_exposed_to_internet(Check):
    # EC2 Instances with Cassandra ports open to the Internet will be flagged as FAIL with a severity of medium if the instance has no public IP, high if the instance has a public IP but is in a private subnet, and critical if the instance has a public IP and is in a public subnet.
    def execute(self):
        findings = []
        check_ports = [7000, 7001, 7199, 9042, 9160]
        for instance in ec2_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = f"Instance {instance.id} does not have Cassandra ports open to the Internet."
            is_open_port = False
            if instance.security_groups:
                for sg in ec2_client.security_groups.values():
                    if sg.id in instance.security_groups:
                        for ingress_rule in sg.ingress_rules:
                            if check_security_group(
                                ingress_rule, "tcp", check_ports, any_address=True
                            ):
                                # The port is open, now check if the instance is in a public subnet with a public IP
                                report.status = "FAIL"
                                (
                                    report.status_extended,
                                    report.check_metadata.Severity,
                                ) = get_instance_public_status(
                                    vpc_client.vpc_subnets, instance, "Cassandra"
                                )
                                is_open_port = True
                                break
                        if is_open_port:
                            break
            findings.append(report)
        return findings

References