Back to Checks
aws

EC2 instance does not allow ingress from the Internet to TCP ports 20 or 21 (FTP)

ec2_instance_port_ftp_exposed_to_internet
Service: ec2Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2Instance

EC2 instances with security groups permitting inbound FTP on TCP 20-21 from any address (e.g., 0.0.0.0/0 or ::/0) are identified.

Exposure is contextualized by the instance's public reachability (public IP and subnet).

Prowler logoProwlerprowler-provider-aws

Risk

Exposed FTP invites Internet brute force and transmits in cleartext, enabling credential theft and packet sniffing (confidentiality).

Attackers can upload/alter files (integrity) and abuse services for malware staging or DoS (availability). Publicly reachable hosts are rapidly probed by scanners.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_port_ftp_exposed_to_internet

Recommendation

Deny public ingress to FTP ports 20-21 following least privilege. Prefer SFTP or FTPS; if transfers are required, restrict to trusted sources and use private access (VPN or dedicated network). Apply defense in depth with tightened security groups and network ACLs, and monitor authentication and access.

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions 'IpProtocol=tcp,FromPort=20,ToPort=21,IpRanges=[{CidrIp=0.0.0.0/0}]'

Terraform

# Security group with FTP restricted
resource "aws_security_group" "<example_resource_name>" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 20
    to_port     = 21
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # CRITICAL: restrict source; not 0.0.0.0/0. Fixes Internet exposure.
  }
}

NativeIaC

# CloudFormation: restrict FTP (ports 20-21) from Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict FTP access
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 20
          ToPort: 21
          CidrIp: 10.0.0.0/8  # CRITICAL: restrict source; not 0.0.0.0/0. Fixes Internet exposure.

Other

1In the AWS Console, go to EC2 > Security Groups
2Select the security group attached to the instance
3Open the Inbound rules tab and click Edit inbound rules
4Find any rule allowing TCP ports 20-21 from 0.0.0.0/0 or ::/0
5Delete the rule, or change Source to a trusted CIDR (e.g., your office IP)
6Click Save rules

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.instance import get_instance_public_status
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class ec2_instance_port_ftp_exposed_to_internet(Check):
    # EC2 Instances with FTP ports open to the Internet will be flagged as FAIL with a severity of medium if the instance has no public IP, high if the instance has a public IP but is in a private subnet, and critical if the instance has a public IP and is in a public subnet.
    def execute(self):
        findings = []
        check_ports = [20, 21]
        for instance in ec2_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = (
                f"Instance {instance.id} does not have FTP ports open to the Internet."
            )
            is_open_port = False
            if instance.security_groups:
                for sg in ec2_client.security_groups.values():
                    if sg.id in instance.security_groups:
                        for ingress_rule in sg.ingress_rules:
                            if check_security_group(
                                ingress_rule, "tcp", check_ports, any_address=True
                            ):
                                # The port is open, now check if the instance is in a public subnet with a public IP
                                report.status = "FAIL"
                                (
                                    report.status_extended,
                                    report.check_metadata.Severity,
                                ) = get_instance_public_status(
                                    vpc_client.vpc_subnets, instance, "FTP"
                                )
                                is_open_port = True
                                break
                        if is_open_port:
                            break
            findings.append(report)
        return findings

References