Back to Checks
aws

EC2 instance does not allow ingress from the Internet to TCP port 9092 (Kafka)

ec2_instance_port_kafka_exposed_to_internet
Service: ec2Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2Instance

EC2 instances with security group rules that allow inbound TCP 9092 (Kafka) from the Internet are reported. The evaluation inspects ingress rules to detect broad sources (for example 0.0.0.0/0 or ::/0) that expose Kafka brokers.

Prowler logoProwlerprowler-provider-aws

Risk

Public Kafka access undermines CIA: adversaries can read topics and metadata (confidentiality), publish or alter events (integrity), and overwhelm brokers (availability). Exposure also eases reconnaissance and lateral movement from the broker host.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_port_kafka_exposed_to_internet

Recommendation

Apply least privilege: restrict TCP 9092 to trusted networks, not 0.0.0.0/0 or ::/0. Keep brokers in private subnets and use private connectivity (VPN/peering). Enforce TLS and authenticated clients with granular ACLs, and add defense in depth via NACLs or proxies.

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 9092 --cidr 0.0.0.0/0

Terraform

# Restrict Kafka (9092) from Internet
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 9092
    to_port     = 9092
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # Critical: restrict source; not 0.0.0.0/0
  }
}

NativeIaC

# CloudFormation: restrict Kafka (9092) from Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict Kafka port
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 9092
          ToPort: 9092
          CidrIp: 10.0.0.0/8  # Critical: do NOT use 0.0.0.0/0; restrict to trusted CIDR to close Internet access

Other

1In the AWS Console, go to EC2 > Security Groups
2Select the security group attached to the instance
3Open the Inbound rules tab and click Edit inbound rules
4Remove the rule allowing TCP 9092 from 0.0.0.0/0 or ::/0 (Internet)
5If needed, add TCP 9092 with a restricted source (e.g., your VPC CIDR)
6Click Save rules

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.instance import get_instance_public_status
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class ec2_instance_port_kafka_exposed_to_internet(Check):
    # EC2 Instances with Kafka port 9092 open to the Internet will be flagged as FAIL with a severity of medium if the instance has no public IP, high if the instance has a public IP but is in a private subnet, and critical if the instance has a public IP and is in a public subnet.
    def execute(self):
        findings = []
        check_ports = [9092]
        for instance in ec2_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = f"Instance {instance.id} does not have Kafka port 9092 open to the Internet."
            is_open_port = False
            if instance.security_groups:
                for sg in ec2_client.security_groups.values():
                    if sg.id in instance.security_groups:
                        for ingress_rule in sg.ingress_rules:
                            if check_security_group(
                                ingress_rule, "tcp", check_ports, any_address=True
                            ):
                                # The port is open, now check if the instance is in a public subnet with a public IP
                                report.status = "FAIL"
                                (
                                    report.status_extended,
                                    report.check_metadata.Severity,
                                ) = get_instance_public_status(
                                    vpc_client.vpc_subnets, instance, "Kafka"
                                )
                                is_open_port = True
                                break
                        if is_open_port:
                            break
            findings.append(report)
        return findings

References