Back to Checks
aws

EC2 instance does not allow ingress from the Internet to TCP ports 389 or 636 (LDAP/LDAPS)

ec2_instance_port_ldap_exposed_to_internet
Service: ec2Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2Instance

EC2 instances with security groups permitting Internet-sourced access to LDAP on TCP 389 or LDAPS on TCP 636 are identified.

Public exposure context (presence of public IP and subnet reachability) is considered to gauge how broadly these ports can be accessed.

Prowler logoProwlerprowler-provider-aws

Risk

Publicly reachable LDAP/LDAPS enables:

  • Directory enumeration and weak/anonymous bind attempts
  • Password spraying and credential theft (cleartext on 389)
  • Unauthorized queries causing data exfiltration

Abuse may lead to privilege escalation and availability impact via account lockouts.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_port_ldap_exposed_to_internet

Recommendation

Limit LDAP to trusted networks:

  • Allowlist specific source CIDRs in security groups (least privilege)
  • Use private connectivity (peering/VPN) instead of Internet
  • Require LDAPS, strong certificates, and disable insecure binds
  • Add NACLs and monitoring for defense in depth

If external access is required, place a proxy and enforce rate limits.

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":389,"ToPort":389,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]},{"IpProtocol":"tcp","FromPort":636,"ToPort":636,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]}]'

Terraform

# Restrict LDAP/LDAPS from the Internet
resource "aws_security_group" "<example_resource_name>" {
  name   = "restricted-ldap"
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 389
    to_port     = 389
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # CRITICAL: not 0.0.0.0/0; restricts LDAP (389)
  }

  ingress {
    from_port   = 636
    to_port     = 636
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # CRITICAL: not 0.0.0.0/0; restricts LDAPS (636)
  }
}

NativeIaC

# CloudFormation: restrict LDAP/LDAPS from the Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restricted LDAP access
      VpcId: "<example_resource_id>"
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 389
          ToPort: 389
          CidrIp: 10.0.0.0/8   # CRITICAL: not 0.0.0.0/0; restricts LDAP (389) to internal range
        - IpProtocol: tcp
          FromPort: 636
          ToPort: 636
          CidrIp: 10.0.0.0/8   # CRITICAL: not 0.0.0.0/0; restricts LDAPS (636) to internal range

Other

1In the AWS Console, go to EC2 > Security Groups
2Select the security group attached to the affected instance
3In Inbound rules, find rules for TCP 389 or 636 with Source set to Anywhere (0.0.0.0/0 or ::/0)
4Delete those rule(s)
5(If access is required) Add inbound rules for TCP 389 and/or 636 scoped to specific trusted CIDR(s) only
6Save rules

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.instance import get_instance_public_status
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class ec2_instance_port_ldap_exposed_to_internet(Check):
    # EC2 Instances with LDAP ports open to the Internet will be flagged as FAIL with a severity of medium if the instance has no public IP, high if the instance has a public IP but is in a private subnet, and critical if the instance has a public IP and is in a public subnet.
    def execute(self):
        findings = []
        check_ports = [389, 636]
        for instance in ec2_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = (
                f"Instance {instance.id} does not have LDAP ports open to the Internet."
            )
            report.resource_id = instance.id
            report.resource_arn = instance.arn
            report.resource_tags = instance.tags
            is_open_port = False
            if instance.security_groups:
                for sg in ec2_client.security_groups.values():
                    if sg.id in instance.security_groups:
                        for ingress_rule in sg.ingress_rules:
                            if check_security_group(
                                ingress_rule, "tcp", check_ports, any_address=True
                            ):
                                # The port is open, now check if the instance is in a public subnet with a public IP
                                report.status = "FAIL"
                                (
                                    report.status_extended,
                                    report.check_metadata.Severity,
                                ) = get_instance_public_status(
                                    vpc_client.vpc_subnets, instance, "LDAP"
                                )
                                is_open_port = True
                                break
                        if is_open_port:
                            break
            findings.append(report)
        return findings

References