Back to Checks
aws

EC2 instance does not allow ingress from the Internet to TCP port 11211 (Memcached)

ec2_instance_port_memcached_exposed_to_internet
Service: ec2Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2Instance

EC2 instances are evaluated for open Memcached access: inbound TCP 11211 allowed from any address (0.0.0.0/0 or ::/0) via their security groups, considering the instance's public exposure.

Prowler logoProwlerprowler-provider-aws

Risk

Internet-exposed Memcached weakens:

  • Availability: abuse for reflection/amplification and resource exhaustion
  • Confidentiality: unauthorized reads of cached objects and metadata
  • Integrity: manipulation of cache entries influencing app behavior

Public reachability also aids reconnaissance and lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_port_memcached_exposed_to_internet

Recommendation

Apply least privilege on network access:

  • Restrict TCP 11211 to trusted sources or internal subnets only
  • Place instances in private subnets; avoid public IPs
  • Layer defense in depth with NACLs and routing to block Internet paths
  • Prefer private connectivity (peering/VPN) and implement service-level authentication where available

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 11211 --cidr 0.0.0.0/0

Terraform

# Security group with Memcached (11211) not exposed to the Internet
resource "aws_security_group" "<example_resource_name>" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 11211
    to_port     = 11211
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # FIX: not 0.0.0.0/0; restricts access to internal range
  }
}

NativeIaC

# CloudFormation: restrict Memcached (11211) from Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict Memcached access
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 11211
          ToPort: 11211
          CidrIp: 10.0.0.0/8  # FIX: not 0.0.0.0/0; limits access to internal range to avoid Internet exposure

Other

1In the AWS Console, go to EC2 > Security Groups
2Select the security group attached to the affected instance
3In Inbound rules, find the rule allowing TCP 11211 from 0.0.0.0/0 or ::/0
4Delete the rule or edit the Source to a restricted range (e.g., a private CIDR or a specific security group)
5Save rules

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.instance import get_instance_public_status
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class ec2_instance_port_memcached_exposed_to_internet(Check):
    # EC2 Instances with Memcached port 11211 open to the Internet will be flagged as FAIL with a severity of medium if the instance has no public IP, high if the instance has a public IP but is in a private subnet, and critical if the instance has a public IP and is in a public subnet.
    def execute(self):
        findings = []
        check_ports = [11211]
        for instance in ec2_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = f"Instance {instance.id} does not have Memcached port 11211 open to the Internet."
            is_open_port = False
            if instance.security_groups:
                for sg in ec2_client.security_groups.values():
                    if sg.id in instance.security_groups:
                        for ingress_rule in sg.ingress_rules:
                            if check_security_group(
                                ingress_rule, "tcp", check_ports, any_address=True
                            ):
                                # The port is open, now check if the instance is in a public subnet with a public IP
                                report.status = "FAIL"
                                (
                                    report.status_extended,
                                    report.check_metadata.Severity,
                                ) = get_instance_public_status(
                                    vpc_client.vpc_subnets, instance, "Memcached"
                                )
                                is_open_port = True
                                break
                        if is_open_port:
                            break
            findings.append(report)
        return findings

References