Back to Checks
aws

EC2 instance does not allow ingress from the Internet to TCP ports 27017 or 27018 (MongoDB)

ec2_instance_port_mongodb_exposed_to_internet
Service: ec2Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2Instance

EC2 instances with security groups permitting inbound TCP 27017 or 27018 (MongoDB) from 0.0.0.0/0 or ::/0 are identified, factoring the instance's public reachability to gauge exposure.

Prowler logoProwlerprowler-provider-aws

Risk

Internet-exposed MongoDB invites scanning, brute force, and exploits leading to:

  • Data extraction (confidentiality)
  • Collection tampering or deletion (integrity)
  • DoS or ransomware disruptions (availability) A compromised DB host can also enable lateral movement within the environment.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_port_mongodb_exposed_to_internet

Recommendation

Apply least privilege to MongoDB access:

  • Remove Internet-wide rules; allow only trusted sources
  • Keep DBs on private subnets without public IPs; use private connectivity or proxies
  • Enforce strong auth and TLS
  • Add segmentation and monitoring for defense in depth

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":27017,"ToPort":27017,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]},{"IpProtocol":"tcp","FromPort":27018,"ToPort":27018,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]}]'

Terraform

resource "aws_security_group" "<example_resource_name>" {
  vpc_id = "<example_resource_id>"

  # Critical: restrict MongoDB ports to internal CIDR, not 0.0.0.0/0 or ::/0
  ingress {
    from_port   = 27017
    to_port     = 27017
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }

  ingress {
    from_port   = 27018
    to_port     = 27018
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }
}

NativeIaC

# CloudFormation: restrict MongoDB ports from Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict MongoDB ports
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 27017
          ToPort: 27017
          CidrIp: 10.0.0.0/8  # Critical: restricts 27017 to internal CIDR (not 0.0.0.0/0)
        - IpProtocol: tcp
          FromPort: 27018
          ToPort: 27018
          CidrIp: 10.0.0.0/8  # Critical: restricts 27018 to internal CIDR (not 0.0.0.0/0)

Other

1In the AWS Console, go to EC2 > Security Groups
2Select the security group attached to the affected instance
3Open the Inbound rules tab and click Edit inbound rules
4Delete any rule allowing TCP port 27017 or 27018 from 0.0.0.0/0 or ::/0
5If access is required, add a rule for those ports limited to a specific trusted CIDR (e.g., your VPC CIDR)
6Click Save rules

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.instance import get_instance_public_status
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class ec2_instance_port_mongodb_exposed_to_internet(Check):
    # EC2 Instances with MongoDB ports open to the Internet will be flagged as FAIL with a severity of medium if the instance has no public IP, high if the instance has a public IP but is in a private subnet, and critical if the instance has a public IP and is in a public subnet.
    def execute(self):
        findings = []
        check_ports = [27017, 27018]
        for instance in ec2_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = f"Instance {instance.id} does not have MongoDB ports open to the Internet."
            is_open_port = False
            if instance.security_groups:
                for sg in ec2_client.security_groups.values():
                    if sg.id in instance.security_groups:
                        for ingress_rule in sg.ingress_rules:
                            if check_security_group(
                                ingress_rule, "tcp", check_ports, any_address=True
                            ):
                                # The port is open, now check if the instance is in a public subnet with a public IP
                                report.status = "FAIL"
                                (
                                    report.status_extended,
                                    report.check_metadata.Severity,
                                ) = get_instance_public_status(
                                    vpc_client.vpc_subnets, instance, "MongoDB"
                                )
                                is_open_port = True
                                break
                        if is_open_port:
                            break
            findings.append(report)
        return findings

References