Back to Checks
aws

EC2 instance does not allow ingress from the Internet to TCP port 3306 (MySQL)

ec2_instance_port_mysql_exposed_to_internet
Service: ec2Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2Instance

EC2 instances with security groups that expose MySQL on TCP 3306 to the Internet (0.0.0.0/0 or ::/0) are identified, with context on public IP and subnet exposure.

Prowler logoProwlerprowler-provider-aws

Risk

Publicly reachable MySQL enables Internet scanning, brute force, and credential stuffing, leading to unauthorized queries and data dumps (confidentiality). Attackers can alter or delete data (integrity), overload the service with query floods (availability), and pivot from the DB host into adjacent workloads.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_port_mysql_exposed_to_internet

Recommendation

Restrict TCP 3306 to trusted sources per least privilege:

  • Allow DB access only from specific application subnets or security groups
  • Place database hosts in private subnets without public IPs
  • Apply defense in depth with VPN/peering for admin access, TLS for connections, and host firewalls; optionally reinforce with NACLs

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 3306 --cidr 0.0.0.0/0

Terraform

# Restrict MySQL (3306) from Internet
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 3306
    to_port     = 3306
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # Critical: do NOT use 0.0.0.0/0; restrict 3306 to a private CIDR
  }
}

NativeIaC

# CloudFormation: restrict MySQL (3306) from Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict MySQL access
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          CidrIp: 10.0.0.0/8  # Critical: do NOT use 0.0.0.0/0; restrict 3306 to a private range

Other

1In the AWS Console, go to EC2 > Security Groups
2Select the security group attached to the affected instance
3Click Inbound rules > Edit inbound rules
4Find the rule allowing TCP 3306 from 0.0.0.0/0 or ::/0 and delete it
5(If access is required) Add a rule for TCP 3306 from a specific private CIDR or trusted IP range only
6Save rules

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.instance import get_instance_public_status
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class ec2_instance_port_mysql_exposed_to_internet(Check):
    # EC2 Instances with MySQL port 3306 open to the Internet will be flagged as FAIL with a severity of medium if the instance has no public IP, high if the instance has a public IP but is in a private subnet, and critical if the instance has a public IP and is in a public subnet.
    def execute(self):
        findings = []
        check_ports = [3306]
        for instance in ec2_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = f"Instance {instance.id} does not have MySQL port 3306 open to the Internet."
            is_open_port = False
            if instance.security_groups:
                for sg in ec2_client.security_groups.values():
                    if sg.id in instance.security_groups:
                        for ingress_rule in sg.ingress_rules:
                            if check_security_group(
                                ingress_rule, "tcp", check_ports, any_address=True
                            ):
                                # The port is open, now check if the instance is in a public subnet with a public IP
                                report.status = "FAIL"
                                (
                                    report.status_extended,
                                    report.check_metadata.Severity,
                                ) = get_instance_public_status(
                                    vpc_client.vpc_subnets, instance, "MySQL"
                                )
                                is_open_port = True
                                break
                        if is_open_port:
                            break
            findings.append(report)
        return findings

References