Back to Checks
aws

EC2 instance does not allow ingress from the Internet to TCP port 5432 (PostgreSQL)

ec2_instance_port_postgresql_exposed_to_internet
Service: ec2Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2Instance

EC2 instances with security group rules allowing inbound PostgreSQL on TCP 5432 from the Internet (0.0.0.0/0 or ::/0) are identified, considering the instance's public reachability via IP and subnet.

Prowler logoProwlerprowler-provider-aws

Risk

Exposed TCP 5432 enables unauthenticated Internet probes and brute-force attempts against PostgreSQL, risking database confidentiality, integrity, and availability. Attackers could dump data, alter schemas, create backdoor accounts, pivot within the VPC, or exploit unpatched flaws at scale.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_port_postgresql_exposed_to_internet

Recommendation

Restrict PostgreSQL to trusted sources only:

  • Remove 0.0.0.0/0 and ::/0 rules
  • Apply least privilege security groups (allow from app tier or VPN)
  • Place instances in private subnets without public IPs
  • Enforce TLS and strong auth; disable unused listeners
  • Layer with NACLs and monitoring for defense in depth

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 5432 --cidr 0.0.0.0/0

Terraform

# Restrict PostgreSQL (5432) from Internet
resource "aws_security_group" "<example_resource_name>" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 5432
    to_port     = 5432
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # CRITICAL: not 0.0.0.0/0; prevents Internet exposure
  }
}

NativeIaC

# CloudFormation: restrict PostgreSQL (5432) from Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict PostgreSQL
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 10.0.0.0/8  # CRITICAL: not 0.0.0.0/0; limits access to internal range

Other

1In AWS Console, go to EC2 > Security Groups
2Select the group attached to the instance
3In Inbound rules, find any rule for PostgreSQL (TCP 5432) with source 0.0.0.0/0 or ::/0
4Delete the rule or change the source to a specific trusted CIDR only
5Save rules

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.instance import get_instance_public_status
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class ec2_instance_port_postgresql_exposed_to_internet(Check):
    # EC2 Instances with PostgreSQL port 5432 open to the Internet will be flagged as FAIL with a severity of medium if the instance has no public IP, high if the instance has a public IP but is in a private subnet, and critical if the instance has a public IP and is in a public subnet.
    def execute(self):
        findings = []
        check_ports = [5432]
        for instance in ec2_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = f"Instance {instance.id} does not have PostgreSQL port 5432 open to the Internet."
            is_open_port = False
            if instance.security_groups:
                for sg in ec2_client.security_groups.values():
                    if sg.id in instance.security_groups:
                        for ingress_rule in sg.ingress_rules:
                            if check_security_group(
                                ingress_rule, "tcp", check_ports, any_address=True
                            ):
                                # The port is open, now check if the instance is in a public subnet with a public IP
                                report.status = "FAIL"
                                (
                                    report.status_extended,
                                    report.check_metadata.Severity,
                                ) = get_instance_public_status(
                                    vpc_client.vpc_subnets, instance, "PostgreSQL"
                                )
                                is_open_port = True
                                break
                        if is_open_port:
                            break
            findings.append(report)
        return findings

References