Back to Checks
aws

EC2 instance does not allow ingress from the Internet to TCP port 3389 (RDP)

ec2_instance_port_rdp_exposed_to_internet
Service: ec2Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2Instance

EC2 instances whose security groups allow Internet-wide inbound RDP on TCP 3389 (0.0.0.0/0 or ::/0). The instance's public IP and subnet routing are considered to determine external reachability.

Prowler logoProwlerprowler-provider-aws

Risk

Internet-exposed RDP allows:

  • Brute force and credential reuse on Windows logons
  • Exploitation of RDP flaws for remote code execution
  • Lateral movement and data exfiltration This threatens confidentiality, integrity, and availability through data theft, tampering, account lockouts, or ransomware.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_port_rdp_exposed_to_internet

Recommendation

Remove Internet-wide RDP. Apply least privilege:

  • Restrict TCP 3389 to trusted IPs
  • Prefer private access via VPN or a hardened bastion; consider Session Manager
  • Use just-in-time access and short-lived rules
  • Enforce strong auth (e.g., NLA) and monitor logs Adopt defense in depth with layered network controls.

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 3389 --cidr 0.0.0.0/0

Terraform

# Restrict RDP so it's not open to the Internet
resource "aws_security_group" "<example_resource_name>" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 3389
    to_port     = 3389
    protocol    = "tcp"
    cidr_blocks = ["<TRUSTED_CIDR>"]  # CRITICAL: restrict RDP to a specific CIDR; not 0.0.0.0/0 or ::/0
  }
}

NativeIaC

# CloudFormation: restrict RDP so it's not open to the Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict RDP access
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3389
          ToPort: 3389
          CidrIp: <TRUSTED_CIDR>  # CRITICAL: limit RDP to a specific CIDR to avoid 0.0.0.0/0 (::/0)

Other

1In AWS Console, go to EC2 > Security Groups
2Open each security group attached to the affected instance
3In Inbound rules, find any rule allowing TCP 3389 from 0.0.0.0/0 or ::/0
4Delete the rule, or edit Source to a specific trusted IP/CIDR only
5Click Save rules

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.instance import get_instance_public_status
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class ec2_instance_port_rdp_exposed_to_internet(Check):
    # EC2 Instances with RDP port 3389 open to the Internet will be flagged as FAIL with a severity of medium if the instance has no public IP, high if the instance has a public IP but is in a private subnet, and critical if the instance has a public IP and is in a public subnet.
    def execute(self):
        findings = []
        check_ports = [3389]
        for instance in ec2_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = f"Instance {instance.id} does not have RDP port 3389 open to the Internet."
            is_open_port = False
            if instance.security_groups:
                for sg in ec2_client.security_groups.values():
                    if sg.id in instance.security_groups:
                        for ingress_rule in sg.ingress_rules:
                            if check_security_group(
                                ingress_rule, "tcp", check_ports, any_address=True
                            ):
                                # The port is open, now check if the instance is in a public subnet with a public IP
                                report.status = "FAIL"
                                (
                                    report.status_extended,
                                    report.check_metadata.Severity,
                                ) = get_instance_public_status(
                                    vpc_client.vpc_subnets, instance, "RDP"
                                )
                                is_open_port = True
                                break
                        if is_open_port:
                            break
            findings.append(report)
        return findings

References