Back to Checks
aws

EC2 instance does not allow ingress from the Internet to TCP ports 1433 or 1434 (SQL Server)

ec2_instance_port_sqlserver_exposed_to_internet
Service: ec2Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2Instance

EC2 instances with security groups permitting any source to TCP 1433 or 1434 (SQL Server) are identified, considering the instance's public reachability based on IP and subnet exposure.

Prowler logoProwlerprowler-provider-aws

Risk

Internet-reachable SQL services enable:

  • Brute-force and credential-stuffing of DB logins
  • Exploitation of SQL Server flaws for remote code execution
  • Unauthorized queries and data exfiltration This threatens confidentiality and integrity, and facilitates lateral movement from the database host.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_port_sqlserver_exposed_to_internet

Recommendation

Enforce least privilege and defense in depth:

  • Remove 0.0.0.0/0 and ::/0 to 1433-1434
  • Allow only trusted IPs or app tiers via security group references
  • Keep databases in private subnets without public IPs; access via VPN or bastion
  • Require TLS and strong authentication; monitor access.

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":1433,"ToPort":1434,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]}]'

Terraform

# Restrict SQL Server ports to non-Internet sources
resource "aws_security_group" "<example_resource_name>" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 1433
    to_port     = 1434
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # FIX: do not use 0.0.0.0/0; restricts access to prevent Internet exposure
  }
}

NativeIaC

# CloudFormation: restrict SQL Server ports to non-Internet sources
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict SQL ports
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 1433
          ToPort: 1434
          CidrIp: 10.0.0.0/8  # FIX: do not use 0.0.0.0/0; limits access to internal range to close Internet exposure

Other

1In the AWS Console, go to VPC > Security Groups
2Select the security group attached to the affected EC2 instance
3In the Inbound rules tab, click Edit inbound rules
4Delete any rule allowing TCP 1433 or 1434 from 0.0.0.0/0 or ::/0
5If access is required, add a rule for TCP 1433-1434 with a specific trusted source (e.g., your office IP or another security group)
6Click Save rules

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.instance import get_instance_public_status
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class ec2_instance_port_sqlserver_exposed_to_internet(Check):
    # EC2 Instances with SQL Server ports open to the Internet will be flagged as FAIL with a severity of medium if the instance has no public IP, high if the instance has a public IP but is in a private subnet, and critical if the instance has a public IP and is in a public subnet.
    def execute(self):
        findings = []
        check_ports = [1433, 1434]
        for instance in ec2_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = f"Instance {instance.id} does not have SQL Server ports open to the Internet."
            is_open_port = False
            if instance.security_groups:
                for sg in ec2_client.security_groups.values():
                    if sg.id in instance.security_groups:
                        for ingress_rule in sg.ingress_rules:
                            if check_security_group(
                                ingress_rule, "tcp", check_ports, any_address=True
                            ):
                                # The port is open, now check if the instance is in a public subnet with a public IP
                                report.status = "FAIL"
                                (
                                    report.status_extended,
                                    report.check_metadata.Severity,
                                ) = get_instance_public_status(
                                    vpc_client.vpc_subnets, instance, "SQL Server"
                                )
                                is_open_port = True
                                break
                        if is_open_port:
                            break
            findings.append(report)
        return findings

References