Back to Checks
aws

Lightsail instance has no publicly accessible ports

lightsail_instance_public
Service: lightsailSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Other

Lightsail instances that have a public IP and at least one firewall rule allowing public ports are treated as publicly exposed. The evaluation inspects instance addressing and port rules to detect any port or range marked public.

Prowler logoProwlerprowler-provider-aws

Risk

Public IP plus open ports enables Internet scanning, brute force, and exploits.

  • Confidentiality: data exfiltration
  • Integrity: RCE/admin takeover via exposed services
  • Availability: DoS or abuse (botnets, cryptomining), service disruption

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks lightsail_instance_public

Recommendation

Apply least privilege network access: close unused ports, restrict sources (avoid 0.0.0.0/0), and review IPv4/IPv6 rules. Use a VPN or bastion host for administration. Place services behind private networking or load balancers, and harden/monitor any required public endpoints.

Remediation

CLI

aws lightsail put-instance-public-ports --instance-name <example_resource_name> --port-infos '[]'

Terraform

# Terraform: ensure no public ports are open on the Lightsail instance
resource "aws_lightsail_instance_public_ports" "<example_resource_name>" {
  instance_name = "<example_resource_name>"

  # Critical: no port_info blocks -> no public ports are configured (closes all)
  dynamic "port_info" {
    for_each = []
    content {
      from_port = 0
      to_port   = 0
      protocol  = "tcp"
    }
  }
}

NativeIaC

# CloudFormation: remove all public ports from a Lightsail instance
Resources:
  ClosePublicPorts:
    Type: AWS::Lightsail::InstancePublicPorts
    Properties:
      InstanceName: <example_resource_name>
      PortInfos: []  # Critical: empty list clears all public ports so the instance is not publicly exposed

Other

1Sign in to the AWS Lightsail console
2Go to Instances and select <example_resource_name>
3Open the Networking tab
4In IPv4 Firewall, delete all existing rules, then Save
5If IPv6 is enabled, in IPv6 Firewall, delete all existing rules, then Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.lightsail.lightsail_client import lightsail_client


class lightsail_instance_public(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []

        for instance in lightsail_client.instances.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = (
                f"Instance '{instance.name}' is not publicly exposed."
            )

            open_public_ports = [
                port for port in instance.ports if port.access_type == "public"
            ]

            if instance.public_ip != "" and len(open_public_ports) > 0:
                report.status = "FAIL"
                report.status_extended = f"Instance '{instance.name}' is publicly exposed. The open ports are: {', '.join(open_port.range for open_port in open_public_ports)}"

            findings.append(report)

        return findings

References