Back to Checks
e2enetworks

E2E Networks database cluster master nodes do not expose a public IP

database_cluster_public_ip_not_assigned
Service: databaseSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

The master node of each E2E Networks database cluster should be reachable only over private networking and must not have a public IP address assigned.

Prowler logoProwlerprowler-provider-e2enetworks

Risk

A public database endpoint is directly reachable from the internet, expanding the attack surface and increasing the risk of unauthorized access, brute-force attempts, and data exposure.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler e2enetworks --checks database_cluster_public_ip_not_assigned

Recommendation

Remove the public IP from the master node of database clusters and access them through private networking such as a VPC.

Check Code

from prowler.lib.check.models import Check, CheckReportE2eNetworks
from prowler.providers.e2enetworks.services.database.database_client import (
    database_client,
)


class database_cluster_public_ip_not_assigned(Check):
    """Check if E2E Networks database clusters do not expose a public IP on the master node."""

    def execute(self) -> list[CheckReportE2eNetworks]:
        findings = []
        for cluster in database_client.clusters:
            report = CheckReportE2eNetworks(metadata=self.metadata(), resource=cluster)
            report.status = "PASS"
            report.status_extended = f"Database cluster {cluster.name} master node does not have a public IP."
            if cluster.master_has_public_ip:
                report.status = "FAIL"
                report.status_extended = f"Database cluster {cluster.name} master node has a public IP assigned."
            findings.append(report)
        return findings

References