Back to Checks
e2enetworks

E2E Networks database read replicas do not have a public IP assigned

database_replica_public_ip_not_assigned
Service: databaseSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

E2E Networks database read replicas should be reachable only over private networking and must not have a public IP address assigned.

Prowler logoProwlerprowler-provider-e2enetworks

Risk

Read replicas with public IPs are directly reachable from the internet, expanding database exposure and increasing the risk of unauthorized access to replicated data.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler e2enetworks --checks database_replica_public_ip_not_assigned

Recommendation

Remove the public IP from database read replicas and route access through private networking.

Check Code

from prowler.lib.check.models import Check, CheckReportE2eNetworks
from prowler.providers.e2enetworks.services.database.database_client import (
    database_client,
)


class database_replica_public_ip_not_assigned(Check):
    """Check if E2E Networks database read replicas do not have a public IP assigned."""

    def execute(self) -> list[CheckReportE2eNetworks]:
        findings = []
        for instance in database_client.instances:
            if instance.role != "replica":
                continue
            report = CheckReportE2eNetworks(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = (
                f"Database replica {instance.name} does not have a public IP assigned."
            )
            if instance.has_public_ip:
                report.status = "FAIL"
                report.status_extended = (
                    f"Database replica {instance.name} has a public IP assigned."
                )
            findings.append(report)
        return findings

References