Back to Checks
huaweicloud

ECS instances should not have public IP addresses

ecs_instance_public_ip
Service: ecsSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

Ensure that Elastic Cloud Server (ECS) instances do not have public IP addresses assigned, reducing exposure to the internet.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

ECS instances with public IP addresses are directly accessible from the internet, which increases the attack surface and risk of unauthorized access, data exfiltration, or exploitation.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks ecs_instance_public_ip

Recommendation

Remove public IP addresses from ECS instances. Use NAT Gateways or VPN connections for instances that require outbound internet access, and Load Balancers for inbound access.

Remediation

CLI

hcloud EIP DisassociatePublicips --publicip_id=<eip_id>

Other

1Log on to the **Huawei Cloud** console
2Navigate to **Elastic Cloud Server**
3Select the instance with a **public IP**
4Unbind the `EIP` from the instance
5Use a **NAT gateway** or `VPN` for outbound connectivity if needed

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.ecs.ecs_client import ecs_client


class ecs_instance_public_ip(Check):
    """Ensure ECS instances do not have public IP addresses."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        for instance in ecs_client.instances.values():
            report = CheckReportHuaweiCloud(metadata=self.metadata(), resource=instance)
            report.region = instance.region
            report.resource_id = instance.id
            report.resource_arn = f"huaweicloud:ecs:{instance.region}:{ecs_client.audited_account}:instance/{instance.id}"

            if instance.public_ip:
                report.status = "FAIL"
                report.status_extended = f"ECS instance {instance.name} ({instance.id}) has a public IP: {instance.public_ip}."
            else:
                report.status = "PASS"
                report.status_extended = f"ECS instance {instance.name} ({instance.id}) does not have a public IP."

            findings.append(report)

        return findings

References