Checks

EC2 instances with a public IP address and an attached instance profile (IAM role) are identified.

Instances lacking public exposure or without an instance profile are excluded.

EC2 instances are assessed for enrollment as Systems Manager managed nodes. Running instances lacking Systems Manager registration are marked as unmanaged; instances in stopped, terminated, or pending states are noted separately.

EC2 instances are evaluated for age while in running state. Instances launched beyond the configurable limit (max_ec2_instance_age_in_days, default 180) are flagged as older than the allowed lifetime. Stopped instances are ignored.

EC2 instances are evaluated for their virtualization mode. Instances with virtualization_type set to paravirtual are identified; those using HVM are recognized as hardware-assisted virtualization.

EC2 instances have Cassandra service ports (7000, 7001, 7199, 9042, 9160) reachable from the Internet through security group ingress.

Public IP presence and subnet exposure are considered to assess external reachability.

EC2 instances with security groups permitting inbound TCP 139 or 445 (CIFS/SMB) from 0.0.0.0/0 are identified.

Exposure level reflects whether the instance has a public IP and the subnet's Internet reachability.

EC2 instances with Elasticsearch/Kibana ports (9200, 9300, 5601) exposed to the Internet through inbound security group rules.

Assesses reachability considering instance public IP and subnet to reflect real exposure.

EC2 instances with security groups permitting inbound FTP on TCP 20-21 from any address (e.g., 0.0.0.0/0 or ::/0) are identified.

Exposure is contextualized by the instance's public reachability (public IP and subnet).

EC2 instances with security group rules that allow inbound TCP 9092 (Kafka) from the Internet are reported. The evaluation inspects ingress rules to detect broad sources (for example 0.0.0.0/0 or ::/0) that expose Kafka brokers.

EC2 instances whose security groups allow public inbound TCP access to Kerberos ports 88, 464, 749, or 750 (authentication, password change, admin).

Rules permitting 0.0.0.0/0 or ::/0 are treated as Internet-exposed.

EC2 instances with security groups permitting Internet-sourced access to LDAP on TCP 389 or LDAPS on TCP 636 are identified.

Public exposure context (presence of public IP and subnet reachability) is considered to gauge how broadly these ports can be accessed.

EC2 instances are evaluated for open Memcached access: inbound TCP 11211 allowed from any address (0.0.0.0/0 or ::/0) via their security groups, considering the instance's public exposure.

EC2 instances with security groups permitting inbound TCP 27017 or 27018 (MongoDB) from 0.0.0.0/0 or ::/0 are identified, factoring the instance's public reachability to gauge exposure.

EC2 instances with security groups that expose MySQL on TCP 3306 to the Internet (0.0.0.0/0 or ::/0) are identified, with context on public IP and subnet exposure.

EC2 instances with security groups allowing inbound TCP from any address to Oracle listener ports 1521, 2483, or 2484

EC2 instances with security group rules allowing inbound PostgreSQL on TCP 5432 from the Internet (0.0.0.0/0 or ::/0) are identified, considering the instance's public reachability via IP and subnet.

EC2 instances whose security groups allow Internet-wide inbound RDP on TCP 3389 (0.0.0.0/0 or ::/0). The instance's public IP and subnet routing are considered to determine external reachability.

EC2 instances with security groups permitting Internet access to Redis on TCP 6379 are identified.

Exposure is assessed using public IP assignment and subnet reachability to reflect how broadly the service can be contacted.

EC2 instances with security groups permitting any source to TCP 1433 or 1434 (SQL Server) are identified, considering the instance's public reachability based on IP and subnet exposure.

EC2 instances with SSH (TCP 22) exposed to the Internet via security group inbound rules allowing 0.0.0.0/0 or ::/0.

Exposure is qualified using the instance's public IP status and subnet reachability.

EC2 instances with security groups allowing inbound Telnet on TCP 23 from the Internet are identified, including open IPv4/IPv6 sources like 0.0.0.0/0 and ::/0.

Exposure is evaluated considering public IP assignment and subnet reachability.

EC2 instances are evaluated for association with an IAM instance profile role that delivers temporary credentials to workloads running on the instance

EC2 instances are assessed for the presence of a public IPv4 address and public DNS. A public IP indicates the instance is directly reachable from the Internet; no public IP implies access only through private networking paths such as load balancers, gateways, or proxies.

EC2 instance User Data is inspected for secret-like values (credentials, tokens, keys). Both plain and compressed content are parsed, honoring configured exclusions, to identify patterns that resemble sensitive material within initialization scripts.