Skip to content

Security Group attached to EC2 instance allows inbound traffic from all to TCP port 6379 (Redis)

Description

Redis should not be publicly accessible from the internet to protect data from unauthorized user access, data loss and possible leakage of sensitive data. As a general precaution if any resource needs to be open to the internet, it must first undergo a security review and approval from DSO.

Fix - Runtime

Procedure

  1. Change the access control policy and security groups to make the Redis endpoint private.
  2. Allow access to a specific list of IP addresses.
  3. Once the Redis endpoint is not publicly accessible Prowler will automatically close the issue.
  4. You can also request exception from the policy violation details page.
  5. SecOps will review and involve DSO if required and grant exception; Prowler will automatically ignore this resource until the expiry of exception.