# Ensure No EC2 Instances Allow Ingress from the Internet to Elasticsearch and Kibana Ports (TCP 9200, 9300, 5601) - Source: https://support.icompaas.com/support/solutions/articles/62000233821-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-elasticsearch-and-kibana-ports-tcp-9200- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## **Profile Applicability:** - **Level 1** ### **Description:** Ensure that no EC2 instances are configured to allow ingress traffic from the internet to Elasticsearch and Kibana ports (TCP 9200, 9300, 5601). This helps prevent unauthorized access to these services and enhances security. ### **Rationale:** Restricting ingress traffic to Elasticsearch and Kibana ports enhances security by preventing potential unauthorized access and data breaches. It ensures that only trusted sources can communicate with these services. ### **Impact:** - Positive Impact: Improved security posture by restricting access to critical services. - Negative Impact: Potential connectivity issues if legitimate sources are inadvertently blocked. ### **Default Value:** By default, security groups may allow ingress traffic from the internet. Explicit configuration is required to restrict access. ### **Pre-Requisite:** - IAM Permissions: Ensure necessary permissions to view and modify security group settings. - AWS Services: Amazon EC2 - Tools Required: AWS Management Console, AWS CLI. ### **Remediation:** #### **Test plan:** #### **Using AWS Console:** 1. Sign In: Log in to the AWS Console. 2. Navigate to EC2 Dashboard. ![](https://support.icompaas.com/assets/kb/d1ba3d0f410fef04.png) 3. Go to the EC2 console. 4. In the navigation pane, choose Security Groups. ![](https://support.icompaas.com/assets/kb/744c7d3b51eeba36.png) 5. Select the security group associated with your EC2 instances. ![](https://support.icompaas.com/assets/kb/44c492ba2867acb7.png) 6. Click Edit inbound rules. ![](https://support.icompaas.com/assets/kb/8d84df843584130a.png) 7. Remove any rules that allow ingress traffic from the internet (0.0.0.0/0) to ports 9200, 9300, and 5601 ![](https://support.icompaas.com/assets/kb/ca576fc88f92132d.png) 8. Click Save rules to apply the changes. ![](https://support.icompaas.com/assets/kb/4306ca7673ab5cb2.png) #### **Using AWS CLI:** 1. Open Terminal: Open your terminal or command prompt. List Security Groups: Execute the following command to list all security groups: aws ec2 describe-security-groups --query 'SecurityGroups\[\*\].{ID:GroupId,Name:GroupName}' 2. Identify Security Group: Identify the security group associated with your EC2 instances. Revoke Ingress Rules: Execute the following command to revoke ingress rules that allow traffic from the internet to ports 9200, 9300, and 5601: aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 9200 --cidr 0.0.0.0/0 aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 9300 --cidr 0.0.0.0/0 aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 5601 --cidr 0.0.0.0/0 ### **Implementation:** #### **Using AWS Console:** 1. Log in to the AWS Console. 2. Navigate to EC2 Dashboard ![](https://support.icompaas.com/assets/kb/cf1ccd6c3114e9e8.png) 3. In the navigation pane, choose Security Groups. ![](https://support.icompaas.com/assets/kb/2db3b0771c8a69a3.png) 4. Review the security group rules to ensure no ingress traffic is allowed from the internet to ports 9200, 9300, and 5601. #### **Using AWS CLI:** 1. Open Terminal: Open your terminal or command prompt. 2. List Security Groups: Execute the following command to list all security groups: aws ec2 describe-security-groups --query 'SecurityGroups\[\*\].{ID:GroupId,Name:GroupName}' 3. Identify Security Group: Identify the security group associated with your EC2 instances. 4. Revoke Ingress Rules: Execute the the following command to revoke ingress rules that allow traffic from the internet to ports 9200, 9300, and 5601: aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 9200 --cidr 0.0.0.0/0 aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 9300 --cidr 0.0.0.0/0 aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 5601 --cidr 0.0.0.0/0 ### **Backout Plan:** ### **Using AWS Console:** 1. ### If disabling access to Elasticsearch and Kibana ports causes issues, re-enable the necessary inbound rule by editing the security group. 2. ### Allow access from specific trusted IPs or range, rather than from 0.0.0.0/0. ### **Using AWS CLI:** 1. ### To restore access to Elasticsearch or Kibana, run the following command to allow ingress from a specific IP address: aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 9200 --cidr /32 2. ### Verify that the necessary rules are in place: aws ec2 describe-security-groups --group-id ### **References:** - [AWS EC2 Security Group Configuration](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/changing-security-group.html) - [Setting Up Elasticsearch and Kibana on AWS EC2](https://www.businesscompassllc.com/setting-up-elasticsearch-and-kibana-on-aws-ec2-linux-a-comprehensive-guide/) **CIS Controls:**

Version	Control ID	Control Description
7.1	3.1	Ensure EC2 instances do not allow ingress from the internet to Elasticsearch (TCP 9200, 9300) and Kibana (TCP 5601) ports.
7.1	8.1	Enforce least privilege by restricting ingress access to Elasticsearch and Kibana to trusted sources or internal networks only.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.