# Ensure security groups do not allow ingress from 0.0.0.0/0 or ::/0 to Cassandra TCP ports 7199, 9160 or 8888

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292204848471-ensure-security-groups-do-not-allow-ingress-from-00000-or-0-to-cassandra-tcp-ports-7199-9160-or-8888
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that no Amazon EC2 security group allows inbound TCP traffic from the Internet (0.0.0.0/0 or ::/0) to the Apache Cassandra ports 7199 (JMX monitoring), 9160 (Thrift client) or 8888 (OpsCenter web console). Access to these ports should be limited to trusted networks or specific security groups. Security groups that have all ports open to the Internet are reported by the separate check for all ports and pass this check, so they are not reported twice.

**Rationale**

Cassandra's JMX, Thrift and OpsCenter interfaces allow reading data and metrics, changing schemas and cluster settings, and running administrative operations. If these ports are open to the Internet, anyone can reach them and attempt unauthorized data access, cluster modification or service disruption. Publicly exposed database ports are also continuously scanned for brute-force and known exploits. Restricting ingress to trusted sources applies least privilege at the network layer and reduces the attack surface of the database tier.

**Impact**

-   Prevents direct Internet access to Cassandra management and client interfaces
    
-   Reduces the risk of data exposure, unauthorized cluster changes and service outages
    
-   Clients or administrators currently connecting over the Internet will lose access until their source addresses are added as trusted CIDRs, or they connect through a VPN or bastion host
    

**Default Value**

A newly created security group has no inbound rules, so all inbound traffic is denied by default. Unrestricted access to ports 7199, 9160 or 8888 exists only if a rule was explicitly added.

**Pre-Requisites**

-   IAM permissions: ec2:DescribeSecurityGroups, ec2:DescribeSecurityGroupRules, ec2:RevokeSecurityGroupIngress and ec2:AuthorizeSecurityGroupIngress
    
-   A list of the trusted CIDR ranges or security groups that legitimately need access to Cassandra
    
-   Confirmation from the application owner that no required client depends on Internet access to these ports
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EC2 console and select **Security Groups** under **Network & Security**.
    
3.  Select a security group and open the **Inbound rules** tab.
    
4.  Check for any rule whose source is 0.0.0.0/0 or ::/0 and that either:
    
    -   has type **All traffic**, or
        
    -   uses protocol TCP with a port or port range that includes 7199, 9160 or 8888.
        
5.  Repeat for each security group in each region in use.
    
6.  If such a rule exists, follow the implementation steps.
    

**CLI:**

List the security groups that have any rule open to the Internet:

aws ec2 describe-security-groups --region <REGION> --filters Name=ip-permission.cidr,Values=0.0.0.0/0 --query "SecurityGroups\[\].GroupId"  
aws ec2 describe-security-groups --region <REGION> --filters Name=ip-permission.ipv6-cidr,Values=::/0 --query "SecurityGroups\[\].GroupId"

For each group returned, list its public inbound rules:

aws ec2 describe-security-group-rules --region <REGION> --filters Name=group-id,Values=<SECURITY\_GROUP\_ID> --query "SecurityGroupRules\[?IsEgress==\\\`false\\\` && (CidrIpv4=='0.0.0.0/0' || CidrIpv6=='::/0')\].\[SecurityGroupRuleId,IpProtocol,FromPort,ToPort,CidrIpv4,CidrIpv6\]" --output table

The group fails if any row has protocol tcp with a FromPort–ToPort range that includes 7199, 9160 or 8888 but is narrower than 0-65535. Rows with protocol -1 (all traffic) or the full range 0-65535 mean all ports are open; such groups are reported by the separate check for all ports and pass this check. A security group that has all ports open to the Internet passes this check, because it is reported by the separate check for all ports.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EC2 console and select **Security Groups** under **Network & Security**.
    
3.  Select the security group found in the Test Plan and open the **Inbound rules** tab.
    
4.  Choose **Edit inbound rules** and delete any rule whose source is 0.0.0.0/0 or ::/0 and that either:
    
    -   has type **All traffic**, or
        
    -   uses protocol TCP with a port or port range that includes 7199, 9160 or 8888.
        
5.  If access to Cassandra is still needed, choose **Add rule**, select type **Custom TCP**, enter the required port and set the source to a trusted IP range or security group.
    
6.  Choose **Save rules**.
    
7.  Repeat for each affected security group in each region in use.
    

**CLI:**

Remove the public rules for the three Cassandra ports:

aws ec2 revoke-security-group-ingress --group-id <SECURITY\_GROUP\_ID> --ip-permissions IpProtocol=tcp,FromPort=7199,ToPort=7199,IpRanges='\[{CidrIp=0.0.0.0/0}\]',Ipv6Ranges='\[{CidrIpv6=::/0}\]' IpProtocol=tcp,FromPort=9160,ToPort=9160,IpRanges='\[{CidrIp=0.0.0.0/0}\]',Ipv6Ranges='\[{CidrIpv6=::/0}\]' IpProtocol=tcp,FromPort=8888,ToPort=8888,IpRanges='\[{CidrIp=0.0.0.0/0}\]',Ipv6Ranges='\[{CidrIpv6=::/0}\]'

If the rule is a port range or **All traffic**, remove it using the rule ID from the Test Plan output:

aws ec2 revoke-security-group-ingress --group-id <SECURITY\_GROUP\_ID> --security-group-rule-ids <SECURITY\_GROUP\_RULE\_ID>

If access is still needed, allow the port from a trusted IP range only (repeat for each port):

aws ec2 authorize-security-group-ingress --group-id <SECURITY\_GROUP\_ID> --ip-permissions IpProtocol=tcp,FromPort=9160,ToPort=9160,IpRanges='\[{CidrIp=<TRUSTED\_CIDR>,Description="Cassandra access from trusted network"}\]'

**Backout Plan**

Before making changes, save the current inbound rules:

aws ec2 describe-security-group-rules --filters Name=group-id,Values=<SECURITY\_GROUP\_ID> > <SECURITY\_GROUP\_ID>-rules-backup.json

To roll back:

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Go to **EC2 > Security Groups** and select the security group.
    
3.  In **Inbound rules**, choose **Edit inbound rules**.
    
4.  Re-add the removed rules using the saved backup (protocol, port range and source).
    
5.  Choose **Save rules**.
    

Note: rolling back re-exposes the Cassandra ports to the Internet. Use it only as a temporary measure while access through trusted sources is arranged.

**Reference**

-   [https://docs.aws.amazon.com/vpc/latest/userguide/VPC\_SecurityGroups.html](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html)
    
-   [https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html](https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html](https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-group-rules.html](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-group-rules.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.