6WAF

Database or cache port open to the internet

CRITICAL / HIGH

What's the problem

A Security Group allows TCP 3306, 5432, 1433, 1521, 27017, 6379, 11211, 9200 or 5601 from 0.0.0.0/0 or ::/0 (including port-range rules). Critical for ports on the EC2.19 list (MySQL, PostgreSQL, SQL Server, OpenSearch, Kibana), High for the others (EC2.18)

How 6WAF detects it

  • Deterministic checks through AWS API calls (IAM, S3, EC2/VPC, CloudTrail, KMS) — no LLM is used for detection; severity is the value the scanner assigns, shown above.
  • Scanning uses an IAM Role you deploy yourself via CloudFormation; 6WAF stores no credentials and you revoke access any time by deleting the stack.
  • Automated scoring covers only part of the scope of standards such as ISO 27001 — this is a technical assessment, not a certification.

Pillar: Security — Fast Scan

Group: Network (Security Groups, VPC, public endpoints)

Reference standard: AWS Security Hub EC2.19 · EC2.18

Get the 39-point AWS waste checklist by email (free, self-serve)

Unticked: we only send the checklist and delete the email after 90 days. Privacy policy

Scan this check (and the other 91) automatically in ~10 minutes

Start free

Related checks

Security Group open to all internet trafficPort 22 (SSH) open to the internetPort 3389 (RDP) open to the internetVPC has no Flow Logs