All checks
High
EC2 instances should not have a public IPv4 address
Flags EC2 instances that have a public IPv4 address, whether auto-assigned or an Elastic IP. With a route to an internet gateway, that address makes the instance reachable from the internet, limited only by its security groups and network ACLs.
- service
- EC2
- severity
- High
- scope
- evaluated in every region
How to fix it
- Can break clients: Clients that connect to this address lose access and outbound IPv4 traffic through an internet gateway stops, so set up a load balancer or NAT gateway first if the instance needs either.
- Can't be undone: An auto-assigned address goes back to Amazon's pool and cannot be reused, so turning auto-assign on again gives the instance a different address.
- Replaces the resource: If Terraform sets associate_public_ip_address = true here, make this fix first and then set it to false, since an apply that sees the two disagree replaces the instance.
In the console
EC2 → Network Interfaces → the instance's primary interface → Actions → Manage IP addresses
- Elastic IP address
- None; disassociate any first (Actions → Disassociate address), since that can bring back an auto-assigned one
- Auto-assign public IP
- Disabled
With the AWS CLI
aws ec2 modify-network-interface-attribute --network-interface-id <eni-id> --no-associate-public-ip-addressSee which of your accounts this check is failing on.
Book a live scan