Check your Amazon EC2 security groups for inbound rules that allow unrestricted access (i.e. 0.0.0.0/0 or ::/0) on TCP and/or UDP port 11211 in order to reduce the attack surface and protect the Memcached cache server instances associated with your security groups. Memcached is an open-source, high-performance, distributed memory object caching system, intended for use in speeding up dynamic websites and web applications by alleviating database load.
This rule can help you work with the AWS Well-Architected Framework.
This rule resolution is part of the Conformity Security & Compliance tool for AWS.
Allowing unrestricted inbound/ingress access on TCP and/or UDP port 11211 (Memcached) to your Amazon EC2 instances can increase opportunities for malicious activities such as DDoS amplification attacks, which can have a serious impact on the health and stability of your web services and applications.
Audit
To determine if your Amazon EC2 security groups allow unrestricted Memcached access, perform the following actions:
Remediation / Resolution
To update the inbound rule configuration for your Amazon EC2 security groups in order to restrict Memcached service access to trusted entities only (i.e. authorized IP addresses and IP ranges, or other security groups), perform the following actions:
References
- AWS Documentation
- Amazon EC2 security groups for Linux instances
- Working with security groups
- Security group rules reference
- Authorizing inbound traffic for your Linux instances
- AWS Command Line Interface (CLI) Documentation
- ec2
- describe-security-groups
- revoke-security-group-ingress
- authorize-security-group-ingress
- Memcached Documentation
- Memcached
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
You are auditing:
Check for Unrestricted Memcached Access
Risk Level: Very High