Check your EC2 security groups for inbound rules that allow unrestricted access (i.e. 0.0.0.0/0 or ::/0) to TCP ports 20 and 21 and restrict access to only those IP addresses that require it in order to implement the principle of least privilege and reduce the possibility of a breach. TCP ports 20 and 21 are used for data transfer and communication by the File Transfer Protocol (FTP) client-server applications: https://goo.gl/bBwI7t.
This rule can help you with the following compliance standards:
This rule can help you work with the AWS Well-Architected Framework
This rule resolution is part of the Cloud Conformity Security & Compliance tool for AWS
Allowing unrestricted FTP access can increase opportunities for malicious activity such as brute-force attacks, FTP bounce attacks, spoofing attacks and packet capture.
To determine if your EC2 security groups allow unrestricted FTP access, perform the following:
To update your security groups inbound/ingress configuration in order to restrict FTP access to specific entities (IP addresses, IP ranges, etc), perform the following: