The Exposed Port

An engineer spins up an EC2 instance during a late-night deployment. Port 22 goes in as a temporary convenience - just until the setup is done. The instance gets its workload, the team moves on, and the rule is never revisited. Three days later, a GuardDuty alert fires: UnauthorizedAccess:EC2/SSHBruteForce. The port has been answering automated scanners since the moment the instance came online.

Modern AWS environments require no inbound management ports. AWS Systems Manager Session Manager provides authenticated, audited shell access over the AWS control plane - no inbound rules, no key pairs, no brute-force surface. The port was never needed. This room shows you how to find it, close it, and build correctly from the start.

Learning Objectives

By the end of this room, you will be able to:

• Understand how an exposed management port creates a persistent brute-force attack vector
• Identify EC2 instances with SSH or RDP open to 0.0.0.0/0 using the CLI
• Confirm whether AWS Systems Manager is already available on a running instance
• Remove a public inbound management rule without interrupting administrative access
• Build a new instance with no inbound management port from the start
• Use Session Manager as the standard, auditable access path for EC2 administration

Prerequisites

• Being able to set up your environment (First Steps Into AWS room)
• Basic Linux commands (Linux Fundamentals room)
• Have a basic understanding of the AWS compute service (Introduction to Cloud Computing room)