Common AWS ports and their uses in security groups

Common Ports and Their Utility in AWS

1. Port 22 (SSH - Secure Shell)
   • Utility: This is the primary port for securely connecting to your Linux EC2 instances. It allows you to execute commands, transfer files, and manage your server remotely.
   • Security Note: For production environments, it's highly recommended to restrict SSH access to specific IP addresses (e.g., your office IP, a jump box IP) rather than 0.0.0.0/0 (anywhere).
2. Port 80 (HTTP - Hypertext Transfer Protocol)
   • Utility: Used for unencrypted web traffic. If you're hosting a website or web application, this port needs to be open for users to access it via a web browser.
   • Security Note: While still common, it's best practice to use HTTPS (Port 443) for all web traffic to ensure data encryption.
3. Port 443 (HTTPS - Hypertext Transfer Protocol Secure)
   • Utility: Used for encrypted web traffic. This is the standard for secure communication over the internet, essential for e-commerce, login pages, and any site handling sensitive data. It uses SSL/TLS for encryption.
   • Security Note: Always prioritize HTTPS over HTTP for public-facing web applications.
4. Port 3389 (RDP - Remote Desktop Protocol)
   • Utility: This port is used to connect to Windows EC2 instances via Remote Desktop. It provides a graphical interface for managing your Windows server.
   • Security Note: Similar to SSH, restrict RDP access to specific trusted IP addresses. Exposing RDP to 0.0.0.0/0 is a significant security risk.
5. Port 21 (FTP - File Transfer Protocol)
   • Utility: Used for transferring files between a client and a server.
   • Security Note: FTP is unencrypted and generally considered insecure for sensitive data. SFTP (SSH File Transfer Protocol, which uses Port 22) or SCP are more secure alternatives.
6. Port 20/21 (FTP Data/Control)
   • Utility: FTP uses two ports: 21 for control commands and 20 for data transfer in active mode.
   • Security Note: Due to the complexity of FTP and its security vulnerabilities, it's often avoided in modern cloud architectures in favor of SFTP or cloud storage solutions like S3.
7. Port 25 (SMTP - Simple Mail Transfer Protocol)
   • Utility: Used for sending email. If your EC2 instance needs to send outbound emails directly (e.g., for notifications), this port might be used.
   • Security Note: AWS often restricts outbound traffic on Port 25 by default to prevent spam. You might need to request an unblock from AWS support. Using AWS SES (Simple Email Service) is generally a better and more scalable approach for sending emails from EC2.
8. Port 53 (DNS - Domain Name System)
   • Utility: Used for DNS queries. Your instances need to communicate on this port to resolve domain names to IP addresses.
   • Security Note: Typically, this port is allowed for outbound traffic to AWS's internal DNS resolvers or public DNS servers. Inbound DNS is usually only needed if your EC2 instance is acting as a DNS server itself.
9. Port 1433 (MS SQL Server)
   • Utility: The default port for Microsoft SQL Server. If you have an MS SQL database running on an EC2 instance, this port needs to be open for clients (applications, other EC2 instances) to connect to it.
   • Security Note: Restrict access to only the necessary application servers or specific IP ranges. Ideally, use AWS RDS for managed databases.
10. Port 3306 (MySQL/Aurora)
    • Utility: The default port for MySQL and Amazon Aurora databases. Similar to MS SQL, this port is needed for applications to connect to a MySQL database running on an EC2 instance.
    • Security Note: Restrict access to only the necessary application servers or specific IP ranges. AWS RDS is the preferred service for managed MySQL/Aurora databases.
11. Port 5432 (PostgreSQL)
    • Utility: The default port for PostgreSQL databases.
    • Security Note: Restrict access to only the necessary application servers or specific IP ranges. AWS RDS is the preferred service for managed PostgreSQL databases.
12. Port 27017 (MongoDB)
    • Utility: The default port for MongoDB.
    • Security Note: If running MongoDB on EC2, restrict access to only the necessary application servers. Consider AWS DocumentDB for a managed MongoDB-compatible service.
13. Port 8080 (HTTP Alternate)
    • Utility: Often used for web servers or application servers (like Tomcat, Jenkins) that serve HTTP traffic on a non-standard port.
    • Security Note: Treat this like Port 80/443 regarding access restrictions.
14. Ephemeral Ports (1024-65535)
    • Utility: These are dynamic ports used by clients when initiating connections to servers. When your EC2 instance initiates an outbound connection (e.g., connecting to an external API, downloading updates), the source port will be an ephemeral port.
    • Security Note: While you typically don't explicitly open these for inbound traffic (unless it's a specific application), outbound rules often allow traffic to these ranges. Security groups are stateful, so return traffic on these ports is automatically allowed if the outbound connection was initiated from the instance.

​When configuring security groups, always adhere to the principle of least privilege: only open the ports and allow traffic from the sources that are absolutely necessary for your application to function. This significantly reduces your attack surface.​