Move the instance into a private subnet and route egress through a NAT gateway. Put public entry points behind an ALB/NLB and use SSM Session Manager instead of public SSH. Disable auto-assign public IP on your subnets so new instances do not get one by default.

Compliance High severity

AWS Security Hub · EC2

EC2.9: Instances are directly reachable on public IPv4

Written and reviewed by Emnode · Last reviewed 27 May 2026

What does AWS Security Hub EC2.9 check?

EC2.9 fails EC2 instances that have a public IPv4 address attached, meaning they are directly addressable from the internet.

Why does EC2.9 matter?

Every public IP is attack surface: it gets scanned continuously, and any exposed service or unpatched daemon becomes a target. Most workloads should sit in private subnets and reach the internet through a NAT gateway, with inbound traffic arriving only via a load balancer or bastion you control.

How do I fix EC2.9?

Move the instance into a private subnet and route egress through a NAT gateway.
Put public entry points behind an ALB/NLB and use SSM Session Manager instead of public SSH.
Disable auto-assign public IP on your subnets so new instances do not get one by default.

Remediation script · bash

# Close the highest-impact public exposure first: databases.
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?PubliclyAccessible==`true`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --no-publicly-accessible --apply-immediately
  echo "$db: public access removed"
done

# Ratchet S3 shut at the account level so no bucket can be made public again.
aws s3control put-public-access-block --account-id 123456789012 \
  --public-access-block-configuration \
    'BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true'

Full walkthrough (console steps, edge cases and verification) in the lesson Block public access to AWS resources.

Is EC2.9 a false positive?

Some workloads are supposed to have a public IPv4 address: an internet-facing bastion, a NAT instance, a self-managed reverse proxy or VPN gateway, or a single-node public service that genuinely terminates traffic itself rather than sitting behind an ALB/NLB. EC2.9 fails on the mere presence of a publicIp on the instance, so it flags these hosts even when the exposure is intentional and the instance is hardened, with its security groups already locked down. The right move isn't to strip a public IP off something that needs one; it's to confirm the SG rules are tight (EC2.14/EC2.19 cover that) and then set the finding's workflow status to SUPPRESSED with a note explaining the role. Note also that the control evaluates IPv4 only, so an IPv6-only host won't trip it.

Full lesson Block public access to AWS resources Step-by-step remediation with CLI, code and persona-specific context.

AWS documentation for EC2 controls ↗ Check your own account for EC2.9 →

Part of the learning path Trim your network spend

EC2.1 An EBS snapshot is publicly restorable by any account
EC2.2 Default security groups still allow traffic
EC2.3 Attached EBS volumes are not encrypted at rest
EC2.4 Long-stopped instances are abandoned attack surface
EC2.6 No VPC flow logs, so there is no network audit trail
EC2.7 New EBS volumes are not encrypted by default
EC2.8 IMDSv1 lets an SSRF steal instance credentials
EC2.10 EC2 API traffic leaves the VPC over the internet
EC2.13 SSH (port 22) is open to the entire internet
EC2.14 RDP (port 3389) is open to the entire internet
EC2.15 Subnets auto-assign public IPs to new instances
EC2.17 Instances with multiple ENIs can bridge network boundaries