Common ports are standardized network port numbers assigned to well-known protocols and services. In EC2, these ports must be explicitly opened in Security Groups to allow inbound or outbound traffic to reach your instance.

In AWS EC2, Security Groups act as virtual firewalls that control traffic to and from instances. To allow a service to be accessible, you must create an inbound rule that opens the corresponding port. Knowing the standard port numbers is essential for configuring Security Groups correctly and troubleshooting connectivity issues.

Remote Access Ports

1
Port 22 — SSH (Secure Shell). Used to remotely log into Linux/Unix EC2 instances. Should be restricted to your IP only, never 0.0.0.0/0 in production.
2
Port 3389 — RDP (Remote Desktop Protocol). Used to remotely access Windows EC2 instances via a graphical desktop interface.

Web / HTTP Ports

1
Port 80 — HTTP (HyperText Transfer Protocol). Unencrypted web traffic. Standard port for web servers like Apache, Nginx.
2
Port 443 — HTTPS (HTTP Secure). Encrypted web traffic using TLS/SSL. Required for secure websites and APIs.
3
Port 8080 — Alternative HTTP port. Commonly used for development web servers, Jenkins, Tomcat, and proxies.
4
Port 8443 — Alternative HTTPS port. Used by some application servers as a non-privileged HTTPS port.

Database Ports

1
Port 3306 — MySQL and Amazon Aurora (MySQL-compatible). Should only be open to the app tier security group, never to the internet.
2
Port 5432 — PostgreSQL and Amazon Aurora (PostgreSQL-compatible).
3
Port 1521 — Oracle Database.
4
Port 1433 — Microsoft SQL Server (MSSQL).
5
Port 27017 — MongoDB. Default port for MongoDB standalone and replica set connections.
6
Port 6379 — Redis. Default port for Redis in-memory data store and Amazon ElastiCache.
7
Port 11211 — Memcached. Default port for Memcached caching service and Amazon ElastiCache.

Email / Messaging Ports

1
Port 25 — SMTP (Simple Mail Transfer Protocol). Outbound email. AWS blocks port 25 by default on EC2 to prevent spam; use Amazon SES instead.
2
Port 465 — SMTPS (SMTP over SSL). Encrypted outbound email.
3
Port 587 — SMTP Submission. Modern port for authenticated email sending with STARTTLS.
4
Port 110 — POP3 (Post Office Protocol v3). Receiving email.
5
Port 143 — IMAP (Internet Message Access Protocol). Receiving email with folder support.
6
Port 993 — IMAPS (IMAP over SSL). Encrypted email retrieval.

Other Common Ports

1
Port 21 — FTP (File Transfer Protocol). Unencrypted file transfer. Avoid in production; use SFTP (port 22) instead.
2
Port 53 — DNS (Domain Name System). Used by AWS Route 53 and internal DNS resolution.
3
Port 123 — NTP (Network Time Protocol). Time synchronization — EC2 instances sync with AWS's NTP servers.
4
Port 2181 — Apache ZooKeeper. Coordination service used by Kafka and HBase.
5
Port 9092 — Apache Kafka. Default broker port for Kafka message streaming.
6
Port 5601 — Kibana. Web UI for the ELK (Elasticsearch, Logstash, Kibana) stack.
7
Port 9200 — Elasticsearch / OpenSearch HTTP API.
8
Port 2379 / 2380 — etcd (used by Kubernetes for cluster state storage).
9
Port 6443 — Kubernetes API Server. Used to communicate with a Kubernetes cluster.

Difficulty: 3/10

Topics: Common port numbers, Security groups, EC2 network access

Scenario Questions

0-2 years experience

1
You're trying to connect to your EC2 instance via SSH but it's timing out — what are the first three things you'd check regarding ports and security groups?
2
Your web app on EC2 isn't loading in the browser — you've confirmed the server is running. What port should you verify is open in the security group, and why?
3
A teammate says they can't reach the API on your EC2 instance. You know it's supposed to serve on port 8080. What would you check first?

2-5 years experience

1
Your team deployed a new microservice on EC2 that uses port 9000, but external clients can't reach it — the security group looks correct. What other network layers could be blocking it, and how would you debug this?
2
You're building a multi-tier app with a web server, app server, and database on EC2. How do you decide which ports to open between tiers, and why not just open everything to the world?
3
A CI/CD pipeline fails because it can't reach the deployment endpoint on port 8080 after a recent security group change. How would you trace what changed and restore access safely?

5-8 years experience

1
You're designing a high-availability service on EC2 that needs to expose multiple internal APIs on non-standard ports. How do you balance security, observability, and operational overhead when managing these port rules across hundreds of instances?
2
Your legacy EC2 fleet still uses port 3389 for RDP access from the internet. You're migrating to AWS Systems Manager Session Manager. What’s your migration plan to deprecate the port safely without breaking existing ops workflows?
3
An audit flags that port 22 is open to the public internet on 15% of your EC2 instances. How do you prioritize remediation, and what alternatives would you propose to eliminate this risk at scale?

8+ years experience

1
You're leading a cloud migration for a legacy monolith that relies on hardcoded port-based communication between on-prem services and EC2. How do you design a secure, scalable replacement that avoids brittle port dependencies while maintaining uptime?
2
Your organization has thousands of EC2 instances across accounts, each with custom port rules. How would you architect a centralized, policy-driven port management system that enforces least privilege without slowing down developer velocity?
3
A regulatory requirement forces you to close all non-essential ports on EC2 instances. How do you map business-critical services to compliant port usage across hybrid environments, and how do you measure and prove compliance at scale?

Follow-up Questions

❓What happens if you forget to open port 22 in your security group?
❓Why would you avoid opening port 22 to 0.0.0.0/0 in production?
❓How would you verify a service is listening on port 80 inside an EC2 instance?