AWS Security Group Reviewer

// 0.0.0.0/0 · ::/0 · SSH · RDP · databases · port ranges · default group

The output of aws ec2 describe-security-groups or aws ec2 describe-security-group-rules, from your own account. Commands are below.

Findings

    
        
    
      
    

      
    
        
    
          
    Rules by group
    
          
        
    
        
    
          
    
        
    
      
    
    
    

    
    
      
    
        
    Get your own rules
    
      
    
      
    
        One group, or leave out --group-ids for every group in the region
        
    aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0
    
        The same rules, one per line, with rule IDs
        
    aws ec2 describe-security-group-rules --filters Name=group-id,Values=sg-0123456789abcdef0
    
        What uses a group (this page can't see that)
        
    aws ec2 describe-network-interfaces --filters Name=group-id,Values=sg-0123456789abcdef0 --query "NetworkInterfaces[].[NetworkInterfaceId,Description]"
    
        
    A rule only matters for the instances, load balancers, databases and functions that use the group. A group open to the internet but attached to nothing is still worth fixing before someone attaches it.