How do I find the resources associated with an Amazon EC2 security group?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Important: The following resolution only applies to services that have elastic network interfaces actively deployed. The following resolution doesn't work for services where you configured security groups but didn't directly deploy network interfaces.

Use the EC2 console

Complete the following steps:

1. Open the Amazon EC2 console.

2. In the navigation pane, choose Security Groups.

3. Copy the security group ID of the security group that you want to investigate.

4. In the navigation pane, choose Network Interfaces.

5. Enter the security group ID in the search bar.

   Note: Make sure that you search in the AWS Region where your security group is located.

6. Review the search results.

Search results show the network interfaces that are associated with the security group. To determine the resource that's associated with the security group, check the description of the network interface. For example, ELB app/example-alb/1234567890abcdef shows that an Application Load Balancer with the name example-alb uses this security group.

If you receive a "No Network Interfaces found matching your filter criteria" message, then there are no resources associated with the security group.

Use the AWS CLI

To find network interfaces that are associated with a security group based on the security group ID, run the describe-network-interfaces AWS CLI command:

aws ec2 describe-network-interfaces --filters Name=group-id,Values=your-group-id --region region --output json

Note: Replace your-group-id with your security group ID. Replace region with your Region.

The output lists the network interfaces that are associated with the security group.

If the output is empty, then there are no resources associated with the security group.

Example output:

{
    "NetworkInterfaces": []
}

If the output contains results, then run the describe-network-interfaces AWS CLI command with your NetworkInterfaces value:

aws ec2 describe-network-interfaces --filters Name=group-id,Values=group-id --region region --output json --query "NetworkInterfaces[*].[NetworkInterfaceId,Description,PrivateIpAddress,VpcId]"

The output gives you information about the resources that are associated with the security group.

Related information

Control traffic to your AWS resources using security groups

Client-side filtering