Security group association to EC2 instances

Question

I like to remove unused security groups. Also need to know which security groups are associated with my EC2 without Going one by one on EC2 instances. Any command or solution to make it manageable ?

Accepted Answer

There is actually a simple way to see the associations.

https://aws.amazon.com/premiumsupport/knowledge-center/ec2-find-security-group-resources/

1.    Run the following command in the AWS CLI to find network interfaces associated with a security group based on the security group ID:

aws ec2 describe-network-interfaces --filters Name=group-id,Values= --region  --output json

The output of this command shows the network interfaces associated with the security group.

2.    Review the output.

If the output is empty similar to this example, then there are no resources associated with the security group:

{
    "NetworkInterfaces": []
}

If the output contains results, then use this command to find more information about the resources associated with the security group:

aws ec2 describe-network-interfaces --filters Name=group-id,Values= --region  --output json --

You can also see from the console :
Copy the security group ID of the security group that you're investigating.

In the navigation pane, choose Network Interfaces. Paste the security group ID in the search bar.

Answer

Hi Sarah,

You could look into AWS Config rule: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-delete-ec2-security-group.html

That rule will delete all unused Sec groups. Hope it helps!

Answer

You can use AWS Firewall Manager to manage your security groups at scale, see [this blog post](https://aws.amazon.com/blogs/security/how-to-continuously-audit-and-limit-security-groups-with-aws-firewall-manager/).

Security group association to EC2 instances

相關內容