Unused Security Groups Should Be Removed
More Info:
Non-default security groups were defined which were unused and may not be required. This being the case, their existence in the configuration increases the risk that they may be inappropriately assigned. The unused security groups should be reviewed and removed if no longer required.Risk Level
LowAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the issue of unused security groups in AWS, follow these steps using the AWS Management Console:
- Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to your AWS account.
- Navigate to the EC2 Dashboard: Click on the “Services” dropdown menu at the top of the page, select “EC2” under the Compute section.
- View Security Groups: In the EC2 Dashboard, locate the “Security Groups” option in the navigation pane on the left and click on it.
- Identify Unused Security Groups: Review the list of security groups to identify the ones that are not associated with any running instances or resources. You can check the “Description” tab of each security group to see if it is actively being used.
- Check Rules and Dependencies: Before deleting a security group, ensure that there are no dependencies on it. Check if any other resources are using the security group for inbound/outbound rules.
- Delete Unused Security Groups: To delete a security group, select the checkbox next to the security group(s) you want to remove, click on the “Actions” dropdown menu, and select “Delete security group”.
- Confirm Deletion: A confirmation dialog will appear asking you to confirm the deletion. Review the security group details once more and click “Yes, Delete” to confirm.
- Verify Deletion: Once the security group is deleted, verify that it has been removed from the list of security groups. Also, ensure that there are no adverse effects on any resources due to the deletion.
- Repeat if Necessary: Repeat the above steps for any other unused security groups that need to be removed.
Using CLI
Using CLI
To remediate the issue of unused security groups in AWS using AWS CLI, follow these steps:
- List all the security groups that are not associated with any EC2 instances:
- Identify the security group that you want to delete from the list obtained in the previous step.
- Delete the unused security group using the following command:
YOUR_SECURITY_GROUP_ID with the actual ID of the security group you want to delete.- Confirm the deletion by listing the security groups again:
Using Python
Using Python
To remediate the issue of unused security groups in AWS using Python, you can follow these steps:
- Install the Boto3 library:
- Use the following Python script to identify and delete unused security groups:
-
Replace the AWS credentials in the AWS CLI configuration file located at
~/.aws/credentialsor use an IAM role that has the necessary permissions to list and delete security groups. - Run the Python script to identify and delete the unused security groups.