A script to list any security groups which can be safely deleted (unless it's named "default")

aws-list-orphaned-security-groups.sh

#!/bin/bash
for region in $(aws ec2 describe-regions --query "Regions[*].[RegionName]" --output text); do
  echo "--- ${region} ---"
  aws ec2 describe-vpcs --region ${region} --query "Vpcs[].[VpcId,Tags[?Key=='Name'].Value | [0]]" --output text | while read vpcdata; do
    set $vpcdata; vpcid=${1}; vpcname=${2}
    aws ec2 describe-security-groups --region ${region} --filters "Name=vpc-id,Values=${vpcid}" --query "SecurityGroups[].[GroupId,GroupName]" --output text | while read sgdata; do
      set $sgdata; sgid=${1}; sgname=${2}
      if [ "${sgname}" != "default" ]; then
        usagecount=$(aws ec2 describe-network-interfaces --region ${region} --filters "Name=group-id,Values=${sgid}" --query "NetworkInterfaces[] | length(@)" --output text)
        if [ "${usagecount}" == "0" ]; then
          echo "${region} ${vpcname} (${vpcid}) ${sgname} (${sgid})"
        fi
      fi
    done
  done
done