[AWS] Find out unused Security Groups

find-unused-security-groups.sh

#!/bin/bash

# Usage:
#
# ./find-unused-security-groups.sh [us-east-1]
#

REGION=${1:-us-east-1}

SECURITY_GROUPS=($(aws ec2 describe-security-groups --no-paginate --region ${REGION} --output json | jq -r '.SecurityGroups[].GroupId'))

echo "Found ${#SECURITY_GROUPS[@]} security group(s) under region: ${REGION}"
echo "${SECURITY_GROUPS[*]}"
echo # just a line break

for SECURITY_GROUP in ${SECURITY_GROUPS[*]}; do
  echo "Security Group \"${SECURITY_GROUP}\" is used by the following ENIs:"

  aws ec2 describe-network-interfaces \
    --filters Name=group-id,Values=${SECURITY_GROUP} \
    --no-paginate --region ${REGION} --output json | \
      jq -r '.NetworkInterfaces[] | { InterfaceType: .InterfaceType, Description: .Description, ENI: .NetworkInterfaceId}'

  echo # just a line break
done