List all unused security groups in all AWS regions ...

list.sh

#!/usr/bin/env bash

set -eo pipefail

[[ -n "${VERBOSE}" ]] && set -x

for region in $(aws ec2 describe-regions | jq -r '.Regions[].RegionName'); do
  for sg in $(aws ec2 describe-security-groups --region="${region}" | jq -r '.SecurityGroups[].GroupId'); do
    if [[ $(aws ec2 describe-network-interfaces --region="${region}" --filters Name=group-id,Values="${sg}" | jq -r '.NetworkInterfaces | length') -eq 0 ]]; then
      echo "${sg} in ${region}"
    fi
  done
done