Cloud - Export AWS Security Groups from all Regions – aws ec2 describe-security-groups

I can’t take any credit for this script. Rich Adams created it and shared kindly on github:

https://gist.github.com/richadams/384020d6e4e6d4f400d7

Steps:

1. Login to AWS account

2. IAM > Users > Username > Security Credentials > Create Access Key

3. Add ‘Access key Id’ and ‘Secret access key’ to relevant section in the script

4. Make sure script is executable (chmod +x)

5. Run script, outputting security groups to text file i.e.

1. sh aws_security_group_details.sh >> aws_all_regions_secgroups.txt

6. Remove access key from AWS > IAM if not longer required

Code below in case the version is removed from github:

1. #!/bin/bash
2. # Requires: awscli (http://aws.amazon.com/cli/)
3. # Prints out a list of all security groups and their settings, just for quickly auditing it.
5. # Your AWS credentials
6. if [ -z ${AWS_ACCESS_KEY_ID} ]; then
7. export AWS_ACCESS_KEY_ID='***'
8. export AWS_SECRET_ACCESS_KEY='***'
9. fi
11. # Want to do this for all regions...
12. REGIONS=(`aws ec2 describe-regions --region us-west-1 --output text | grep "-" | awk -F\t '{print $3}'`)
13. for REGION in ${REGIONS[*]}; do
14. echo "=> $REGION"
16. # Grab all the security group info for this region in one call.
17. GFILE='/tmp/aws-sec-groups'
18. aws ec2 describe-security-groups --region $REGION --output text > $GFILE
20. # Grab list of actively used security groups for EC2.
21. EC2FILE='/tmp/aws-sec-groups-ec2'
22. aws ec2 describe-instances --query 'Reservations[*].Instances[*].SecurityGroups[*].GroupId' --output text --region $REGION | tr '\t' '\n' | sort | uniq > $EC2FILE
24. # Grab list of actively used security groups for RDS.
25. RDSFILE='/tmp/aws-sec-groups-rds'
26. aws rds describe-db-security-groups --query 'DBSecurityGroups[*].EC2SecurityGroups[*].EC2SecurityGroupId' --output text --region $REGION | tr '\t' '\n' | sort | uniq > $RDSFILE
28. # Loop over each line of the file and parse it.
29. old_IFS=$IFS; IFS=$'\n'
30. cat $GFILE | while read line
31. do
32. case $line in
33. # Header
34. SECURITYGROUPS*)
35. PORT_HAS_GLOBAL_RULE=0
36. SID=(`echo $line | awk -F\t '{print $3}'`)
37. GNAME=(`echo $line | awk -F\t '{print $4}'`)
39. # Determine if this group is currently being used by an EC2/RDS instance.
40. EXTRA=""
41. grep $SID $EC2FILE &> /dev/null
42. if [ $? -ne 0 ]; then
43. grep $SID $RDSFILE &> /dev/null
44. if [ $? -ne 0 ]; then
45. EXTRA=" <= ** Not currently used by any EC2 or RDS instance in this region!"
46. fi
47. fi
49. echo " => $SID ($GNAME) $EXTRA"
50. ;;
52. # Rule Info
53. IPPERMISSIONS*)
54. INPORT=(`echo $line | awk -F\t '{print $2}'`)
55. OUTPORT=(`echo $line | awk -F\t '{print $4}'`)
56. PROTO=(`echo $line | awk -F\t '{print $3}'`)
57. ;;
58. IPRANGES*)
59. EXTRA=""
60. CIDR=(`echo $line | awk -F\t '{print $2}'`)
62. # If a global rule was already seen for this port combo, then this rule is redundant!
63. if [[ "$PORT_HAS_GLOBAL_RULE" = "$PROTO:$INPORT-$OUTPORT" ]] ; then
64. EXTRA=" <= ** Redundant, /0 was already specified for $PORT_HAS_GLOBAL_RULE."
65. fi
67. # Check if we have the global rule enabled.
68. if [[ "$CIDR" = "0.0.0.0/0" ]]; then
69. EXTRA=" (!!)" # Mark it as potentially dangerous.
70. PORT_HAS_GLOBAL_RULE="$PROTO:$INPORT-$OUTPORT" # Also keep track, as it makes other rules redundant.
71. fi
73. echo -e " => $PROTO:$INPORT->$OUTPORT\t\t$CIDR $EXTRA"
74. ;;
75. USERIDGROUPPAIRS*)
76. EXTRA=""
77. GROUPID=(`echo $line | awk -F\t '{print $2}'`)
78. GROUPNAME=(`echo $line | awk -F\t '{print $3}'`)
80. # If a global rule was already seen for this port combo, then this rule is redundant!
81. if [[ "$PORT_HAS_GLOBAL_RULE" = "$PROTO:$INPORT-$OUTPORT" ]] ; then
82. EXTRA=" <= ** Redundant, /0 was already specified for $PORT_HAS_GLOBAL_RULE."
83. fi
85. echo -e " => $PROTO:$INPORT->$OUTPORT\t\t$GROUPID ($GROUPNAME) $EXTRA"
86. ;;
87. esac
88. done
89. IFS=$old_IFS
91. # Clean up
92. rm $GFILE
93. rm $EC2FILE
94. rm $RDSFILE
95. done
97. # Remove any credentials from env.
98. unset AWS_ACCESS_KEY_ID
99. unset AWS_SECRET_ACCESS_KEY
101. echo ""