Command syntax
To run the audit, execute the following command from the directory containing the script:Ensure you have AWS credentials configured before running the audit. The tool uses boto3 to access your AWS account through your default credentials or environment variables.
What happens during execution
Account identification
The tool retrieves your AWS account ID using STS (Security Token Service) and displays it in the console:
Security group enumeration
All security groups in your account are retrieved and counted. The tool initializes a tracking dictionary to monitor which security groups have associated resources.
Progressive scanning
Each security group is analyzed sequentially with a progress indicator showing the current position:
Resource association checks
For each security group, the tool checks associations with 20+ AWS services including:
- EC2 instances
- Load balancers (ELB, ALB, NLB)
- RDS databases
- ECS services and tasks
- EKS clusters and node groups
- ElastiCache clusters
- Redshift clusters
- VPC endpoints
- Transfer Family servers
- And many more AWS resources
Security group reference check
The tool also identifies if other security groups reference the current security group in their rules:
Progress indicators
The audit displays real-time progress as it scans:- Counter format:
(current/total)shows your position in the scan - Separator lines:
------------------------------------------------clearly delineate each security group section - Indented output: Associated resources are shown with tabs (
\t) for easy readability
Execution time
The audit duration depends on:- Number of security groups: More security groups = longer scan time
- Number of resources: Accounts with many resources require more API calls
- AWS API response times: Network latency and AWS service responsiveness affect speed
- Small accounts (10-20 SGs): 1-3 minutes
- Medium accounts (50-100 SGs): 5-10 minutes
- Large accounts (200+ SGs): 15-30 minutes
Output log file
All console output is simultaneously written to a log file named:123456789012_sg_log.txt
This log file is created in the same directory where you run the script and contains the complete audit results for later reference.
Example console output
Here’s what a typical audit session looks like:Next steps
After the audit completes, you can:- Review the detailed results in the log file
- Delete unused security groups through the interactive prompt