Security Group Finder

Orphaned Security Group Finder

Coming Soon

This automation is planned but not yet implemented. The documentation below describes the intended functionality.

The Security Group Finder is a Trigger automation that identifies security groups that are no longer attached to any AWS resources. These orphaned security groups can clutter your environment and pose security risks.

How It Works

graph LR
    A[Security Group Finder] --> B[List All Security Groups]
    B --> C[Check Attachments]
    C --> D{Attached?}
    D -->|Yes| E[Skip]
    D -->|No| F[Flag as Orphaned]
    F --> G[Generate Report]
  1. Enumerate - Lists all security groups across configured accounts and regions
  2. Analyze - Checks each security group for resource attachments
  3. Identify - Flags security groups with no attachments as orphaned
  4. Report - Generates a report of orphaned security groups

Why Orphaned Security Groups Matter

RiskImpact
ClutterDifficulty managing security configurations
Security auditHarder to review security posture
ComplianceMay violate security policies
ConfusionUnclear purpose of unused groups

Running the Automation

As a Trigger automation, the Security Group Finder runs on-demand:

  1. Navigate to Automations
  2. Find Orphaned Security Group Finder
  3. Click Trigger
  4. Wait for the automation to complete
  5. View results in Automation Reports

Prerequisites

The SkySaver IAM role needs these permissions:

- Effect: "Allow"
  Action:
    - "ec2:DescribeSecurityGroups"
    - "ec2:DescribeNetworkInterfaces"
    - "ec2:DescribeInstances"
  Resource: "*"

Understanding the Report

The report includes:

FieldDescription
Security Group IDThe AWS security group ID (sg-xxx)
NameSecurity group name
VPC IDThe VPC where the group exists
AccountAWS account containing the group
RegionAWS region
DescriptionSecurity group description
Created DateWhen the group was created

What to Do with Orphaned Groups

After reviewing the report:

  1. Verify - Confirm the groups are truly unused
  2. Document - Note why each group was orphaned
  3. Delete - Remove groups that are no longer needed
  4. Keep - Some groups may be intentionally reserved

Safely Deleting Security Groups

Before deleting a security group:

  1. Check for references in:

    • Launch templates
    • Auto Scaling Group configurations
    • CloudFormation stacks
    • Terraform state

  2. Verify no pending instance launches will use the group

  3. Delete via AWS Console or CLI:

    aws ec2 delete-security-group --group-id sg-xxxxxxxxx

Common Scenarios

ScenarioOrphan Likely?Action
Instance terminatedYesSafe to delete
Lambda function deletedYesSafe to delete
RDS instance removedYesSafe to delete
Newly created for future useNoKeep for now
Referenced by CloudFormationNoKeep (CloudFormation manages it)

Best Practices

  1. Run regularly - Schedule monthly reviews
  2. Document exceptions - Use description field for reserved groups
  3. Tag groups - Use tags like Status: Reserved for intentional keeps
  4. Review before deletion - Always verify before removing

Downloading Results

Export the orphaned security group list:

  1. Navigate to Automation Reports
  2. Find the relevant execution
  3. Click Download CSV

Troubleshooting

IssuePossible CauseSolution
No groups foundPermissions issueVerify IAM role permissions
Missing regionsRegion not configuredAdd region to Project Defaults
False positivesGroup used by unsupported serviceManually verify before deletion