1. Identify Unused Security Groups:
   • Go to the AWS Management Console and navigate to the EC2 dashboard.
   • Click on the ‘Security Groups’ option in the left-hand menu to view all the security groups in your account.
   • Review each security group and identify the ones that are not associated with any EC2 instances or other resources.
2. Remove Unused Security Groups:
   • Select the unused security groups that you want to delete by checking the box next to each one.
   • Click on the ‘Actions’ dropdown menu at the top, and select ‘Delete security group’.
   • Confirm the deletion when prompted.
3. Update Security Group Rules:
   • Review the remaining security groups to ensure that they have the necessary and correct inbound and outbound rules.
   • Remove any unnecessary rules that are overly permissive or no longer needed.
4. Consolidate Security Groups:
   • If you have multiple security groups with similar rules, consider consolidating them into fewer security groups to simplify management.
   • Update the security group associations for your resources to use the consolidated security groups.
5. Implement Security Group Naming Conventions:
   • Establish a naming convention for your security groups to easily identify their purpose and associated resources.
   • Rename the security groups accordingly to maintain consistency and organization.
6. Regularly Audit Security Groups:
   • Schedule periodic reviews of your security groups to identify and remove any unused or redundant ones.
   • Ensure that security groups are properly configured and adhere to your organization’s security policies.

​

1. List all Security Groups: First, you need to list all the existing security groups in your AWS account to identify the excessive ones. You can use the following AWS CLI command to list all security groups:

aws ec2 describe-security-groups

2. Identify Excessive Security Groups: Review the list of security groups returned by the above command and identify the ones that are not necessary or are excessive.
3. Delete Excessive Security Groups: To delete a security group, you can use the following AWS CLI command:

aws ec2 delete-security-group --group-id YOUR_SECURITY_GROUP_ID

4. Repeat as Necessary: Repeat the above steps for each excessive security group that needs to be deleted.
5. Monitor and Test: After deleting the excessive security groups, monitor your resources to ensure that the necessary security groups are in place and that the deletion of the excessive ones did not impact your applications or services.

1. Install the Boto3 library:

pip install boto3

2. Create a Python script (e.g., remediate_security_groups.py) with the following code:

import boto3

# Initialize the AWS clients for EC2
ec2_client = boto3.client('ec2')

def get_excessive_security_groups():
    # Get all security groups
    response = ec2_client.describe_security_groups()
    security_groups = response['SecurityGroups']
    
    # Filter security groups with more than 1 rule
    excessive_security_groups = [sg['GroupId'] for sg in security_groups if len(sg['IpPermissions']) > 1]
    
    return excessive_security_groups

def delete_security_group(group_id):
    # Delete the security group
    ec2_client.delete_security_group(GroupId=group_id)
    print(f"Security Group {group_id} deleted successfully")

if __name__ == '__main__':
    excessive_groups = get_excessive_security_groups()
    
    if excessive_groups:
        for group_id in excessive_groups:
            delete_security_group(group_id)
    else:
        print("No excessive security groups found")

3. Run the Python script using the following command:

python remediate_security_groups.py

# Consolidated security group with the combined least-privilege rules
resource "aws_security_group" "CONSOLIDATED_SG" {
  name        = "CONSOLIDATED_SG_NAME"   # replace with desired SG name
  description = "Consolidated security group for EC2 instance"
  vpc_id      = "VPC_ID"                 # replace with the VPC ID where the instance resides

  # Add only the required, consolidated rules from the existing security groups

  ingress {
    description = "REPLACE_WITH_RULE_DESCRIPTION"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["ALLOWED_CIDR_1", "ALLOWED_CIDR_2"] # replace with required CIDRs
  }

  # Add additional ingress/egress blocks as needed to cover all required access
}

# EC2 instance configured to use only the consolidated security group
resource "aws_instance" "EC2_INSTANCE" {
  ami                    = "AMI_ID"                 # replace with the AMI ID
  instance_type          = "INSTANCE_TYPE"          # replace with the instance type
  subnet_id              = "SUBNET_ID"              # replace with the subnet ID
  iam_instance_profile   = "INSTANCE_PROFILE_NAME"  # optional; replace/remove as needed

  # This argument mirrors:
  #   aws ec2 modify-instance-attribute --groups <space-separated-list-of-sg-ids>
  # and REPLACES all currently attached security groups.
  vpc_security_group_ids = [
    aws_security_group.CONSOLIDATED_SG.id,
    # If you are doing a staged migration, temporarily keep one or more
    # of the original SG IDs here in an earlier Terraform apply, then
    # remove them in a later change after testing.
    # "EXISTING_SG_ID_1",
    # "EXISTING_SG_ID_2",
  ]

  # ... other required arguments for your instance ...
}

• A new aws_security_group.CONSOLIDATED_SG to be created (if it doesn’t already exist).
• An in-place update to aws_instance.EC2_INSTANCE where vpc_security_group_ids changes from the previous list of many security groups to the new, consolidated list you specify.