使用 Python 和 Boto3 查找并验证 AWS 中未使用的安全组

   pip install boto3

import boto3from botocore.exceptions import clienterrordef get_unused_security_groups(region='us-east-1'):    """    find security groups that are not being used by any resources.    """    ec2_client = boto3.client('ec2', region_name=region)    try:        # get all security groups        security_groups = ec2_client.describe_security_groups()['securitygroups']        # get all network interfaces        enis = ec2_client.describe_network_interfaces()['networkinterfaces']        # create set of security groups in use        used_sg_ids = set()        # check security groups attached to enis        for eni in enis:            for group in eni['groups']:                used_sg_ids.add(group['groupid'])        # find unused security groups        unused_groups = []        for sg in security_groups:            if sg['groupid'] not in used_sg_ids:                # skip default security groups as they cannot be deleted                if sg['groupname'] != 'default':                    unused_groups.append({                        'groupid': sg['groupid'],                        'groupname': sg['groupname'],                        'description': sg['description'],                        'vpcid': sg.get('vpcid', 'ec2-classic')                    })        # print results        if unused_groups:            print(f"found {len(unused_groups)} unused security groups in {region}:")            print("-" * 80)            for group in unused_groups:                print(f"security group id: {group['groupid']}")                print(f"name: {group['groupname']}")                print(f"description: {group['description']}")                print(f"vpc id: {group['vpcid']}")                print("-" * 80)        else:            print(f"no unused security groups found in {region}")        return unused_groups    except clienterror as e:        print(f"error retrieving security groups: {str(e)}")        return none

def check_sg_references(ec2_client, group_id):    """    check if a security group is referenced in other security groups' rules    """    try:        # check if the security group is referenced in other groups        response = ec2_client.describe_security_groups(            filters=[                {                    'name': 'ip-permission.group-id',                    'values': [group_id]                }            ]        )        referencing_groups = response['securitygroups']        # check for egress rules        response = ec2_client.describe_security_groups(            filters=[                {                    'name': 'egress.ip-permission.group-id',                    'values': [group_id]                }            ]        )        referencing_groups.extend(response['securitygroups'])        return referencing_groups    except clienterror as e:        print(f"error checking security group references: {str(e)}")        return none

def validate_unused_groups(region='us-east-1'):    """    validate and provide detailed information about unused security groups    """    ec2_client = boto3.client('ec2', region_name=region)    unused_groups = get_unused_security_groups(region)    if not unused_groups:        return    print("validating security group references...")    print("-" * 80)    for group in unused_groups:        group_id = group['groupid']        referencing_groups = check_sg_references(ec2_client, group_id)        if referencing_groups:            print(f"security group {group_id} ({group['groupname']}) is referenced by:")            for ref_group in referencing_groups:                print(f"- {ref_group['groupid']} ({ref_group['groupname']})")        else:            print(f"security group {group_id} ({group['groupname']}) is not referenced by any other groups")            print("this security group can be safely deleted if not needed")

Found 5 unused security groups in us-east-1:--------------------------------------------------------------------------------Security Group ID: sg-12345678Name: unused-sg-1Description: Unused security groupVPC ID: vpc-abcde123--------------------------------------------------------------------------------Security Group sg-12345678 (unused-sg-1) is not referenced by any other groupsThis security group can be safely deleted if not needed--------------------------------------------------------------------------------Security Group ID: sg-23456789Name: unused-sg-2Description: Another unused groupVPC ID: vpc-abcde123--------------------------------------------------------------------------------Security Group sg-23456789 (unused-sg-2) is referenced by:- sg-34567890 (some-other-sg)