有效管理 AWS 安全组对于维护安全且经济高效的云环境至关重要。安全组是 AWS 网络安全的重要组成部分，但随着时间的推移，未使用的安全组会不断累积。这些未使用的组不仅会使您的环境变得混乱，还可能带来安全风险或不必要地增加成本。
在本文中，我们将探讨如何使用 Python 和 Boto3 识别 AWS 环境中未使用的安全组、验证它们并确保它们不被任何其他资源引用。我们还将研究如何安全地确定是否可以删除这些组。
要学习本教程，您需要以下内容：
AWS 账户：确保您有权访问要搜索未使用的安全组的 AWS 环境。
Boto3 已安装：您可以通过运行以下命令来安装 Boto3 Python SDK：
pip install boto3
已配置 AWS 凭证：确保您使用 AWS CLI 或使用 IAM 角色或环境变量直接在代码中配置了 AWS 凭证。
让我们看一下代码，用于识别给定 AWS 区域中未使用的安全组、验证它们并检查它们是否被任何其他组引用。
pip install boto3
import boto3
from botocore.exceptions import ClientError
def get_unused_security_groups(region='us-east-1'):
"""
Find security groups that are not being used by any resources.
"""
ec2_client = boto3.client('ec2', region_name=region)
try:
# Get all security groups
security_groups = ec2_client.describe_security_groups()['SecurityGroups']
# Get all network interfaces
enis = ec2_client.describe_network_interfaces()['NetworkInterfaces']
# Create set of security groups in use
used_sg_ids = set()
# Check security groups attached to ENIs
for eni in enis:
for group in eni['Groups']:
used_sg_ids.add(group['GroupId'])
# Find unused security groups
unused_groups = []
for sg in security_groups:
if sg['GroupId'] not in used_sg_ids:
# Skip default security groups as they cannot be deleted
if sg['GroupName'] != 'default':
unused_groups.append({
'GroupId': sg['GroupId'],
'GroupName': sg['GroupName'],
'Description': sg['Description'],
'VpcId': sg.get('VpcId', 'EC2-Classic')
})
# Print results
if unused_groups:
print(f"\nFound {len(unused_groups)} unused security groups in {region}:")
print("-" * 80)
for group in unused_groups:
print(f"Security Group ID: {group['GroupId']}")
print(f"Name: {group['GroupName']}")
print(f"Description: {group['Description']}")
print(f"VPC ID: {group['VpcId']}")
print("-" * 80)
else:
print(f"\nNo unused security groups found in {region}")
return unused_groups
except ClientError as e:
print(f"Error retrieving security groups: {str(e)}")
return None
def check_sg_references(ec2_client, group_id):
"""
Check if a security group is referenced in other security groups' rules
"""
try:
# Check if the security group is referenced in other groups
response = ec2_client.describe_security_groups(
Filters=[
{
'Name': 'ip-permission.group-id',
'Values': [group_id]
}
]
)
referencing_groups = response['SecurityGroups']
# Check for egress rules
response = ec2_client.describe_security_groups(
Filters=[
{
'Name': 'egress.ip-permission.group-id',
'Values': [group_id]
}
]
)
referencing_groups.extend(response['SecurityGroups'])
return referencing_groups
except ClientError as e:
print(f"Error checking security group references: {str(e)}")
return None
要运行脚本，只需执行 validate_unused_groups 函数即可。例如，当区域设置为 us-east-1 时，脚本将：
def validate_unused_groups(region='us-east-1'):
"""
Validate and provide detailed information about unused security groups
"""
ec2_client = boto3.client('ec2', region_name=region)
unused_groups = get_unused_security_groups(region)
if not unused_groups:
return
print("\nValidating security group references...")
print("-" * 80)
for group in unused_groups:
group_id = group['GroupId']
referencing_groups = check_sg_references(ec2_client, group_id)
if referencing_groups:
print(f"\nSecurity Group {group_id} ({group['GroupName']}) is referenced by:")
for ref_group in referencing_groups:
print(f"- {ref_group['GroupId']} ({ref_group['GroupName']})")
else:
print(f"\nSecurity Group {group_id} ({group['GroupName']}) is not referenced by any other groups")
print("This security group can be safely deleted if not needed")
使用此脚本，您可以自动执行在 AWS 中查找未使用的安全组的过程，并确保您不会保留不必要的资源。这有助于减少混乱、改善安全状况，并可能通过删除未使用的资源来降低成本。
您可以将此脚本扩展为：
确保您的 AWS 环境安全且组织良好！
以上是使用 Python 和 Boto3 查找并验证 AWS 中未使用的安全组的详细内容。更多信息请关注PHP中文网其他相关文章！
