It's difficult to find out who's using the security group if you looked at wrong place. Here's how to find out dependent objects:
1. Search group name or group ID at "Network Interfaces" under EC2 Management Console. This will give you all direct usage from instances including EC2, RDS, RedShift ....
2. find out dependencies between/among security groups by using this small program:
https://github.com/mingbowan/sgdeps
you will get something like:
python sgdeps.py --region us-east-1 mingbotest-A
sg-b4566ad1 (mingbotest-A)
|-- sg-9b566afe (mingbotest-C2)
|-- sg-9f566afa (mingbotest-C1)
| |-- sg-69576b0c (mingbotest-D2)
| | `-- sg-b4566ad1 (mingbotest-A) ** loop
| `-- sg-64576b01 (mingbotest-D1)
| `-- sg-9b566afe (mingbotest-C2)
|-- sg-8b566aee (mingbotest-B2)
`-- sg-86566ae3 (mingbotest-B1)
1. Search group name or group ID at "Network Interfaces" under EC2 Management Console. This will give you all direct usage from instances including EC2, RDS, RedShift ....
2. find out dependencies between/among security groups by using this small program:
https://github.com/mingbowan/sgdeps
you will get something like:
python sgdeps.py --region us-east-1 mingbotest-A
sg-b4566ad1 (mingbotest-A)
|-- sg-9b566afe (mingbotest-C2)
|-- sg-9f566afa (mingbotest-C1)
| |-- sg-69576b0c (mingbotest-D2)
| | `-- sg-b4566ad1 (mingbotest-A) ** loop
| `-- sg-64576b01 (mingbotest-D1)
| `-- sg-9b566afe (mingbotest-C2)
|-- sg-8b566aee (mingbotest-B2)
`-- sg-86566ae3 (mingbotest-B1)
then delete dependent rules/groups.
Very helpful tool - thanks for this!
ReplyDelete