Check ID:
Provider: AWS
Service:
Severity: LOW
Categories:
Resource type:
ec2_securitygroup_not_usedProvider: AWS
Service:
ec2Severity: LOW
Categories:
trust-boundariesResource type:
AwsEc2SecurityGroupWhat this check verifies
EC2 security groups, exceptdefault, are assessed for unused status: zero attached network interfaces, no AWS Lambda associations, and no references from other security groups.
Risk
Orphaned security groups may later be attached with overly permissive rules without review, enabling unintended inbound or lateral access that compromises confidentiality and integrity. They also create configuration drift, increasing the chance of misapplied access controls.Recommendation
Apply least privilege and strong lifecycle management: delete or quarantine unused security groups, enforce ownership tags and retention policies, review regularly, and manage changes via IaC with approvals. Restrict who can attach groups and use guardrails to prevent reuse of stale or permissive groups.Remediation
- CLI
- Terraform
- Dashboard steps
aws ec2 delete-security-group —group-id <SECURITY_GROUP_ID>
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/EC2/default-security-group-unrestricted.html
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = ec2_securitygroup_not_used. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks