How do I use the AWS Powershell Tools to get ID's of security groups allowed in ingress rules?

Question

In the AWS Web Console, viewing a security group's inbound rules can display another Security Group ID in the source column instead of an ip address. I need to view Security Group ingress rules through powershell that reference other security groups as the source.

Get-EC2SecurityGroup does not appear to include information about other incoming security groups.

To fetch information about a single EC2 security group in AWS the following Powershell command can be used:

Get-EC2SecurityGroup -GroupId sg-121kRandStringf912j

The results look like this:

Description         : My Security Group Description
GroupId             : sg-121kRandStringf912j
GroupName           : SSHIn
IpPermissions       : {Amazon.EC2.Model.IpPermission}
IpPermissionsEgress : {Amazon.EC2.Model.IpPermission}
OwnerId             : 123456789012
Tags                : {Name, aws:cloudformation:stack-name, aws:cloudformation:logical-id, aws:cloudformation:stack-id}
VpcId               : vpc-01q23RandString09ab817

A closer inspection of the IPPermissions property for a rule that uses IP addresses looks similar to this:

FromPort         : 22
IpProtocol       : tcp
IpRanges         : {192.168.1.0/32, 192.168.2.0/32}
Ipv6Ranges       : {}
PrefixListIds    : {}
ToPort           : 22
UserIdGroupPairs : {}

Notice in the output above, IP Ranges are listed.

I would expect to find similar output when the ingress rule allows an entire security group in. I would expect to find information similar to this:

FromPort         : 22
IpProtocol       : tcp
IpRanges         : {sg-1q9b2RandomString93q47}
Ipv6Ranges       : {}
PrefixListIds    : {}
ToPort           : 22
UserIdGroupPairs : {}

Instead, all the other properties in the main SecurityGroup object are similar, but when inspecting the IPPermissions property, the rule for that port is present while the IpRanges property is empty and there aren't any additional properties that contain security group IDs.

FromPort         : 22
IpProtocol       : tcp
IpRanges         : {}
Ipv6Ranges       : {}
PrefixListIds    : {}
ToPort           : 22
UserIdGroupPairs : {}

How can I use Powershell to find rules that allow other security groups inbound?

Answer 1

You should see the list of configured security groups in UserIdGroupPairs , each with Description , GroupId , and UserId . That's what the awscli returns. I would check that you are supplying the correct security group ID in your request.