Finding unused Security Groups in ec2,rds,LB using boto or bash(using AWS-CLI)

Question

I'm trying to find a way to determine orphan security groups so I can clean up and get rid of them. Does anyone know a way to discover unused security groups. It should check EC2,RDS,LB,VPC etc

I am able to find the unused SG only for EC2 Security groups. I tried to find rds Security groups.

#!/usr/bin/python3
import boto3

session = boto3.session.Session(profile_name='xxx-xxx-xxx')


sgs = session.client('rds', region_name='us-east-1').describe_db_security_groups()
for sg in sgs:
    print (sg)

Answer 1

Security Groups are associated with Elastic Network Interfaces (ENIs).

Therefore, you could iterate through all ENIs and retrieve the attached Security Groups. Then, compare the list against security groups to identify which ones are not in use.

Alternatively, I wonder if you can just attempt to delete them? If they are "in use", the deletion should probably fail. (But test it first!)