security-group-scan

Verify the real impact of public AWS security group exposures by running a scan that calls describe_instances for HIGH and CRITICAL findings. This process identifies the active instances within the affected security groups, confirming whether the permissive inbound rules are actually exposing live resources.

Produce a risk-ranked remediation report by scanning AWS security groups for public inbound rules on sensitive ports. The generated report prioritizes findings by severity and includes example revoke-ingress commands, providing actionable guidance to close network access control gaps quickly.

You can scan a specific AWS VPC or a single security group for public exposure by scoping the security group audit. The scan calls EC2 describe_security_groups to classify inbound rules across your defined scope, detecting overly permissive access controls without requiring a full account-wide review.

You need AWS environment variables configured for the default region to run a network auditing scan for sensitive ports. Setting up the AWS environment variables allows the scanning process to authenticate and call EC2 describe_security_groups to evaluate your inbound rules for public exposure.

AWS security group incident response requires classifying findings by port and protocol exposure to prioritize remediation accurately. Categorizing public ingress rules by sensitive ports like 22 and 3389 helps investigators focus on the highest risk network access controls and generate effective revoke-ingress commands.