security-group-scan

Identify overly permissive AWS security group inbound rules exposing sensitive ports.

Updated Aug 23, 2026

Search Tags:#aws #remediation #incident response #network auditing #security groups #inbound rules #public exposure

Ready to run

npx skills add https://github.com/afoxnyc3/chelsea-piers-itops --skill security-group-scan

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-group-scan
Source: https://github.com/afoxnyc3/chelsea-piers-itops/tree/main/plugins/aws-security/skills/security-group-scan
Command: npx skills add https://github.com/afoxnyc3/chelsea-piers-itops --skill security-group-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

It helps you quickly identify overly permissive AWS security group inbound rules that expose sensitive services to the public internet.

Core Features & Use Cases

Risk-ranked exposure scanning: Detects 0.0.0.0/0 and ::/0 inbound rules across security groups.
Sensitive port identification: Flags commonly abused ports such as SSH (22), RDP (3389), and major database ports.
Exposure verification: For HIGH/CRITICAL findings, identifies instances in the security group to confirm real impact.
Remediation guidance: Provides prioritized recommendations and example revoke-ingress commands.

Quick Start

Ask the AI to run security-group-scan for your account using the default AWS region environment variables and report the highest-risk public inbound rules it finds.

Frequently Asked Questions about security-group-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find exposed AWS security group inbound rules opening sensitive ports to the public internet?▼

Verify the real impact of public AWS security group exposures by running a scan that calls describe_instances for HIGH and CRITICAL findings. This process identifies the active instances within the affected security groups, confirming whether the permissive inbound rules are actually exposing live resources.

What is the best way to produce a risk-ranked remediation report for AWS security groups?▼

Produce a risk-ranked remediation report by scanning AWS security groups for public inbound rules on sensitive ports. The generated report prioritizes findings by severity and includes example revoke-ingress commands, providing actionable guidance to close network access control gaps quickly.

Can I scan a specific AWS VPC or single security group for public exposure instead of the whole account?▼

You can scan a specific AWS VPC or a single security group for public exposure by scoping the security group audit. The scan calls EC2 describe_security_groups to classify inbound rules across your defined scope, detecting overly permissive access controls without requiring a full account-wide review.

Do I need to set up AWS environment variables to run a network auditing scan for sensitive ports?▼

You need AWS environment variables configured for the default region to run a network auditing scan for sensitive ports. Setting up the AWS environment variables allows the scanning process to authenticate and call EC2 describe_security_groups to evaluate your inbound rules for public exposure.

Why does AWS security group incident response require classifying findings by port and protocol exposure?▼

AWS security group incident response requires classifying findings by port and protocol exposure to prioritize remediation accurately. Categorizing public ingress rules by sensitive ports like 22 and 3389 helps investigators focus on the highest risk network access controls and generate effective revoke-ingress commands.