# Amazon EC2 Security Group

> Security groups cost nothing on any AWS invoice, but unused groups and over-permissive rules accumulate as audit debt. ZopNight discovers every security group on the 6-hour cycle and runs hygiene checks that flag groups attached to nothing and ingress rules open to 0.0.0.0/0 where exposure looks unintended.

Source: https://zop.dev/integrations/aws/security-group
Updated: 2026-08-19

---

A security group is a virtual firewall controlling inbound and outbound traffic for AWS resources. Security groups are free, but unused groups and overly permissive rules accumulate as hygiene and audit debt across an account.

## Zero dollars, nonzero liability

No meter runs against a security group: AWS bills nothing for the group, its rules, or its evaluations, at any scale. The cost is organizational. Accounts routinely accumulate hundreds of groups, one per Terraform module instantiation, one per deleted experiment, and every audit, incident review, and migration has to reason about all of them. Each unused group is a question someone must answer later, and each over-broad rule is a finding waiting for a penetration test to surface it.

## Hygiene checks ZopNight runs on groups

A dedicated provider inventories security groups on the 6-hour cycle. Two recommendation classes come out of it: unused-group detection, for groups no ENI references. Those are safe deletions that shrink the audit surface. The second is open-ingress detection, for rules admitting 0.0.0.0/0 on ports where public exposure is rarely intentional. There is nothing to schedule or stop; the value is a maintained, current map of the firewall layer instead of a quarterly spreadsheet exercise.

## How rule sprawl actually happens

The default group in every VPC collects ad-hoc rules because it is always there. Groups get cloned rather than shared (copy sg-app, add one port, never reconcile), so the same intent exists in six diverging versions. Temporary debugging rules (SSH from anywhere, "just for an hour") outlive the incident that justified them. And groups referenced by other groups' rules can't be deleted casually, so cleanup stalls and the graph ossifies.

## Inspecting groups and their attachments

Both the EC2 and VPC consoles expose Security Groups; the network interfaces view is the fastest way to confirm whether a group is actually attached to anything. Filtering rules by 0.0.0.0/0 source surfaces the exposure candidates. Deleting an unreferenced group is free, instant, and reversible only by recreating it, which is exactly why the unused ones are the place to start.