EC2 security groups, except default, are assessed for unused status: zero attached network interfaces, no AWS Lambda associations, no AWS Batch compute environment associations, and no references from other security groups.
Risk
Orphaned security groups may later be attached with overly permissive rules without review, enabling unintended inbound or lateral access that compromises confidentiality and integrity. They also create configuration drift, increasing the chance of misapplied access controls.
prowler aws --checks ec2_securitygroup_not_used
Recommendation
Apply least privilege and strong lifecycle management: delete or quarantine unused security groups, enforce ownership tags and retention policies, review regularly, and manage changes via IaC with approvals. Restrict who can attach groups and use guardrails to prevent reuse of stale or permissive groups.
Remediation
aws ec2 delete-security-group --group-id <SECURITY_GROUP_ID>
- In the AWS Console, go to EC2 > Security Groups
- Select the non-default security group that shows Used by = 0 (no network interfaces or resources)
- Click Actions > Delete security group > Delete
Source Code
Resource Type
AwsEc2SecurityGroup