Description:

This check verifies that all Security Groups configured in Utho Cloud are associated with one or more compute instances or other supported resources. Security Groups that are not attached to any resource are considered unused and should be reviewed and removed if they are no longer required. Removing unused Security Groups reduces administrative overhead and minimizes the risk of obsolete or overly permissive firewall rules being unintentionally reused.


Rationale:

Unused Security Groups increase the complexity of managing network security and may contain outdated or overly permissive rules that no longer serve a business purpose.

This check helps:

  • Eliminate unnecessary Security Groups from the environment.

  • Reduce the risk of accidentally attaching insecure or outdated Security Groups to resources.

  • Simplify firewall and network security management.

  • Improve compliance with security best practices by maintaining only actively used Security Groups.


Impact:

  • Reduces the number of unnecessary firewall configurations.

  • Improves visibility and manageability of Security Groups.

  • Decreases the risk of obsolete firewall rules being reused.

  • Administrators may need to recreate deleted Security Groups if they are required for future workloads.


Default Value:

Utho Cloud does not automatically remove unused Security Groups. Security Groups remain available until they are manually deleted, even if they are not associated with any cloud resource.


Pre-requisites:

  • Utho Cloud account.

  • Permissions to view and manage Security Groups.

  • Access to the Utho Cloud Console or Utho API.

  • One or more Security Groups configured in the account.


Remediation Steps:

Test Plan:

Using the Utho Cloud Console

  1. Sign in to the Utho Cloud Console.

  2. Navigate to Networking → Security Groups.

  3. Review each Security Group.

  4. Verify whether the Security Group is attached to any compute instance or supported resource.

  5. Identify Security Groups that have no associated resources.


Using the Utho API

List all Security Groups (Firewalls).

curl -s -H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/firewall

Retrieve the details of each Security Group.

curl -s -H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/firewall/<FIREWALL_ID>

Review the response and verify whether the Security Group is attached to any compute instance or cloud resource (for example, through associated instance IDs, server IDs, or attachment information returned by the API).


Implementation Plan:

Using the Utho Cloud Console

  1. Log in to the Utho Cloud Console.

  2. Navigate to Networking → Security Groups.

  3. Identify Security Groups that are not attached to any resource.

  4. Verify that the Security Group is no longer required.

  5. Delete the unused Security Group.

  6. Confirm that no production workloads depend on the deleted Security Group.


Using the Utho API

List Security Groups and identify those with no resource associations.

curl -s -H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/firewall

Delete the unused Security Group.

curl -s -X DELETE \
-H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/firewall/<FIREWALL_ID>/delete

Replace <FIREWALL_ID> with the identifier of the unused Security Group.


Backout Plan:

  1. Log in to the Utho Cloud Console.

  2. Navigate to Networking → Security Groups.

  3. Recreate the deleted Security Group if it is later determined to be required.

  4. Restore all inbound and outbound firewall rules as previously configured.

  5. Reassociate the Security Group with the appropriate compute instances or cloud resources.

  6. Verify that application connectivity and network access function as expected.

References: