# Ensure non-default security groups are in use - Source: https://support.icompaas.com/support/solutions/articles/a_1793292207879102-ensure-non-default-security-groups-are-in-use - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every non-default Amazon EC2 security group is in use. A security group is considered unused when it is not attached to any network interface, is not used by any AWS Lambda function, and is not referenced in the inbound rules of any security group. Default security groups are not evaluated because they cannot be deleted. **Rationale** Unused security groups are often left over from old workloads and are rarely reviewed. They may contain overly permissive rules and can later be attached to a new resource without anyone checking them, giving unintended inbound or lateral access. They also add clutter and configuration drift, which makes it harder to review access controls. Deleting unused security groups, and managing the remaining ones with clear ownership and regular reviews, keeps the network configuration clean and reduces the risk of misapplied rules. **Impact** - Removes stale and possibly permissive rules before they can be reused - Makes security group reviews simpler and reduces configuration drift - A deleted security group cannot be restored; recreating it produces a new security group ID, so any template, script or launch configuration that refers to the old ID must be updated **Default Value** Security groups are not deleted automatically when the resources that used them are terminated or deleted. **Pre-Requisites** - IAM permissions: ec2:DescribeSecurityGroups, ec2:DescribeNetworkInterfaces, lambda:ListFunctions and ec2:DeleteSecurityGroup - Confirmation from the owner that the security group is not referenced by templates, launch templates or automation that will use it later **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console and select **Security Groups** under **Network & Security**. 3. Note the ID of a security group other than default. 4. Check that the security group is not used anywhere: - select **Network Interfaces** under **Network & Security**, search for the security group ID and check whether any interface is listed, - check whether the inbound rules of any other security group use this security group ID as the source, - check whether any AWS Lambda function's VPC settings use this security group. 5. Repeat for each security group in each region in use. 6. If a security group is not used anywhere, follow the implementation steps. **CLI:** Check whether the security group is attached to any network interface: aws ec2 describe-network-interfaces --region --filters Name=group-id,Values= --query "NetworkInterfaces\[\].NetworkInterfaceId" Check whether any security group references it in an inbound rule: aws ec2 describe-security-groups --region --filters Name=ip-permission.group-id,Values= --query "SecurityGroups\[\].GroupId" Check whether any Lambda function uses it: aws lambda list-functions --region --query "Functions\[\].\[FunctionName,VpcConfig.SecurityGroupIds\]" A security group other than default fails if all three commands return no match for its ID. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console and select **Security Groups** under **Network & Security**. 3. Select the unused security group found in the Test Plan. 4. Choose **Actions**, then **Delete security groups**, and confirm the deletion. 5. Repeat for each unused security group in each region in use. **CLI:** Delete the unused security group: aws ec2 delete-security-group --region --group-id **Backout Plan** Before deleting, save the security group's configuration: aws ec2 describe-security-groups --region --group-ids > -backup.json To roll back: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console, select **Security Groups** and choose **Create security group**. 3. Enter the name, description and VPC from the saved backup. 4. Re-add the inbound and outbound rules from the saved backup and choose **Create security group**. 5. Update any template or automation that referred to the old security group ID. Note: the recreated security group gets a new ID; the original ID cannot be restored. **Reference** - [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html) - [https://docs.aws.amazon.com/vpc/latest/userguide/deleting-security-groups.html](https://docs.aws.amazon.com/vpc/latest/userguide/deleting-security-groups.html) - [https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-security-group.html](https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-security-group.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.