Table Of Contents

Feedback

User Guide

First time using the AWS CLI? See the User Guide for help getting started.

[ aws . ec2 ]

describe-security-groups

Description

Describes one or more of your security groups.

A security group is for use with instances either in the EC2-Classic platform or in a specific VPC. For more information, see Amazon EC2 Security Groups in the Amazon Elastic Compute Cloud User Guide and Security Groups for Your VPC in the Amazon Virtual Private Cloud User Guide .

See also: AWS API Documentation

describe-security-groups is a paginated operation. Multiple API calls may be issued in order to retrieve the entire data set of results. You can disable pagination by providing the --no-paginate argument. When using --output text and the --query argument on a paginated response, the --query argument must extract data from the results of the following query expressions: SecurityGroups

Synopsis

  describe-security-groups
[--filters <value>]
[--group-ids <value>]
[--group-names <value>]
[--dry-run | --no-dry-run]
[--cli-input-json <value>]
[--starting-token <value>]
[--page-size <value>]
[--max-items <value>]
[--generate-cli-skeleton <value>]

Options

--filters (list)

One or more filters. If using multiple filters for rules, the results include security groups for which any combination of rules - not necessarily a single rule - match all filters.

  • description - The description of the security group.
  • egress.ip-permission.cidr - An IPv4 CIDR block for an outbound security group rule.
  • egress.ip-permission.from-port - For an outbound rule, the start of port range for the TCP and UDP protocols, or an ICMP type number.
  • egress.ip-permission.group-id - The ID of a security group that has been referenced in an outbound security group rule.
  • egress.ip-permission.group-name - The name of a security group that has been referenced in an outbound security group rule.
  • egress.ip-permission.ipv6-cidr - An IPv6 CIDR block for an outbound security group rule.
  • egress.ip-permission.prefix-list-id - The ID (prefix) of the AWS service to which a security group rule allows outbound access.
  • egress.ip-permission.protocol - The IP protocol for an outbound security group rule (tcp | udp | icmp or a protocol number).
  • egress.ip-permission.to-port - For an outbound rule, the end of port range for the TCP and UDP protocols, or an ICMP code.
  • egress.ip-permission.user-id - The ID of an AWS account that has been referenced in an outbound security group rule.
  • group-id - The ID of the security group.
  • group-name - The name of the security group.
  • ip-permission.cidr - An IPv4 CIDR block for an inbound security group rule.
  • ip-permission.from-port - For an inbound rule, the start of port range for the TCP and UDP protocols, or an ICMP type number.
  • ip-permission.group-id - The ID of a security group that has been referenced in an inbound security group rule.
  • ip-permission.group-name - The name of a security group that has been referenced in an inbound security group rule.
  • ip-permission.ipv6-cidr - An IPv6 CIDR block for an inbound security group rule.
  • ip-permission.prefix-list-id - The ID (prefix) of the AWS service from which a security group rule allows inbound access.
  • ip-permission.protocol - The IP protocol for an inbound security group rule (tcp | udp | icmp or a protocol number).
  • ip-permission.to-port - For an inbound rule, the end of port range for the TCP and UDP protocols, or an ICMP code.
  • ip-permission.user-id - The ID of an AWS account that has been referenced in an inbound security group rule.
  • owner-id - The AWS account ID of the owner of the security group.
  • tag-key - The key of a tag assigned to the security group.
  • tag-value - The value of a tag assigned to the security group.
  • vpc-id - The ID of the VPC specified when the security group was created.

Shorthand Syntax:

Name=string,Values=string,string ...

JSON Syntax:

[
  {
    "Name": "string",
    "Values": ["string", ...]
  }
  ...
]

--group-ids (list)

One or more security group IDs. Required for security groups in a nondefault VPC.

Default: Describes all your security groups.

Syntax:

"string" "string" ...

--group-names (list)

[EC2-Classic and default VPC only] One or more security group names. You can specify either the security group name or the security group ID. For security groups in a nondefault VPC, use the group-name filter to describe security groups by name.

Default: Describes all your security groups.

Syntax:

"string" "string" ...

--dry-run | --no-dry-run (boolean)

Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation . Otherwise, it is UnauthorizedOperation .

--cli-input-json (string) Performs service operation based on the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, the CLI values will override the JSON-provided values.

--starting-token (string)

A token to specify where to start paginating. This is the NextToken from a previously truncated response.

For usage examples, see Pagination in the AWS Command Line Interface User Guide .

--page-size (integer)

The size of each page to get in the AWS service call. This does not affect the number of items returned in the command's output. Setting a smaller page size results in more calls to the AWS service, retrieving fewer items in each call. This can help prevent the AWS service calls from timing out.

For usage examples, see Pagination in the AWS Command Line Interface User Guide .

--max-items (integer)

The total number of items to return in the command's output. If the total number of items available is more than the value specified, a NextToken is provided in the command's output. To resume pagination, provide the NextToken value in the starting-token argument of a subsequent command. Do not use the NextToken response element directly outside of the AWS CLI.

For usage examples, see Pagination in the AWS Command Line Interface User Guide .

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command.

Examples

To describe a security group for EC2-Classic

This example displays information about the security group named MySecurityGroup.

Command:

aws ec2 describe-security-groups --group-names MySecurityGroup

Output:

{
    "SecurityGroups": [
        {
            "IpPermissionsEgress": [],
            "Description": "My security group",
            "IpPermissions": [
                {
                    "PrefixListIds": [],
                    "FromPort": 22,
                    "IpRanges": [
                        {
                            "CidrIp": "203.0.113.0/24"
                        }
                    ],
                    "ToPort": 22,
                    "IpProtocol": "tcp",
                    "UserIdGroupPairs": []
                }
            ],
            "GroupName": "MySecurityGroup",
            "OwnerId": "123456789012",
            "GroupId": "sg-903004f8",
        }
    ]
}

To describe a security group for EC2-VPC

This example displays information about the security group with the ID sg-903004f8. Note that you can't reference a security group for EC2-VPC by name.

Command:

aws ec2 describe-security-groups --group-ids sg-903004f8

Output:

{
    "SecurityGroups": [
        {
            "IpPermissionsEgress": [
                {
                    "IpProtocol": "-1",
                    "IpRanges": [
                        {
                            "CidrIp": "0.0.0.0/0"
                        }
                    ],
                    "UserIdGroupPairs": [],
                    "PrefixListIds": []
                }
            ],
            "Description": "My security group",
            "Tags": [
                {
                    "Value": "SG1",
                    "Key": "Name"
                 }
            ],
            "IpPermissions": [
                {
                    "IpProtocol": "-1",
                    "IpRanges": [],
                    "UserIdGroupPairs": [
                        {
                             "UserId": "123456789012",
                             "GroupId": "sg-903004f8"
                        }
                    ],
                    "PrefixListIds": []
                },
                {
                    "PrefixListIds": [],
                    "FromPort": 22,
                    "IpRanges": [
                        {
                            "Description": "Access from NY office",
                            "CidrIp": "203.0.113.0/24"
                        }
                    ],
                    "ToPort": 22,
                    "IpProtocol": "tcp",
                    "UserIdGroupPairs": []
                  }
            ],
            "GroupName": "MySecurityGroup",
            "VpcId": "vpc-1a2b3c4d",
            "OwnerId": "123456789012",
            "GroupId": "sg-903004f8",
        }
    ]
}

To describe security groups that have specific rules

(EC2-VPC only) This example uses filters to describe security groups that have a rule that allows SSH traffic (port 22) and a rule that allows traffic from all addresses (0.0.0.0/0). The output is filtered to display only the names of the security groups. Security groups must match all filters to be returned in the results; however, a single rule does not have to match all filters. For example, the output returns a security group with a rule that allows SSH traffic from a specific IP address and another rule that allows HTTP traffic from all addresses.

Command:

aws ec2 describe-security-groups --filters Name=ip-permission.from-port,Values=22 Name=ip-permission.to-port,Values=22 Name=ip-permission.cidr,Values='0.0.0.0/0' --query 'SecurityGroups[*].{Name:GroupName}'

Output:

[
  {
     "Name": "default"
  },
  {
     "Name": "Test SG"
  },
  {
     "Name": "SSH-Access-Group"
  }
]

To describe tagged security groups

This example describes all security groups that include test in the security group name, and that have the tag Test=To-delete. The output is filtered to display only the names and IDs of the security groups.

Command:

aws ec2 describe-security-groups --filters Name=group-name,Values='*test*' Name=tag-key,Values=Test Name=tag-value,Values=To-delete --query 'SecurityGroups[*].{Name:GroupName,ID:GroupId}'

Output:

[
  {
     "Name": "testfornewinstance",
     "ID": "sg-33bb22aa"
  },
  {
     "Name": "newgrouptest",
     "ID": "sg-1a2b3c4d"
  }
]

For more information, see Using Security Groups in the AWS Command Line Interface User Guide.

Output

SecurityGroups -> (list)

Information about one or more security groups.

(structure)

Describes a security group

Description -> (string)

A description of the security group.

GroupName -> (string)

The name of the security group.

IpPermissions -> (list)

One or more inbound rules associated with the security group.

(structure)

Describes a set of permissions for a security group rule.

FromPort -> (integer)

The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.

IpProtocol -> (string)

The IP protocol name (tcp , udp , icmp ) or number (see Protocol Numbers ).

[EC2-VPC only] Use -1 to specify all protocols. When authorizing security group rules, specifying -1 or a protocol number other than tcp , udp , icmp , or 58 (ICMPv6) allows traffic on all ports, regardless of any port range you specify. For tcp , udp , and icmp , you must specify a port range. For 58 (ICMPv6), you can optionally specify a port range; if you don't, traffic for all types and codes is allowed when authorizing rules.

IpRanges -> (list)

One or more IPv4 ranges.

(structure)

Describes an IPv4 range.

CidrIp -> (string)

The IPv4 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv4 address, use the /32 prefix length.

Description -> (string)

A description for the security group rule that references this IPv4 address range.

Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*

Ipv6Ranges -> (list)

[EC2-VPC only] One or more IPv6 ranges.

(structure)

[EC2-VPC only] Describes an IPv6 range.

CidrIpv6 -> (string)

The IPv6 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv6 address, use the /128 prefix length.

Description -> (string)

A description for the security group rule that references this IPv6 address range.

Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*

PrefixListIds -> (list)

(EC2-VPC only; valid for authorize-security-group-egress , revoke-security-group-egress and describe-security-groups only) One or more prefix list IDs for an AWS service. In an authorize-security-group-egress request, this is the AWS service that you want to access through a VPC endpoint from instances associated with the security group.

(structure)

[EC2-VPC only] The ID of the prefix.

Description -> (string)

A description for the security group rule that references this prefix list ID.

Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*

PrefixListId -> (string)

The ID of the prefix.

ToPort -> (integer)

The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1 indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes.

UserIdGroupPairs -> (list)

One or more security group and AWS account ID pairs.

(structure)

Describes a security group and AWS account ID pair.

Description -> (string)

A description for the security group rule that references this user ID group pair.

Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*

GroupId -> (string)

The ID of the security group.

GroupName -> (string)

The name of the security group. In a request, use this parameter for a security group in EC2-Classic or a default VPC only. For a security group in a nondefault VPC, use the security group ID.

For a referenced security group in another VPC, this value is not returned if the referenced security group is deleted.

PeeringStatus -> (string)

The status of a VPC peering connection, if applicable.

UserId -> (string)

The ID of an AWS account.

For a referenced security group in another VPC, the account ID of the referenced security group is returned in the response. If the referenced security group is deleted, this value is not returned.

[EC2-Classic] Required when adding or removing rules that reference a security group in another AWS account.

VpcId -> (string)

The ID of the VPC for the referenced security group, if applicable.

VpcPeeringConnectionId -> (string)

The ID of the VPC peering connection, if applicable.

OwnerId -> (string)

The AWS account ID of the owner of the security group.

GroupId -> (string)

The ID of the security group.

IpPermissionsEgress -> (list)

[EC2-VPC] One or more outbound rules associated with the security group.

(structure)

Describes a set of permissions for a security group rule.

FromPort -> (integer)

The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.

IpProtocol -> (string)

The IP protocol name (tcp , udp , icmp ) or number (see Protocol Numbers ).

[EC2-VPC only] Use -1 to specify all protocols. When authorizing security group rules, specifying -1 or a protocol number other than tcp , udp , icmp , or 58 (ICMPv6) allows traffic on all ports, regardless of any port range you specify. For tcp , udp , and icmp , you must specify a port range. For 58 (ICMPv6), you can optionally specify a port range; if you don't, traffic for all types and codes is allowed when authorizing rules.

IpRanges -> (list)

One or more IPv4 ranges.

(structure)

Describes an IPv4 range.

CidrIp -> (string)

The IPv4 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv4 address, use the /32 prefix length.

Description -> (string)

A description for the security group rule that references this IPv4 address range.

Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*

Ipv6Ranges -> (list)

[EC2-VPC only] One or more IPv6 ranges.

(structure)

[EC2-VPC only] Describes an IPv6 range.

CidrIpv6 -> (string)

The IPv6 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv6 address, use the /128 prefix length.

Description -> (string)

A description for the security group rule that references this IPv6 address range.

Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*

PrefixListIds -> (list)

(EC2-VPC only; valid for authorize-security-group-egress , revoke-security-group-egress and describe-security-groups only) One or more prefix list IDs for an AWS service. In an authorize-security-group-egress request, this is the AWS service that you want to access through a VPC endpoint from instances associated with the security group.

(structure)

[EC2-VPC only] The ID of the prefix.

Description -> (string)

A description for the security group rule that references this prefix list ID.

Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*

PrefixListId -> (string)

The ID of the prefix.

ToPort -> (integer)

The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1 indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes.

UserIdGroupPairs -> (list)

One or more security group and AWS account ID pairs.

(structure)

Describes a security group and AWS account ID pair.

Description -> (string)

A description for the security group rule that references this user ID group pair.

Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*

GroupId -> (string)

The ID of the security group.

GroupName -> (string)

The name of the security group. In a request, use this parameter for a security group in EC2-Classic or a default VPC only. For a security group in a nondefault VPC, use the security group ID.

For a referenced security group in another VPC, this value is not returned if the referenced security group is deleted.

PeeringStatus -> (string)

The status of a VPC peering connection, if applicable.

UserId -> (string)

The ID of an AWS account.

For a referenced security group in another VPC, the account ID of the referenced security group is returned in the response. If the referenced security group is deleted, this value is not returned.

[EC2-Classic] Required when adding or removing rules that reference a security group in another AWS account.

VpcId -> (string)

The ID of the VPC for the referenced security group, if applicable.

VpcPeeringConnectionId -> (string)

The ID of the VPC peering connection, if applicable.

Tags -> (list)

Any tags assigned to the security group.

(structure)

Describes a tag.

Key -> (string)

The key of the tag.

Constraints: Tag keys are case-sensitive and accept a maximum of 127 Unicode characters. May not begin with aws:

Value -> (string)

The value of the tag.

Constraints: Tag values are case-sensitive and accept a maximum of 255 Unicode characters.

VpcId -> (string)

[EC2-VPC] The ID of the VPC for the security group.

NextToken -> (string)

The token to use to retrieve the next page of results. This value is null when there are no more results to return.