IT Buddy
Menu
NetworkingSecurityCloudLinux & DevOpsUtilitiesMicrosoft Soon
All toolsMy toolsWhat's newAbout

AWS Security Group analyzer

Paste a describe-security-groups export to find open ports, redundant and shadowed rules, see a traffic diagram and the impact of removing a rule.

Runs in your browser · nothing is sentAWSNew

Everything runs in your browser. Nothing is sent anywhere, including account IDs, group IDs and IP ranges in your export.

How to use

  1. Run "aws ec2 describe-security-groups --output json" (optionally with --group-ids to limit the output), or export from the console.
  2. Paste the JSON into the tool.
  3. Review the findings, the diagram and the groups table.
  4. Click "Show impact" on a flagged rule to see what removing it would change, then export the report if needed.

Common scenarios

Auditing a database security group after a migration

Check whether a rule left open during a migration (for example 0.0.0.0/0 on the database port) is still needed, and see the impact of removing it.

Reviewing rules before a security review

Export all security groups in a VPC and scan for ports open to the internet, duplicate rules and shadowed rules before a scheduled audit.

About this tool

Paste the JSON output of "aws ec2 describe-security-groups" (or the equivalent from the console or SDK) and the tool checks every inbound and outbound rule for common problems: ports open to the entire internet, sensitive services exposed without restriction, rules that are shadowed or redundant, and exact duplicates. It draws a diagram of the allowed traffic between groups, lets you check what would change if you removed a flagged rule, and can export a plain-text report. Everything runs locally; the export never leaves your browser.

🔒 Your input stays in your browser and is never sent anywhere.

Frequently asked questions

Does this connect to my AWS account?

No. There are no credentials and no API calls. You export the security groups yourself with the AWS CLI or console and paste the JSON here.

What counts as "open to the internet"?

A rule whose source (for inbound) or destination (for outbound) includes a large part of the public IPv4 or IPv6 address space, not just specific known networks.

What does "impact of removing this rule" show?

It re-runs the analysis without that one rule and compares the findings. This tells you whether removing it actually fixes the problem, or whether another rule still allows the same traffic.

Does it handle security-group-to-security-group rules?

Yes. A rule that references another security group as its source or destination is shown with that group’s name instead of an IP range, since that traffic is internal to your VPC.

What to do next

Also useful

  • Azure NSG analyzerPaste an Azure NSG export to find open ports, hidden conflicts between subnet and NIC rules, and see a traffic diagram.
  • Kubernetes manifest analyzerPaste a Kubernetes manifest to find missing resource limits, risky security settings, overly broad RBAC rules, and get a suggested patch.
  • VPC/subnet plannerPlan subnets inside a VPC or VNet, see usable addresses after provider reservations, catch overlaps, and export Terraform or CloudFormation.
  • Common network portsSearchable list of well-known TCP and UDP ports: SSH, HTTP, HTTPS, RDP, SMB, DNS, databases and more.
  • DMARC analyzerCheck a DMARC record: policy, subdomain policy, pct and report addresses, with a diagram of what receivers do. Look it up in DNS or paste records.

Found a problem or have a suggestion? Tell us