Nrthugu

i m trying to get unused SG from all regions but its not working .

i tried below code

#!/usr/bin/env python

import boto3



ec2 = boto3.resource('ec2')

regions = ec2.describe_regions().get('Regions',)

for region in regions:

  reg=region['RegionName']



sgs = list(ec2.security_groups.all())

insts = list(ec2.instances.all())



all_sgs = set([sg.group_name for sg in sgs])

all_inst_sgs = set([sg['GroupName'] for inst in insts for sg in inst.security_groups])

unused_sgs = all_sgs - all_inst_sgs



print 'Total SGs:', len(all_sgs)

print 'SGS attached to instances:', len(all_inst_sgs)

print 'Orphaned SGs:', len(unused_sgs)

print 'Unattached SG names:', unused_sgs

describe_regions is a function of the ec2 client, not the ec2 resource. Try this:

#!/usr/bin/env python

import boto3



ec2 = boto3.client('ec2')

regions = ec2.describe_regions().get('Regions',)

for region in regions:

  reg=region['RegionName']

However you're not using the region name in any way. The following code iterates across the regions, sets up a new ec2 resource in each region, and repeats your scans.

#!/usr/bin/env python

import boto3





ec2Client = boto3.client('ec2')

regions = ec2Client.describe_regions().get('Regions',)

for region in regions:

    reg=region['RegionName']

    print ('Checking region {}'.format(reg))



    ec2 = boto3.resource('ec2', region_name=reg)



    sgs = list(ec2.security_groups.all())

    insts = list(ec2.instances.all())



    all_sgs = set([sg.group_name for sg in sgs])

    all_inst_sgs = set([sg['GroupName'] for inst in insts for sg in inst.security_groups])

    unused_sgs = all_sgs - all_inst_sgs



    print ('    Total SGs:', len(all_sgs))

    print ('    SGS attached to instances:', len(all_inst_sgs))

    print ('    Orphaned SGs:', len(unused_sgs))

    print ('    Unattached SG names:', unused_sgs)

While testing I found I have a lot of unused SGs, thanks.