Control: 3 Unused EC2 security groups should be removed


This control helps you maintain an accurate asset inventory of needed security groups in your cardholder data environment (CDE). It does so by checking that security groups are attached to Amazon EC2 instances or to an ENI. A failed finding indicates you may have unused Amazon EC2 security groups.

Unless there is a business need to retain them, you should remove unused resources to maintain an accurate inventory of system components.


You must perform the following steps for each security group not attached to an ENI.

  1. Open the Amazon VPC console
  2. In the navigation pane, under Security, choose Security groups.
  3. Select the check box for the security group to delete.
  4. From Actions, choose Delete security group.
  5. Choose Delete.


steampipe check aws_compliance.control.pci_v321_ec2_3


This control uses a named query: