turbot/aws_insights

Query: vpc_security_unrestricted_egress_count

Usage

powerpipe query aws_insights.query.vpc_security_unrestricted_egress_count

SQL

with egress_sg as (
select
group_id,
count(*)
from
aws_vpc_security_group_rule
where
(
cidr_ipv4 = '0.0.0.0/0'
or cidr_ipv6 = '::/0'
)
and ip_protocol <> 'icmp'
and (
from_port = -1
or (
from_port = 0
and to_port = 65535
)
)
and is_egress
group by
group_id
)
select
'Unrestricted Egress (Excludes ICMP)' as label,
count(*) as value,
case
when count(*) = 0 then 'ok'
else 'alert'
end as type
from
aws_vpc_security_group as sg
where
sg.group_id in (
select
group_id
from
egress_sg
)

Dashboards

The query is used in the dashboards: