AWS Security Groups

Import AWS Security Group configurations exported with the AWS CLI. netbobr parses inbound and outbound rules, extracting source/destination CIDRs, protocols, and port ranges for compliance analysis.

Export Commands

# Export all security groups
aws ec2 describe-security-groups > security-groups.json

# Export a specific security group
aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0 > sg.json

# Export with filters (e.g., by VPC)
aws ec2 describe-security-groups --filters "Name=vpc-id,Values=vpc-abc123" > vpc-sgs.json

# Bare array of groups (no wrapper)
aws ec2 describe-security-groups --query SecurityGroups > sg-array.json

# One record per rule
aws ec2 describe-security-group-rules > sg-rules.json

Supported JSON Shapes

netbobr accepts four JSON structures, all detected automatically:

1. Full describe-security-groups output -- the standard AWS CLI response with a SecurityGroups array wrapper
2. Array of security group objects -- for example --query SecurityGroups
3. Single security group object -- a single object with IpPermissions and/or IpPermissionsEgress
4. describe-security-group-rules output -- a SecurityGroupRules array with one record per rule (IsEgress, IpProtocol, FromPort, ToPort, and one of CidrIpv4, CidrIpv6, PrefixListId, ReferencedGroupInfo)

Example

A minimal security group with one inbound and one outbound rule:

{
  "SecurityGroups": [
    {
      "GroupName": "web-servers",
      "GroupId": "sg-0abc0001",
      "Description": "Security group for web services",
      "IpPermissions": [
        {
          "IpProtocol": "tcp",
          "FromPort": 443,
          "ToPort": 443,
          "IpRanges": [
            { "CidrIp": "10.0.0.0/8", "Description": "HTTPS from internal" }
          ]
        }
      ],
      "IpPermissionsEgress": [
        {
          "IpProtocol": "tcp",
          "FromPort": 80,
          "ToPort": 80,
          "IpRanges": [
            { "CidrIp": "0.0.0.0/0", "Description": "HTTP outbound" }
          ]
        }
      ]
    }
  ]
}

This produces two flows:

• Inbound: 10.0.0.0/8 -> 0.0.0.0/0 TCP 443
• Outbound: 0.0.0.0/0 -> 0.0.0.0/0 TCP 80

Parser Behavior

• Protocol -1 (all traffic) maps to ANY with port range 1-65535
• Port ranges are preserved as FromPort-ToPort notation (e.g., 8000-9000). A range starting at 0 starts at 1: 0-65535 becomes 1-65535, because AWS uses it to mean "all ports" and port 0 is not a real service
• Single ports where FromPort equals ToPort are rendered as a single number (e.g., 443)
• ICMP rules use the ICMP type (FromPort) instead of a port; -1 means all types. Types netbobr does not model individually (anything other than 0, 3, 5, 8, 11 and 12) are analysed as all ICMP types, with a warning such as ICMP type 13 is not modelled; treated as all ICMP types. Type-specific checks (for example "ICMP redirect permitted") can then fire.
• Supported protocols are TCP (tcp/6), UDP (udp/17), ICMP (icmp/1) and all traffic (-1). Other protocols, such as ESP (50), AH (51), GRE (47), SCTP (132) and ICMPv6 (58), are skipped with a warning such as AWS security group "vpn" (sg-0abc) inbound rule: protocol "50" (ESP) is not supported -- rule skipped
• Metadata includes the security group name, group ID, description, and direction for each parsed flow

Member instances placeholder

A security group rule only names the remote side. The other side is "the instances this group is attached to", which cannot be resolved to a CIDR. netbobr uses the 0.0.0.0/0 placeholder for it (the destination of inbound flows, the source of outbound flows) and reports this once per file:

24 AWS security groups: member instances cannot be resolved to CIDR -- substituted 0.0.0.0/0 as the destination of 223 inbound flows and the source of 137 outbound flows (web-servers-1, web-servers-2, database-servers-1, database-servers-2, admin-servers-1, … +19 more)

Limitations and Warnings

Security group references

Rules that reference other security groups (UserIdGroupPairs) cannot be resolved to CIDR blocks. These rules generate a warning and are skipped:

Security group reference sg-0abc1234 in web-servers cannot be resolved to CIDR -- skipped

To include these flows, find the CIDR ranges associated with the referenced security group and create equivalent CIDR-based rules, or add them manually in netbobr.

IPv6 ranges

IPv6 CIDR ranges (Ipv6Ranges) are skipped with a warning. netbobr currently only supports IPv4 addresses.

VPC prefix lists

Rules referencing VPC prefix lists (PrefixListIds) are skipped with a warning since prefix lists cannot be resolved to CIDRs without additional AWS API calls.

Tier 2 rules (both-specific source AND destination)

AWS Security Groups inherently express rules with only one specific CIDR -- the source (for inbound) or the destination (for outbound). The other side is always implied as "the resource the SG is attached to." This means AWS SGs always have 0% Tier 2 accuracy (rules requiring both a specific source and destination CIDR).

Accuracy

The 79.5% match rate reflects two expected gaps:

• 40 Tier 2 flows that require both specific source and destination CIDRs (AWS SGs cannot express this)
• 42 Tier 1 flows involving protocol ANY with full port ranges, where AWS protocol -1 semantics differ from CSV baseline representation

When a flow does match, risk scores, risk levels, and verdicts are identical to the CSV baseline (100% field accuracy).

Troubleshooting

No flows parsed

Verify the JSON file is one of the four supported shapes: a SecurityGroups wrapper, an array of security groups, a single security group, or a SecurityGroupRules wrapper. A common mistake is exporting EC2 instance descriptions instead of security groups -- look for IpPermissions in the JSON structure. If the file is recognised but every rule was skipped (for example only security group references), the import says that no flows could be analysed and lists the warnings.

Missing rules

Check if rules use security group references instead of CIDR blocks. These appear as warnings in the import results banner. Rules referencing UserIdGroupPairs, Ipv6Ranges, or PrefixListIds are skipped, and so are rules with an unsupported protocol.

Fewer flows than expected

Each CidrIp entry in IpRanges produces one flow. If a single rule has multiple CIDR ranges, they produce multiple flows. Rules with no IpRanges (only security group references) produce zero flows.

Usage

CLI:

npx @netbobr/cli analyze security-groups.json --cloud-format aws-sg

Browser: Drag and drop the .json file onto the import area. The format is auto-detected.