Agile Architecture
Performance on Amazon AWS 
Michiel Sens 14 Oct, 2012
Share 
Amazon AWS makes it really easy for anybody to create and update firewall rules that provide access to the virtual machines inside AWS. Within seconds you can add your own IP address so you can work from home or the office. However, it is also very easy to forget to remove them once your are finished. The utility aws-sg-revoker , will help you maintain your firewall rules.
aws-sg-revoker inspects all your inbound access permission and compares them with the public IP addresses of the machines in your AWS account. For grants to IP addresses not found in your account, it will generate a aws CLI revoke command. But do not be afraid: it only generates, it does not execute it directly. You may want to investigate before removal. Follow the following 4 steps to safeguard your account!
step 1. Investigate
First run the following command to generate a list of all the IP address ranges that are referenced but not in your account.
aws-sg-revoker -l 1.2.3.4 x.y.z. 4.5.6.7. hostname.com. 5.5.123.4 a.b.c. 8.9.10.11/16 ....
You may find that you have to install jq and the aws CLI 🙂
step 2. Exclude known addresses
Exclude the ip addresses that are ok. These addresses are added as regular expressions.
aws-sg-revoker -l -w 1\.2\.\3\.4 -w 8\.9\.10\.11/16
step 3. generate revoke commands
Once you are happy, you can generate the revoke commands:
aws-sg-revoker -w 1\.2\.\3\.4 -w 4\.5\.6\.7 -w 8\.9\.10\.11/16 aws ec2 revoke-security-group-ingress --group-id sg-aaaaaaaa --port 22-22 --protocol tcp --cidr 5.5.123.4/32 # revoke from sg blablbsdf aws ec2 revoke-security-group-ingress --group-id sg-aaaaaaaa --port 9200-9200 --protocol tcp --cidr 5.5.123.4/32 # revoke from sg blablbsdf aws ec2 revoke-security-group-ingress --group-id sg-aaaaaaaa --port 9080-9080 --protocol tcp --cidr 5.5.123.4/32 # revoke from sg blablbsdf aws ec2 revoke-security-group-ingress --group-id sg-bbbbbbbb --protocol -1 --cidr 5.5.123.4/32 # revoke from sg sg-1 aws ec2 revoke-security-group-ingress --group-id sg-bbbbbbbb --protocol -1 -cidr 5.5.123.4/32 # revoke from sg sg-3
step 4. Execute!
If the revokes look ok, you can execute them by piping them to a shell:
aws-sg-revoker -w 1\.2\.\3\.4 -w 8\.9\.10\.11/16 | tee revoked.log | bash
conclusion
This utility makes it easy to for you to regularly inspect and maintain your firewall rules and keep your AWS resources safe!
Mark van Holsteijn is a senior software systems architect at Xebia Cloud-native solutions. He is passionate about removing waste in the software delivery process and keeping things clear and simple.
