1. Run the describe-security-groups command using the required values as shown in the sample below to retrieve the list of security groups with ingress rules that allow SSH traffic (TCP port 22) from any address:

aws ec2 describe-security-groups \\
	--region us-east-1 \\
	--filters Name=ip-permission.from-port,Values=22 Name=ip-permission.to-port,Values=22 Name=ip-permission.cidr,Values='0.0.0.0/0' \\
	--query 'SecurityGroups[*].{GroupID: GroupId, Name:GroupName }'

 
2. In return, you should receive a list of Security Group IDs and Names that have unfettered SSH access. If you obtain no output, it implies that no EC2 security groups permit unrestricted SSH access.

[
    {
        "GroupID": "sg-000733f1909fa454c",
        "Name": "ricardo-nessus"
    },
    {
        "GroupID": "sg-0017b1796c79076fe",
        "Name": "launch-wizard-53"
    },
    {
        "GroupID": "sg-0025ccd0a2ac11c01",
        "Name": "jorge-sg"
    },
		...
    {
        "GroupID": "sg-0039067806d7a7d32",
        "Name": "launch-wizard-79"
    },
    {
        "GroupID": "sg-00a0549138ca12713",
        "Name": "AutoScaling-Security-Group-1"
    },
    {
        "GroupID": "sg-00a2ad181cf9c287a",
        "Name": "launch-wizard-100"
		}
]

 
3. Now copy a security group id from among the output and run the describe-instances command with the appropriate values to determine the associated EC2 instances and their subnets . The following example retrieves all instances that have the security group sg-0017b1796c79076fe attached to it:

aws ec2 describe-instances \\
	--region us-east-1 \\
	--filters Name=network-interface.group-id,Values=sg-0017b1796c79076fe \\
	--query 'Reservations[*].Instances[*].{ID: InstanceId, SubnetId: SubnetId, VPCId: VpcId}[]'

 
4. The response should contain a list of all instances and subnet ids that are members of the security group mentioned earlier. There are no instances linked with the security group if the returned list has 0 items.

[
    {
        "ID": "i-0cef3d8f841f9e6e8",
        "SubnetId": "subnet-0807cfba916abfa48",
        "VPCId": "vpc-00fe952cb22d6bff5"
    },
    {
        "ID": "i-040e31e435bcab271",
        "SubnetId": "subnet-0807cfba916abfa48",
        "VPCId": "vpc-00fe952cb22d6bff5"
    }
]

 
5. Now grab the SubnetId and run describe-route-tables command with necessary filters to determine the routes tables associated with the subnet.

aws ec2 describe-route-tables \\
	--region us-east-1 \\
	--filters Name=association.subnet-id,Values=subnet-0807cfba916abfa48 \\
	--query 'RouteTables[*].{Id: RouteTableId, Routes: Routes}'

 
6. The output should return any explicit route table and the corresponding routes associated with the subnet. Suppose a subnet is not explicitly associated with any route table, i.e., In that case, the output of the above command is an empty list. The subnet would be implicitly associated with the main route table of the VPC. In our case, the command’s output is an empty list; hence the subnet is associated with the main route table of the VPC.

[]

 
7. Using the VPCId returned in Step 4, Run describe-route-tables again to fin out the main route table and associated routes as shown below

aws ec2 describe-route-tables \\
	--region us-east-1 --filters Name=vpc-id,Values=vpc-00fe952cb22d6bff5 Name=association.main,Values=true \\
--query 'RouteTables[*].{TableId: RouteTableId, Routes: Routes}'

 
8. The output of the above command should return the list of main route tables associated with the VPC, as shown below. Check if there is an associated route to 0.0.0.0/0 via an Internet Gateway. e.g., in the output below, we can see a route to 0.0.0.0/0 via Internet Gateway Id igw-01937c8f9e2716653. This indicates that the concerned subnet is a public subnet and the EC2 instance chosen is at risk. ****
 
9. Repeat Steps 5 – 8 for all instances identified in Step 4.
 
10. Repeat Steps 3 – 9 for all security groups identified in Step 2.