**Example 1: To describe a security group**
The following ``describe-security-groups`` example describes the specified security group. ::
aws ec2 describe-security-groups \
--group-ids sg-903004f8
Output::
{
"SecurityGroups": [
{
"IpPermissionsEgress": [
{
"IpProtocol": "-1",
"IpRanges": [
{
"CidrIp": "0.0.0.0/0"
}
],
"UserIdGroupPairs": [],
"PrefixListIds": []
}
],
"Description": "My security group",
"Tags": [
{
"Value": "SG1",
"Key": "Name"
}
],
"IpPermissions": [
{
"IpProtocol": "-1",
"IpRanges": [],
"UserIdGroupPairs": [
{
"UserId": "123456789012",
"GroupId": "sg-903004f8"
}
],
"PrefixListIds": []
},
{
"PrefixListIds": [],
"FromPort": 22,
"IpRanges": [
{
"Description": "Access from NY office",
"CidrIp": "203.0.113.0/24"
}
],
"ToPort": 22,
"IpProtocol": "tcp",
"UserIdGroupPairs": []
}
],
"GroupName": "MySecurityGroup",
"VpcId": "vpc-1a2b3c4d",
"OwnerId": "123456789012",
"GroupId": "sg-903004f8",
}
]
}
**Example 2: To describe security groups that have specific rules**
The following ``describe-security-groups``example uses filters to scope the results to security groups that have a rule that allows SSH traffic (port 22) and a rule that allows traffic from all addresses (``0.0.0.0/0``). The example uses the ``--query`` parameter to display only the names of the security groups. Security groups must match all filters to be returned in the results; however, a single rule does not have to match all filters. For example, the output returns a security group with a rule that allows SSH traffic from a specific IP address and another rule that allows HTTP traffic from all addresses. ::
aws ec2 describe-security-groups \
--filters Name=ip-permission.from-port,Values=22 Name=ip-permission.to-port,Values=22 Name=ip-permission.cidr,Values='0.0.0.0/0' \
--query "SecurityGroups[*].[GroupName]" \
--output text
Output::
default
my-security-group
web-servers
launch-wizard-1
**Example 3: To describe security groups based on tags**
The following ``describe-security-groups`` example uses filters to scope the results to security groups that include ``test`` in the security group name, and that have the tag ``Test=To-delete``. The example uses the ``--query`` parameter to display only the names and IDs of the security groups. ::
aws ec2 describe-security-groups \
--filters Name=group-name,Values=*test* Name=tag:Test,Values=To-delete \
--query "SecurityGroups[*].{Name:GroupName,ID:GroupId}"
Output::
[
{
"Name": "testfornewinstance",
"ID": "sg-33bb22aa"
},
{
"Name": "newgrouptest",
"ID": "sg-1a2b3c4d"
}
]
For additional examples using tag filters, see `Working with tags <https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#Using_Tags_CLI>`__ in the *Amazon EC2 User Guide*.