AWS Lambda + Amazon EventBridge로 보안 그룹의 풀 오픈(0.0.0.0) 규칙을 탐지하고 이메일로 통지해 봤습니다.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeSecurityGroups"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "sns:Publish"
      ],
      "Resource": "arn:aws:sns:ap-northeast-2:xxxxxxxxxx"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:*"
    }
  ]
}

import json
import boto3

ec2 = boto3.client('ec2')
sns = boto3.client('sns')

SNS_TOPIC_ARN = 'arn:aws:sns:ap-northeast-2:xxxxxxxxxx'

def lambda_handler(event, context):
    print("Received event:", json.dumps(event))

    # 모든 보안 그룹 조회
    response = ec2.describe_security_groups()
    security_groups = response['SecurityGroups']

    for sg in security_groups:
        group_id = sg['GroupId']
        for perm in sg.get('IpPermissions', []):
            ip_ranges = perm.get('IpRanges', [])
            for ip_range in ip_ranges:
                cidr = ip_range.get('CidrIp')
                if cidr == '0.0.0.0/0':
                    from_port = perm.get('FromPort', 'All')
                    to_port = perm.get('ToPort', 'All')
                    protocol = perm.get('IpProtocol', 'All')

                    message = (f"⚠️ 보안 경고: Security Group {group_id}이(가) "
                               f"0.0.0.0/0로 포트 오픈됨\n"
                               f"Protocol: {protocol}, Ports: {from_port} - {to_port}")
                    print(message)

                    sns.publish(
                        TopicArn=SNS_TOPIC_ARN,
                        Subject="❗보안 그룹 포트 오픈 경고",
                        Message=message
                    )

    return {
        'statusCode': 200,
        'body': 'Security Group check completed'
    }

{
  "source": ["aws.ec2"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventName": ["AuthorizeSecurityGroupIngress"]
  }
}