NQE Check EC2 Instance for 'default' Security Group

Yes, you can definitely do this with the current NQE model. It parses the instance and security group names and tags.

Take a look at the following query:

foreach cloudAccount in network.cloudAccounts
foreach vpc in cloudAccount.vpcs
foreach computeInstance in vpc.computeInstances
foreach securityGroup in vpc.securityGroups
select {
  violation: securityGroup.groupName == "default",
  VPC: vpc.id,
  "Compute Instance ID": computeInstance.id,
  "Compute Instance Name": computeInstance.name,
  "Security Group ID": securityGroup.id,
  "Security Group Name": securityGroup.name,
  "Security Group Desc": securityGroup.description,
  "Security Group Tags": securityGroup.tags
}

This will pull all of the security groups, show which ones are associated with a particular instance, and then throw a violation on which ones are a default security group.  You can further restrict to particular cloud accounts as needed, or add additional information (instance tags, image type, etc) from the data model.

Ahh, yes - this query will just return all the security groups, with a true/false column for violation for the intersection of those that are set to default and also applied to instances.  This makes it handy for pass/fail continuous verification checks and audits.

To just return the instances that the default groups are applied, let’s move the 

violation: securityGroup.groupName == "default"

line farther up as a where condition instead:

foreach cloudAccount in network.cloudAccounts
foreach vpc in cloudAccount.vpcs
foreach computeInstance in vpc.computeInstances
foreach securityGroup in vpc.securityGroups
where securityGroup.groupName == "default"
select {
  VPC: vpc.id,
  "Compute Instance ID": computeInstance.id,
  "Compute Instance Name": computeInstance.name,
  "Security Group ID": securityGroup.id,
  "Security Group Name": securityGroup.name,
  "Security Group Desc": securityGroup.description,
  "Security Group Tags": securityGroup.tags
}

You can still keep the violation field if you want it to be a pass/fail intent check as well.

Let me know if that helps - thanks!