> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/resilience-testing/chaos-engineering/use-chaos-engineering/probes/probe-templates/aws/aws-security-group-rule-check.md).

# Aws Security Group Rule Check

Validates the presence of rules in AWS security groups. This probe checks if the specified security groups have any rules configured. It can be used to verify that security groups are not left open.

## Infrastructure type <a href="#infrastructure-type" id="infrastructure-type"></a>

* **Kubernetes**

## Use cases <a href="#use-cases" id="use-cases"></a>

AWS Security Group Rule Check probe helps you:

* Validate security group configurations remain intact during chaos
* Verify network access rules are properly configured
* Monitor security posture during infrastructure changes
* Ensure security groups are not accidentally left without rules

***

## Overview <a href="#overview" id="overview"></a>

This probe uses the AWS CLI to query security group configurations and validates that the specified security groups have rules configured. It can check for ingress rules, egress rules, or both, helping ensure your network security policies are maintained during chaos experiments.

### Probe type <a href="#probe-type" id="probe-type"></a>

**Command Probe**

### Prerequisites <a href="#prerequisites" id="prerequisites"></a>

* Kubernetes cluster with chaos infrastructure installed
* AWS credentials configured with appropriate IAM permissions:
  * `ec2:DescribeSecurityGroups`
  * `ec2:DescribeSecurityGroupRules`
* Network connectivity to AWS API endpoints
* Target security groups should exist in the specified region

***

## Probe properties <a href="#probe-properties" id="probe-properties"></a>

### Command <a href="#command" id="command"></a>

```
healthchecks -name aws-resource-access-restrict
```

### Comparator <a href="#comparator" id="comparator"></a>

| Type   | Criteria | Value   |
| ------ | -------- | ------- |
| string | contains | \[Pass] |

The probe passes when the command output contains `[Pass]`, indicating the specified security groups have rules configured.

### Environment variables <a href="#environment-variables" id="environment-variables"></a>

| Variable             | Description                                                                            | Required | Default |
| -------------------- | -------------------------------------------------------------------------------------- | -------- | ------- |
| `SECURITY_GROUP_IDS` | Comma-separated list of security group IDs to check (e.g., `sg-12345678,sg-87654321`). | Yes      | -       |
| `RULE_TYPE`          | Type of rule to check: `ingress` or `egress`.                                          | No       | ingress |
| `REGION`             | AWS region where the security groups are located (e.g., `us-east-1`, `eu-west-2`).     | Yes      | -       |

***

## Run properties <a href="#run-properties" id="run-properties"></a>

| Property          | Description                                                              | Type    | Default |
| ----------------- | ------------------------------------------------------------------------ | ------- | ------- |
| `timeout`         | Maximum time to wait for the probe to complete (e.g., `30s`, `1m`, `5m`) | String  | 300s    |
| `interval`        | Time between probe executions (e.g., `5s`, `30s`, `1m`)                  | String  | 10s     |
| `attempt`         | Number of retry attempts before marking the probe as failed              | Integer | 1       |
| `pollingInterval` | Time between retry attempts (e.g., `1s`, `5s`, `10s`)                    | String  | -       |
| `initialDelay`    | Initial delay before starting the probe (e.g., `0s`, `10s`, `30s`)       | String  | -       |
| `stopOnFailure`   | Stop the experiment if the probe fails                                   | Boolean | false   |
| `verbosity`       | Log verbosity level (`info`, `debug`, `trace`)                           | String  | -       |

***

## Probe definition <a href="#probe-definition" id="probe-definition"></a>

You can define this probe in your chaos experiment as follows:

### Check ingress rules <a href="#check-ingress-rules" id="check-ingress-rules"></a>

```yaml
probe:
  - name: "sg-ingress-rule-check"
    type: "cmdProbe"
    mode: "Edge"
    cmdProbe/inputs:
      command: "healthchecks -name aws-resource-access-restrict"
      comparator:
        type: "string"
        criteria: "contains"
        value: "[Pass]"
      env:
        - name: SECURITY_GROUP_IDS
          value: "sg-12345678,sg-87654321"
        - name: RULE_TYPE
          value: "ingress"
        - name: REGION
          value: "us-east-1"
    runProperties:
      timeout: 300s
      interval: 10s
      attempt: 1
      stopOnFailure: false
```

### Check egress rules <a href="#check-egress-rules" id="check-egress-rules"></a>

```yaml
probe:
  - name: "sg-egress-rule-check"
    type: "cmdProbe"
    mode: "Continuous"
    cmdProbe/inputs:
      command: "healthchecks -name aws-resource-access-restrict"
      comparator:
        type: "string"
        criteria: "contains"
        value: "[Pass]"
      env:
        - name: SECURITY_GROUP_IDS
          value: "sg-abcdef123456"
        - name: RULE_TYPE
          value: "egress"
        - name: REGION
          value: "ap-south-1"
    runProperties:
      timeout: 60s
      interval: 5s
      attempt: 3
      pollingInterval: 2s
```