Paste an AWS Security Group or Azure NSG JSON to flag overly permissive rules. Detects critical exposures like SSH, RDP, and database ports open to the internet.
Security Group Analyzer parses AWS Security Group JSON and Azure NSG JSON, then checks every inbound rule against known risk patterns. Critical findings cover sensitive ports (SSH port 22, RDP 3389, MySQL 3306, PostgreSQL 5432, Redis 6379, and others) open to 0.0.0.0/0 or ::/0. High findings cover any other port or protocol open to the internet. Medium findings flag inbound rules with port ranges wider than 100 ports, which are often overly broad. Info findings show rules scoped to a specific CIDR.
To get AWS Security Group JSON, run: aws ec2 describe-security-groups --group-ids sg-xxxxxxxx. To get Azure NSG JSON, run: az network nsg show --name myNSG --resource-group myRG. The analyzer works entirely in the browser; your JSON is never sent to a server.
Common misconfigurations caught here include administrative ports (SSH and RDP) accidentally left open to the world, database ports reachable from any IP, and overly broad port ranges created as temporary shortcuts that were never tightened. Reviewing security group rules regularly reduces the attack surface exposed to internet-facing resources.