AWS Security Groups Traffic Analysis Dashboard

A comprehensive Python-based dashboard for analyzing AWS Security Groups across multiple accounts to identify traffic patterns, security vulnerabilities (especially 0.0.0.0/0 rules), and create communication maps between security groups.

🎯 Purpose

This tool performs security audits and traffic analysis across 14 AWS accounts to:

• Identify and analyze 0.0.0.0/0 (public access) rules
• Map security group communications
• Analyze ports, protocols, and IP patterns
• Generate comprehensive security reports
• Provide interactive visualization dashboard

🏗️ Architecture

Core Components

1. SecurityGroupAnalyzer (security_group_analyzer.py)

   • Main analysis engine
   • Multi-account data collection
   • Cross-account role assumption
   • Parallel processing for efficiency

2. Interactive Dashboard (dashboard.py)

   • Streamlit-based web interface
   • Real-time data visualization
   • Network communication graphs
   • Filtering and export capabilities

3. Data Models

   • SecurityGroupRule dataclass for structured data
   • Comprehensive rule analysis
   • Traffic pattern identification

🚀 Features

Security Analysis

• Public Access Detection: Automatically identifies 0.0.0.0/0 rules
• Communication Mapping: Maps inter-security-group communications
• Port Analysis: Analyzes port usage patterns across accounts
• Protocol Distribution: Breaks down traffic by protocol types

Dashboard Capabilities

• Interactive Visualizations: Network graphs, charts, and metrics
• Multi-Account Support: Analyze across all 14 target accounts
• Real-time Filtering: Filter by account, region, protocol
• Export Functionality: Generate CSV reports for further analysis

Multi-Account Support

Target AWS Accounts:

• 549166761550, 025381531841, 138351723750, 852584260383
• 790679477109, 144196841275, 174436502675, 575045511530
• 713037428386, 856231879353, 338589391164, 147367150109
• 270134153674, 106363003370 (root)

🛠️ Setup Instructions

Prerequisites

• Python 3.8 or higher
• AWS CLI configured with appropriate credentials
• Cross-account IAM roles set up for security analysis

Installation

1. Clone and navigate to the project:

   cd c:\ps\awsMapper

2. Install Python dependencies:

   pip install -r requirements.txt

3. Configure AWS credentials:

   • Ensure AWS CLI is configured with credentials that can assume cross-account roles
   • Set up IAM roles in each target account with SecurityAudit permissions

AWS IAM Setup

For each target account, create an IAM role named SecurityAuditRole with:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeVpcs",
                "ec2:DescribeRegions"
            ],
            "Resource": "*"
        }
    ]
}

Trust policy to allow cross-account access:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::106363003370:root"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

🚀 Usage

Command Line Analysis

Run the security group analyzer directly:

python security_group_analyzer.py

This will:

• Collect security group data from all accounts and regions
• Generate CSV reports in the ./reports directory
• Display summary statistics

Interactive Dashboard

Launch the Streamlit dashboard:

streamlit run dashboard.py

The dashboard provides:

• Overview: Key metrics and alerts
• Public Rules: Detailed view of 0.0.0.0/0 rules
• Communication Map: Network visualization of SG communications
• Port Analysis: Port usage patterns and statistics
• Charts & Graphs: Visual analysis by account and region
• Raw Data: Export functionality and raw data access

Dashboard Features

1. Overview Tab

• Total rules count across all accounts
• Public rules identification and alerts
• Account and security group summaries

2. Public Rules Tab

• Detailed list of all 0.0.0.0/0 rules
• Filtering by account and protocol
• Export capabilities for remediation planning

3. Communication Map Tab

• Interactive network graph showing SG communications
• Detailed communication matrix
• Protocol and port information

4. Port Analysis Tab

• Most commonly used ports
• Protocol distribution charts
• Security implications of port usage

5. Charts & Graphs Tab

• Rules distribution by account
• Regional analysis
• Security posture comparisons

📊 Output Reports

The tool generates several CSV reports:

1. all_security_group_rules_[timestamp].csv: Complete rule inventory
2. public_rules_[timestamp].csv: All rules allowing 0.0.0.0/0 access
3. communication_map_[timestamp].csv: Inter-SG communication matrix
4. port_analysis_[timestamp].csv: Port usage analysis

🔒 Security Considerations

• READ-ONLY: This tool only reads security group configurations
• No Modifications: Cannot and will not modify any security groups
• Audit Trail: All analysis activities are logged
• Secure Credentials: Uses AWS STS for secure cross-account access

⚠️ Important Notes

1. Permissions Required: Ensure proper IAM roles are configured
2. Rate Limiting: The tool implements appropriate API throttling
3. Large Datasets: Analysis may take several minutes for all accounts
4. Network Requirements: Requires internet access to AWS APIs

🔧 Customization

Adding New Regions

Modify the regions parameter in SecurityGroupAnalyzer:

regions = ['us-east-1', 'us-west-2', 'eu-west-1', 'your-new-region']

Custom Analysis

Extend the SecurityGroupRule dataclass to capture additional metadata:

@dataclass
class SecurityGroupRule:
    # ... existing fields ...
    custom_field: str = ""

🐛 Troubleshooting

Common Issues

1. Authentication Errors

   • Verify AWS credentials are configured
   • Check cross-account role permissions
   • Ensure STS is allowed in your region

2. No Data Retrieved

   • Verify account IDs are correct
   • Check regional availability
   • Confirm security group permissions

3. Dashboard Not Loading

   • Ensure all dependencies are installed
   • Check Python version compatibility
   • Verify Streamlit installation

Debug Mode

Enable detailed logging by modifying the log level:

logging.basicConfig(level=logging.DEBUG)

📝 License

This project is intended for internal security analysis purposes.

🤝 Contributing

1. Follow existing code structure
2. Add comprehensive error handling
3. Update documentation for new features
4. Test with multiple accounts before deployment

📞 Support

For issues or questions:

1. Check the troubleshooting section
2. Review AWS IAM configurations
3. Verify account access permissions
4. Check regional service availability