<p>You can use <code>aws ec2 describe-instances</code> instead, you can specify the id <code>--instance-ids &lt;value&gt;</code> and it will output the security group.</p>

CC BY-SA 4.0
2018-02-07T17:43:29.580Z
2018-07-18T23:27:40.430Z
2018-07-18T23:27:40.430Z
MonkeyMagic
<p>The following one-liner in shell works for me:</p>

<pre><code>aws ec2 describe-security-groups --group-ids $(aws ec2 describe-instances --instance-id $id --query "Reservations[].Instances[].SecurityGroups[].GroupId[]" --output text) --output text
</code></pre>

<p>Where <code>$id</code> is my instance-id.</p>

CC BY-SA 3.0
2018-02-07T18:03:58.983Z
2018-02-07T18:03:58.983Z
kenorb
<p>Even better check this out:</p>
<pre><code>aws ec2 describe-instances --output=json | jq '.Reservations[] | .Instances[] | {PrivateAddress: .PrivateIpAddress, Tags: .Tags, KeyName: .KeyName, Tags: .Tags, RunningState: .State, InstanceId: .InstanceId, SecurityGroups: .SecurityGroups}'
</code></pre>
<p>You don't need to know anything this way ... but you need to install <code>jq</code>, to chomp the JSON o/p just right.</p>
<p>A lot of the elements there could be removed I guess ... tags, key names, running state, etc.</p>

CC BY-SA 4.0
2021-12-20T22:24:19.647Z
This looks promising, but for me it yields only `parse error: Invalid numeric literal at line 1, column 13`.  I suspect there is some "unanticipated" line in my cli output.
CODE-REaD
CC BY-SA 4.0
2021-12-21T19:03:10.030Z
(I amend my comment, above): I had configured my .aws/config file to output text rather than the default JSON.  So in my case, using `--output=json` on the command line caused the prescribed invocation to operate correctly.
CODE-REaD
CC BY-SA 4.0
2021-03-12T15:18:01.340Z
2021-12-21T20:17:40.707Z
2021-12-21T20:17:40.707Z
Cristian Dumitru
<p>If you want to run this on an EC2 instance and find out its own security groups, you can do:</p>
<pre class="lang-shell prettyprint-override"><code>id=$(wget -q -O - http://169.254.169.254/latest/meta-data/instance-id)

for sg in $(aws ec2 describe-instances --instance-id $id \
  --query &quot;Reservations[].Instances[].SecurityGroups[].GroupId[]&quot; \
  --output text)
do
 echo
 aws ec2 describe-security-groups --group-id $sg --output text
done
</code></pre>

CC BY-SA 4.0
2022-11-09T16:42:44.530Z
2022-11-09T16:42:44.530Z
Pierre D
<p>you can use</p>

<pre>aws ec2 describe-instances --instance-ids (your Instance id) --query "Reservations[].Instances[].SecurityGroups[].GroupId[]" --output text</pre>

<p>replace <pre>(your instance id)</pre> with the specific instance id you are looking for.</p>

CC BY-SA 4.0
2019-04-15T20:58:33.923Z
2019-04-15T20:58:33.923Z
user13482
<p>I'm looking for syntax like:</p>

<pre><code>aws ec2 describe-security-groups --instance-id i-0xyz
</code></pre>

<p>however, the above sub-command doesn't support <code>--instance-id</code> parameter.</p>

<p>I've checked and there are <code>--filters</code> and <code>--query</code> parameters, but I'm not sure about the syntax.</p>

<p>What would be the easiest way to display the description of the security group of the instance?</p>

<security><aws-cli>
How to list security groups for the specific instance via CLI?
kenorb
# How to list security groups for the specific instance via CLI?

(Asked by: username_0 on 2018-02-07)

I'm looking for syntax like:
aws ec2 describe-security-groups --instance-id i-0xyz

however, the above sub-command doesn't support --instance-id parameter.
I've checked and there are --filters and --query parameters, but I'm not sure about the syntax.
What would be the easiest way to display the description of the security group of the instance?

**Tags:** security, aws-cli


---

## 5 answers

### Answer by username_1 on 2018-02-07. Score: 4 | Accepted answer

You can use `aws ec2 describe-instances` instead, you can specify the id `--instance-ids`  and it will output the security group.


---

### Answer by username_0 on 2018-02-07. Score: 5

The following one-liner in shell works for me:
aws ec2 describe-security-groups --group-ids $(aws ec2 describe-instances --instance-id $id --query "Reservations[].Instances[].SecurityGroups[].GroupId[]" --output text) --output text

Where $id is my instance-id.


---

### Answer by username_2 on 2021-03-12. Score: 0

Even better check this out:
aws ec2 describe-instances --output=json | jq '.Reservations[] | .Instances[] | {PrivateAddress: .PrivateIpAddress, Tags: .Tags, KeyName: .KeyName, Tags: .Tags, RunningState: .State, InstanceId: .InstanceId, SecurityGroups: .SecurityGroups}'

You don't need to know anything this way ... but you need to install jq, to chomp the JSON o/p just right.
A lot of the elements there could be removed I guess ... tags, key names, running state, etc.

> **Comments:**
> **username_3**: This looks promising, but for me it yields only `parse error: Invalid numeric literal at line 1, column 13`.  I suspect there is some "unanticipated" line in my cli output.  
> **username_3**: (I amend my comment, above): I had configured my .aws/config file to output text rather than the default JSON.  So in my case, using `--output=json` on the command line caused the prescribed invocation to operate correctly.  

---

### Answer by username_4 on 2022-11-09. Score: 0

If you want to run this on an EC2 instance and find out its own security groups, you can do:
id=$(wget -q -O - http://169.254.169.254/latest/meta-data/instance-id)

for sg in $(aws ec2 describe-instances --instance-id $id \
  --query "Reservations[].Instances[].SecurityGroups[].GroupId[]" \
  --output text)
do
 echo
 aws ec2 describe-security-groups --group-id $sg --output text
done


---

### Answer by username_5 on 2019-04-15. Score: 0

you can use
aws ec2 describe-instances --instance-ids (your Instance id) --query "Reservations[].Instances[].SecurityGroups[].GroupId[]" --output text
replace (your instance id) with the specific instance id you are looking for.


---

