Back to Checks
huaweicloud

ECS instances should have security groups attached

ecs_instance_security_groups_attached
Service: ecsSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

Ensure that Elastic Cloud Server (ECS) instances have at least one security group attached to control network traffic.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

ECS instances without security groups have no network-level access control, potentially allowing unrestricted inbound or outbound traffic.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks ecs_instance_security_groups_attached

Recommendation

Attach at least one properly configured security group to every ECS instance.

Remediation

CLI

hcloud ECS NovaAssociateSecurityGroup --server_id=<instance_id> --addSecurityGroup.name=<sg_name>

Other

1Log on to the **Huawei Cloud** console
2Navigate to **Elastic Cloud Server**
3Select the instance
4Click **More** > **Manage Security Group**
5Attach an appropriate **security group**

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.ecs.ecs_client import ecs_client


class ecs_instance_security_groups_attached(Check):
    """Ensure ECS instances have security groups attached."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        for instance in ecs_client.instances.values():
            report = CheckReportHuaweiCloud(metadata=self.metadata(), resource=instance)
            report.region = instance.region
            report.resource_id = instance.id
            report.resource_arn = f"huaweicloud:ecs:{instance.region}:{ecs_client.audited_account}:instance/{instance.id}"

            if instance.security_groups:
                sg_names = ", ".join(
                    name or sg_id for sg_id, name in instance.security_groups.items()
                )
                report.status = "PASS"
                report.status_extended = f"ECS instance {instance.name} ({instance.id}) has security group(s) attached: {sg_names}."
            else:
                report.status = "FAIL"
                report.status_extended = f"ECS instance {instance.name} ({instance.id}) does not have any security groups attached."

            findings.append(report)

        return findings

References