A stale security group rule is a rule that references a deleted security group in the same VPC or in VPC attached to the same transit gateway. When a security group rule becomes stale, it's not automatically removed from your security group—you must manually remove it.
You can view and delete the stale security group rules for a VPC using the Amazon VPC console.
To view and delete stale security group rules
Open the Amazon VPC console at https://console.aws.amazon.com/vpc/
. -
In the navigation pane, choose Security groups.
-
Choose Actions, Manage stale rules.
-
For VPC, choose the VPC with the stale rules.
-
Choose Edit.
-
Choose the Delete button next to the rule that you want to delete. Choose Preview changes, Save rules.
To describe your stale security group rules using the command line
-
describe-stale-security-groups
(AWS CLI) -
Get-EC2StaleSecurityGroup (AWS Tools for Windows PowerShell)
After you've identified the stale security group rules, you can delete them using
the revoke-security-group-ingress
