security-group-gc.py

#!/usr/bin/env python
import argparse
import sys
import logging

from boto.ec2 import regions, connect_to_region


def main():

    parser = setup_parser()
    options = parser.parse_args()

    log = logging.getLogger("aws-gc")
    log.setLevel(logging.DEBUG)
    handler = logging.StreamHandler(sys.stdout)
    handler.setLevel(logging.DEBUG)
    handler.setFormatter(logging.Formatter("%(asctime)s %(message)s"))
    log.addHandler(handler)

    log.info("Garbage collecting unused security groups")

    total = 0
    for region in (options.regions or regions()):
        log.info("Processing region %s", region)
        if isinstance(region, basestring):
           ec2 = connect_to_region(region)
        else:
           ec2 = region.connect()

        reservations = ec2.get_all_instances()
        groups = ec2.get_all_security_groups()
        unused = set([g.name for g in groups])
        if options.prefix:
            unused = set(filter(lambda x: x.startswith(options.prefix), unused))

        for r in reservations:
            for rg in r.groups:
                if rg.name in unused:
                    unused.remove(rg.name)

        log.info("Found %d unused groups" % (len(unused)))

        if options.dry_run:
            continue

        for u in sorted(unused):
            if str(u) == 'default':
                continue
            log.debug("Deleting group %s", u)
            ec2.delete_security_group(u)

        total += len(unused)
    log.info("Complete (total: %d)" % total)


def setup_parser():
    parser = argparse.ArgumentParser()
    parser.add_argument(
        '-o', '--owner', default="self",
        help="Account owner (used to filter images and snapshots).")
    parser.add_argument(
        '-r', '--region', action="append", required=True, dest="regions",
        help="Regions to operate, on repeat for multiples.")
    parser.add_argument(
        '-p', '--prefix', help="Group prefix.")
    parser.add_argument(
        '-d', '--dryrun', action="store_true", dest="dry_run",
        help="Dry run application of infer tags")
    return parser


if __name__ == '__main__':
    try:
        main()
    except:
        import pdb, sys, traceback
        traceback.print_exc()
        pdb.post_mortem(sys.exc_info()[-1])