I'm looking for syntax like:

aws ec2 describe-security-groups --instance-id i-0xyz

however, the above sub-command doesn't support --instance-id parameter.

I've checked and there are --filters and --query parameters, but I'm not sure about the syntax.

What would be the easiest way to display the description of the security group of the instance?

5 Answers 5


You can use aws ec2 describe-instances instead, you can specify the id --instance-ids <value> and it will output the security group.


The following one-liner in shell works for me:

aws ec2 describe-security-groups --group-ids $(aws ec2 describe-instances --instance-id $id --query "Reservations[].Instances[].SecurityGroups[].GroupId[]" --output text) --output text

Where $id is my instance-id.


you can use

aws ec2 describe-instances --instance-ids (your Instance id) --query "Reservations[].Instances[].SecurityGroups[].GroupId[]" --output text


(your instance id)
with the specific instance id you are looking for.


Even better check this out:

aws ec2 describe-instances --output=json | jq '.Reservations[] | .Instances[] | {PrivateAddress: .PrivateIpAddress, Tags: .Tags, KeyName: .KeyName, Tags: .Tags, RunningState: .State, InstanceId: .InstanceId, SecurityGroups: .SecurityGroups}'

You don't need to know anything this way ... but you need to install jq, to chomp the JSON o/p just right.

A lot of the elements there could be removed I guess ... tags, key names, running state, etc.

  • This looks promising, but for me it yields only parse error: Invalid numeric literal at line 1, column 13. I suspect there is some "unanticipated" line in my cli output.
    – CODE-REaD
    Commented Dec 20, 2021 at 22:24
  • (I amend my comment, above): I had configured my .aws/config file to output text rather than the default JSON. So in my case, using --output=json on the command line caused the prescribed invocation to operate correctly.
    – CODE-REaD
    Commented Dec 21, 2021 at 19:03

If you want to run this on an EC2 instance and find out its own security groups, you can do:

id=$(wget -q -O -

for sg in $(aws ec2 describe-instances --instance-id $id \
  --query "Reservations[].Instances[].SecurityGroups[].GroupId[]" \
  --output text)
 aws ec2 describe-security-groups --group-id $sg --output text

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.