Answers: <p>You can use <code>aws ec2 describe-instances</code> instead, you can specify the id <code>--instance-ids &lt;value&gt;</code> and it will output the security group.</p>
  
Answers: CC BY-SA 4.0
Answers: 2018-02-07T17:43:29.580Z
Answers: 2018-07-18T23:27:40.430Z
Answers: 2018-07-18T23:27:40.430Z
Answers: MonkeyMagic
Answers: <p>The following one-liner in shell works for me:</p>
  
  <pre><code>aws ec2 describe-security-groups --group-ids $(aws ec2 describe-instances --instance-id $id --query "Reservations[].Instances[].SecurityGroups[].GroupId[]" --output text) --output text
  </code></pre>
  
  <p>Where <code>$id</code> is my instance-id.</p>
  
Answers: CC BY-SA 3.0
Answers: 2018-02-07T18:03:58.983Z
Answers: 2018-02-07T18:03:58.983Z
Answers: kenorb
Answers: <p>Even better check this out:</p>
  <pre><code>aws ec2 describe-instances --output=json | jq '.Reservations[] | .Instances[] | {PrivateAddress: .PrivateIpAddress, Tags: .Tags, KeyName: .KeyName, Tags: .Tags, RunningState: .State, InstanceId: .InstanceId, SecurityGroups: .SecurityGroups}'
  </code></pre>
  <p>You don't need to know anything this way ... but you need to install <code>jq</code>, to chomp the JSON o/p just right.</p>
  <p>A lot of the elements there could be removed I guess ... tags, key names, running state, etc.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-12-20T22:24:19.647Z
Answers: This looks promising, but for me it yields only `parse error: Invalid numeric literal at line 1, column 13`.  I suspect there is some "unanticipated" line in my cli output.
Answers: CODE-REaD
Answers: CC BY-SA 4.0
Answers: 2021-12-21T19:03:10.030Z
Answers: (I amend my comment, above): I had configured my .aws/config file to output text rather than the default JSON.  So in my case, using `--output=json` on the command line caused the prescribed invocation to operate correctly.
Answers: CODE-REaD
Answers: CC BY-SA 4.0
Answers: 2021-03-12T15:18:01.340Z
Answers: 2021-12-21T20:17:40.707Z
Answers: 2021-12-21T20:17:40.707Z
Answers: Cristian Dumitru
Answers: <p>If you want to run this on an EC2 instance and find out its own security groups, you can do:</p>
  <pre class="lang-shell prettyprint-override"><code>id=$(wget -q -O - http://169.254.169.254/latest/meta-data/instance-id)
  
  for sg in $(aws ec2 describe-instances --instance-id $id \
    --query &quot;Reservations[].Instances[].SecurityGroups[].GroupId[]&quot; \
    --output text)
  do
   echo
   aws ec2 describe-security-groups --group-id $sg --output text
  done
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2022-11-09T16:42:44.530Z
Answers: 2022-11-09T16:42:44.530Z
Answers: Pierre D
Answers: <p>you can use</p>
  
  <pre>aws ec2 describe-instances --instance-ids (your Instance id) --query "Reservations[].Instances[].SecurityGroups[].GroupId[]" --output text</pre>
  
  <p>replace <pre>(your instance id)</pre> with the specific instance id you are looking for.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-04-15T20:58:33.923Z
Answers: 2019-04-15T20:58:33.923Z
Answers: user13482
Body: <p>I'm looking for syntax like:</p>
  
  <pre><code>aws ec2 describe-security-groups --instance-id i-0xyz
  </code></pre>
  
  <p>however, the above sub-command doesn't support <code>--instance-id</code> parameter.</p>
  
  <p>I've checked and there are <code>--filters</code> and <code>--query</code> parameters, but I'm not sure about the syntax.</p>
  
  <p>What would be the easiest way to display the description of the security group of the instance?</p>
  
Tags: <security><aws-cli>
Title: How to list security groups for the specific instance via CLI?
UserDisplayName: kenorb
ThreadText: # How to list security groups for the specific instance via CLI?
  
  (Asked by: username_0 on 2018-02-07)
  
  I'm looking for syntax like:
  
  ```
  aws ec2 describe-security-groups --instance-id i-0xyz
  
  ```
  
  however, the above sub-command doesn't support `--instance-id` parameter.
  
  I've checked and there are `--filters` and `--query` parameters, but I'm not sure about the syntax.
  
  What would be the easiest way to display the description of the security group of the instance?
  
  **Tags:** security, aws-cli
  
  
  ---
  
  ## 5 answers
  
  ### Answer by username_1 on 2018-02-07. Score: 4 | Accepted answer
  
  You can use `aws ec2 describe-instances` instead, you can specify the id `--instance-ids <value>` and it will output the security group.
  
  
  ---
  
  ### Answer by username_0 on 2018-02-07. Score: 5
  
  The following one-liner in shell works for me:
  
  ```
  aws ec2 describe-security-groups --group-ids $(aws ec2 describe-instances --instance-id $id --query "Reservations[].Instances[].SecurityGroups[].GroupId[]" --output text) --output text
  
  ```
  
  Where `$id` is my instance-id.
  
  
  ---
  
  ### Answer by username_2 on 2021-03-12. Score: 0
  
  Even better check this out:
  
  ```
  aws ec2 describe-instances --output=json | jq '.Reservations[] | .Instances[] | {PrivateAddress: .PrivateIpAddress, Tags: .Tags, KeyName: .KeyName, Tags: .Tags, RunningState: .State, InstanceId: .InstanceId, SecurityGroups: .SecurityGroups}'
  
  ```
  
  You don't need to know anything this way ... but you need to install `jq`, to chomp the JSON o/p just right.
  
  A lot of the elements there could be removed I guess ... tags, key names, running state, etc.
  
  > **Comments:**
  > **username_3**: This looks promising, but for me it yields only `parse error: Invalid numeric literal at line 1, column 13`.  I suspect there is some "unanticipated" line in my cli output.  
  > **username_3**: (I amend my comment, above): I had configured my .aws/config file to output text rather than the default JSON.  So in my case, using `--output=json` on the command line caused the prescribed invocation to operate correctly.  
  
  ---
  
  ### Answer by username_4 on 2022-11-09. Score: 0
  
  If you want to run this on an EC2 instance and find out its own security groups, you can do:
  
  ```shell
  id=$(wget -q -O - http://169.254.169.254/latest/meta-data/instance-id)
  
  for sg in $(aws ec2 describe-instances --instance-id $id \
    --query "Reservations[].Instances[].SecurityGroups[].GroupId[]" \
    --output text)
  do
   echo
   aws ec2 describe-security-groups --group-id $sg --output text
  done
  
  ```
  
  
  ---
  
  ### Answer by username_5 on 2019-04-15. Score: 0
  
  you can use
  
  ```
  aws ec2 describe-instances --instance-ids (your Instance id) --query "Reservations[].Instances[].SecurityGroups[].GroupId[]" --output text
  ```
  
  replace
  
  ```
  (your instance id)
  ```
  
  with the specific instance id you are looking for.
  
  
  ---
  
  