Query: vpc_security_unrestricted_egress_count

with egress_sg as (
  select
    group_id,
    count(*)
  from
    aws_vpc_security_group_rule
  where
    ( cidr_ipv4 = '0.0.0.0/0' or cidr_ipv6 = '::/0')
    and ip_protocol <> 'icmp'
    and (
    from_port = -1
    or (from_port = 0 and to_port = 65535)
    )
    and is_egress
  group by group_id
)
select
  'Unrestricted Egress (Excludes ICMP)' as label,
  count(*) as value,
  case
    when count(*) = 0 then 'ok'
    else 'alert'
  end as type
from
  aws_vpc_security_group as sg
  where sg.group_id in (select group_id from egress_sg )