Q:

How to describe all Security Group in which inbound rule's source is not "sg-12345678"

Using AWS CLI, i can list all Security Group which has inbound rule like this:
Type  Protocol   Port Range Source           Description
MYSQL   TCP          3306    sg-12345678      From App

With a command line
aws ec2 describe-security-groups --filters Name=ip-permission.group-id,Values=sg-12345678 --query "SecurityGroups[*].{Name:GroupName}"

However, my intention is to find all SG that doesn't have sg-12345678 as a source in inbound rule.
How can i achieve this?

A:

Example using --query, needs further parsing with jq or any other command line tools.
aws ec2 describe-security-groups --query "SecurityGroups[*].{name:GroupName,secid:GroupId,sourceid:IpPermissions[*].UserIdGroupPairs[?GroupId!='sg-1234567']}"

