What is mean FromPort is 0 and ToPort is 0 in Security Groups IpPermission/IpPermissionEgress

In AWS Security Groups, when you see FromPort and ToPort both as 0, this usually represents a rule for the "All traffic" rule which means all port ranges (0 - 65535) are allowed, which is why it's expressed as 0 to 0.

However, you need to be careful here. The protocol for this rule is also important. The "All traffic" rule typically allows all protocols, including TCP, UDP, and ICMP, and would usually be represented as -1 (not 0). In the case of FromPort and ToPort being 0, if the protocol is TCP or UDP, it usually means that the rule is specifically for that protocol on port 0, not for all ports or protocols.

As for your second question, checking if all ports are allowed to access the VPC, you need to parse the response from EC2.Client.describe_security_groups(). You will want to check each security group's IpPermissions and IpPermissionsEgress entries. If you find an entry in IpPermissions (for inbound rules) or IpPermissionsEgress (for outbound rules) where the 'FromPort' is -1, 'ToPort' is -1, and 'IpProtocol' is -1, this means all ports and all protocols are allowed.

Here's a rough pseudocode example of what you might do:

response = ec2.describe_security_groups(GroupIds=['sg-0123456789abcdef0'])
for group in response['SecurityGroups']:
    for permission in group['IpPermissions']:
        if permission['IpProtocol'] == '-1':
            print("All inbound ports are open for security group: ", group['GroupId'])
    for permission in group['IpPermissionsEgress']:
        if permission['IpProtocol'] == '-1':
            print("All outbound ports are open for security group: ", group['GroupId'])

Please replace 'sg-0123456789abcdef0' with your own Security Group ID. In this code, if a security group has all ports open, it will print a message to that effect.