diff --git a/pkg/util/aws/disk.go b/pkg/util/aws/disk.go
index 2f00c82a54..3110092fae 100644
--- a/pkg/util/aws/disk.go
+++ b/pkg/util/aws/disk.go
@@ -100,15 +100,19 @@ func (self *SDisk) IsEmulated() bool {
 }
 
 func (self *SDisk) GetMetadata() *jsonutils.JSONDict {
-	panic("implement me")
+	data := jsonutils.NewDict()
+	data.Add(jsonutils.NewString(models.HYPERVISOR_AWS), "hypervisor")
+
+	return data
 }
 
 func (self *SDisk) GetBillingType() string {
-	panic("implement me")
+	// todo: implement me
+	return models.BILLING_TYPE_PREPAID
 }
 
 func (self *SDisk) GetExpiredAt() time.Time {
-	panic("implement me")
+	return self.ExpiredTime
 }
 
 func (self *SDisk) GetIStorge() cloudprovider.ICloudStorage {
@@ -269,8 +273,8 @@ func (self *SRegion) GetDisks(instanceId string, zoneId string, storageType stri
 			disk.DeleteWithInstance = *item.Attachments[0].DeleteOnTermination
 			disk.AttachedTime = *item.Attachments[0].AttachTime
 			disk.AttachmentStatus = *item.Attachments[0].State
-			disk.Device = *item.Attachments[0].Device
-			disk.InstanceId = *item.Attachments[0].InstanceId
+			disk.Device = StrVal(item.Attachments[0].Device)
+			disk.InstanceId = StrVal(item.Attachments[0].InstanceId)
 			// todo: 需要通过describe-instances 的root device 判断是否是系统盘
 			if len(disk.InstanceId) > 0 {
 				instance, err := self.GetInstance(disk.InstanceId)
diff --git a/pkg/util/aws/instance.go b/pkg/util/aws/instance.go
index a52a4e14c5..f002648e98 100644
--- a/pkg/util/aws/instance.go
+++ b/pkg/util/aws/instance.go
@@ -363,7 +363,9 @@ func (self *SRegion) GetInstances(zoneId string, ids []string, offset int, limit
 		params = params.SetInstanceIds(ConvertedList(ids))
 	}
 
-	params = params.SetFilters(filters)
+	if len(filters) > 0 {
+		params = params.SetFilters(filters)
+	}
 	res, err := self.ec2Client.DescribeInstances(params)
 	if err != nil {
 		log.Errorf("GetInstances fail %s", err)
diff --git a/pkg/util/aws/securitygroup.go b/pkg/util/aws/securitygroup.go
index 592543d1d4..4cd5032408 100644
--- a/pkg/util/aws/securitygroup.go
+++ b/pkg/util/aws/securitygroup.go
@@ -144,7 +144,7 @@ func (self *SRegion) syncSecgroupRules(secgroupId string, rules []secrules.Secur
 func (self *SRegion) getSecRules(ingress []*ec2.IpPermission, egress []*ec2.IpPermission) ([]secrules.SecurityRule) {
 	rules := []secrules.SecurityRule{}
 	for _, p := range ingress {
-		ret, err := AwsIpPermissionToYunion(secrules.SecurityRuleIngress, p)
+		ret, err := AwsIpPermissionToYunion(secrules.SecurityRuleIngress, *p)
 		if err != nil {
 			log.Debugf(err.Error())
 		}
@@ -155,7 +155,7 @@ func (self *SRegion) getSecRules(ingress []*ec2.IpPermission, egress []*ec2.IpPe
 	}
 
 	for _, p := range egress {
-		ret, err := AwsIpPermissionToYunion(secrules.SecurityRuleEgress, p)
+		ret, err := AwsIpPermissionToYunion(secrules.SecurityRuleEgress, *p)
 		if err != nil {
 			log.Debugf(err.Error())
 		}
@@ -193,7 +193,6 @@ func (self *SRegion) GetSecurityGroups(vpcId string, offset int, limit int) ([]S
 		}
 
 		permissions := self.getSecRules(item.IpPermissions, item.IpPermissionsEgress)
-
 		group := SSecurityGroup{
 			vpc:               vpc,
 			Description:       *item.Description,
diff --git a/pkg/util/aws/snapshot.go b/pkg/util/aws/snapshot.go
index e9c5364004..006eae0139 100644
--- a/pkg/util/aws/snapshot.go
+++ b/pkg/util/aws/snapshot.go
@@ -98,7 +98,8 @@ func (self *SRegion) GetSnapshots(instanceId string, diskId string, snapshotName
 	// if len(instanceId) > o {
 	// 	filters = AppendSingleValueFilter(filters, )
 	// }
-
+	// owner by self
+	// filters = AppendSingleValueFilter(filters, "owner-id", self)
 	if len(diskId) > 0 {
 		filters = AppendSingleValueFilter(filters, "volume-id", diskId)
 	}
diff --git a/pkg/util/aws/utils.go b/pkg/util/aws/utils.go
index df8963bc0f..d7c4b416af 100644
--- a/pkg/util/aws/utils.go
+++ b/pkg/util/aws/utils.go
@@ -34,9 +34,11 @@ func AppendSingleValueFilter(filters []*ec2.Filter, name string, value string) (
 }
 
 func ConvertedList(list []string) ([]*string) {
-	result := make([]*string, len(list))
+	result := make([]*string, 0)
 	for _, item := range list {
-		result = append(result, &item)
+		if len(item) > 0 {
+			result = append(result, &item)
+		}
 	}
 
 	return result
@@ -61,7 +63,19 @@ func StrVal(s *string) string {
 	return ""
 }
 
+func IntVal(s *int64) int64 {
+	if s != nil {
+		return *s
+	}
+
+	return 0
+}
+
 func isAwsPermissionAllPorts(p ec2.IpPermission) bool {
+	if p.FromPort == nil || p.ToPort == nil {
+		return false
+	}
+
 	//  全部端口范围： TCP/UDP （0，65535）    其他：（-1，-1）
 	if (*p.IpProtocol == "tcp" || *p.IpProtocol == "udp") && *p.FromPort == 0 && *p.ToPort == 65535 {
 		return true
@@ -73,7 +87,7 @@ func isAwsPermissionAllPorts(p ec2.IpPermission) bool {
 }
 
 func awsProtocolToYunion(p ec2.IpPermission) string {
-	if *p.IpProtocol == "-1" {
+	if p.IpProtocol != nil && *p.IpProtocol == "-1" {
 		return secrules.PROTO_ANY
 	} else {
 		return *p.IpProtocol
@@ -173,11 +187,17 @@ func AwsIpPermissionToYunion(direction secrules.TSecurityRuleDirection,p ec2.IpP
 				IPNet:       &net.IPNet{net.IP(ipNet[0]), net.IPMask(ipNet[1])},
 				Protocol:    protocol,
 				Direction:   direction,
-				PortStart:   int(*p.FromPort),
-				PortEnd:     int(*p.ToPort),
 				Priority:    1,
 				Description: StrVal(ip.Description),
 			}
+
+			if p.FromPort != nil {
+				rule.PortStart = int(*p.FromPort)
+			}
+
+			if p.ToPort != nil {
+				rule.PortStart = int(*p.ToPort)
+			}
 		}
 
 		rules = append(rules, rule)
diff --git a/pkg/util/aws/vpc.go b/pkg/util/aws/vpc.go
index 48debaa329..50c87492d6 100644
--- a/pkg/util/aws/vpc.go
+++ b/pkg/util/aws/vpc.go
@@ -208,6 +208,16 @@ func (self *SVpc) assignSecurityGroup(secgroupId string, instanceId string) erro
 }
 
 func (self *SVpc) fetchSecurityGroups() error {
+	secgroups, _, err := self.region.GetSecurityGroups(self.VpcId,0,0)
+	if err != nil {
+		return err
+	}
+
+	self.secgroups = make([]cloudprovider.ICloudSecurityGroup, len(secgroups))
+	for i := 0; i < len(secgroups); i++ {
+		secgroups[i].vpc = self
+		self.secgroups[i] = &secgroups[i]
+	}
 	return nil
 }
 
@@ -244,13 +254,12 @@ func (self *SRegion) GetVpcs(vpcId []string, offset int, limit int) ([]SVpc, int
 	if len(vpcId) > 0 {
 		params.SetVpcIds(ConvertedList(vpcId))
 	}
-
 	ret, err := self.ec2Client.DescribeVpcs(params)
 	if err != nil {
 		return nil, 0, err
 	}
 
-	vpcs := make([]SVpc, len(ret.Vpcs))
+	vpcs := []SVpc{}
 	for _, item := range ret.Vpcs {
 		vpcs = append(vpcs, SVpc{
 			region:    self,