Skip to content

add-description-for-security-group

Explanation

Security groups and security group rules should include a description for auditing purposes.

Simplifies auditing, debugging, and managing security groups.

Possible Impact

Descriptions provide context for the firewall rule reasons

Suggested Resolution

Add descriptions for all security groups and rules

Insecure Example

The following example will fail the AVD-AWS-0049 check.

---
Resources:
  BadExampleCacheGroup:
    Type: AWS::ElastiCache::SecurityGroup
    Properties:
      Tags:
      - Name: BadExample
  BadExampleEc2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: BadExample
      GroupDescription: Bad Elasticache Security Group
  BadSecurityGroupIngress:
    Type: AWS::ElastiCache::SecurityGroupIngress
    Properties: 
      CacheSecurityGroupName: BadExampleCacheGroup
      EC2SecurityGroupName: BadExampleEc2SecurityGroup

Secure Example

The following example will pass the AVD-AWS-0049 check.

---
Resources:
  GoodExampleCacheGroup:
    Type: AWS::ElastiCache::SecurityGroup
    Properties:
      Description: Some description
  GoodExampleEc2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: GoodExample
      GroupDescription: Good Elasticache Security Group
  GoodSecurityGroupIngress:
    Type: AWS::ElastiCache::SecurityGroupIngress
    Properties: 
      CacheSecurityGroupName: GoodExampleCacheGroup
      EC2SecurityGroupName: GoodExampleEc2SecurityGroup