Skip to content

add-description-to-security-group

Default Severity: low

Explanation

Security groups should include a description for auditing purposes.

Simplifies auditing, debugging, and managing security groups.

Possible Impact

Descriptions provide context for the firewall rule reasons

Suggested Resolution

Add descriptions for all security groups

Insecure Example

The following example will fail the aws-vpc-add-description-to-security-group check. 

 resource "aws_security_group" "bad_example" {
   name        = "http"
   description = ""

   ingress {
     description = "HTTP from VPC"
     from_port   = 80
     to_port     = 80
     protocol    = "tcp"
     cidr_blocks = [aws_vpc.main.cidr_block]
   }
 }

Secure Example

The following example will pass the aws-vpc-add-description-to-security-group check. 

 resource "aws_security_group" "good_example" {
   name        = "http"
   description = "Allow inbound HTTP traffic"

   ingress {
     description = "HTTP from VPC"
     from_port   = 80
     to_port     = 80
     protocol    = "tcp"
     cidr_blocks = [aws_vpc.main.cidr_block]
   }
 }