Project: KICS (Provisioning / Security & Compliance)
File: 68eb4bf3-f9bf-463d-b5cf-e029bb446d2e.md

title: Security Group Rule Without Description hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 68eb4bf3-f9bf-463d-b5cf-e029bb446d2e Query name: Security Group Rule Without Description Platform: Terraform Severity: <span style="color:#5bc0de">Info</span> Category: Best Practices URL: It's considered a best practice for all rules in AWS Security Group to have a description<br> ```tf title="Positive test num. 1 - tf file" hl_lines="6 14" resource "awssecuritygroup" "allow_tls" { name = "allow_tls" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { from_port = 443 to_port = 443 protocol = "tcp" cidrblocks = [awsvpc.main.cidr_block] ipv6cidrblocks = [awsvpc.main.ipv6cidr_block] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] ipv6cidrblocks = ["::/0"] } tags = { Name = "allow_tls" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="15" resource "awssecuritygroup" "positive2" { name = "${var.prefix}-external-http-https" description = "Allow main HTTP / HTTPS" vpcid = local.vpcid ingress { description = "Enable HTTP access for select VMs" from_port = 80 to_port = 80 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } ingress { from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } tags = { Name = "${var.prefix}-external-http-https" } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="23" resource "awssecuritygroup" "positive3" { name = "${var.prefix}-external-http-https" description = "Allow main HTTP / HTTPS" vpcid = local.vpcid tags = { Name = "${var.prefix}-external-http-https" } } resource "awssecuritygroup_rule" "positive3a" { description = "Enable HTTP access for select VMs" from_port = 80 to_port = 80 cidr_blocks = ["0.0.0.0/0"] protocol = "tcp" securitygroupid = awssecuritygroup.positive3.id type = "ingress" } resource "awssecuritygroup_rule" "positive3b" { from_port = 443 to_port = 443 cidr_blocks = ["0.0.0.0/0"] protocol = "tcp" securitygroupid = awssecuritygroup.positive3.id type = "ingress" } ``` ```tf title="Negative test num. 1 - tf file" resource "awssecuritygroup" "allow_tls" { name = "allow_tls" description = "Allow TLS inbound traffic" vpcid = awsvpc.main.id ingress { description = "TLS from VPC" from_port = 443 to_port = 443 protocol = "tcp" cidrblocks = [awsvpc.main.cidr_block] ipv6cidrblocks = [awsvpc.main.ipv6cidr_block] } tags = { Name = "allow_tls" } } ``` ```tf title="Negative test num. 2 - tf file" resource "awssecuritygroup" "negative2" { name = "${var.prefix}-external-http-https" description = "Allow main HTTP / HTTPS" vpcid = local.vpcid ingress { description = "Enable HTTP access for select VMs" from_port = 80 to_port = 80 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } ingress { description = "Enable HTTPS access for select VMs" from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } tags = { Name = "${var.prefix}-external-http-https" } } ``` ```tf title="Negative test num. 3 - tf file" resource "awssecuritygroup" "negative3" { name = "${var.prefix}-external-http-https" description = "Allow main HTTP / HTTPS" vpcid = local.vpcid tags = { Name = "${var.prefix}-external-http-https" } } resource "awssecuritygroup_rule" "negative3a" { from_port = 80 to_port = 80 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] securitygroupid = awssecuritygroup.negative3.id type = "ingress" description = "Enable HTTP access for select VMs" } resource "awssecuritygroup_rule" "negative3b" { from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] securitygroupid = awssecuritygroup.negative3.id type = "ingress" description = "Enable HTTPS access for select VMs" } ```