Security Groups Should Have Descriptions

Using Console

To remediate the misconfiguration of security groups not having descriptions in AWS, you can follow the below steps:

Log in to the AWS Management Console.
Navigate to the EC2 service.
Click on the “Security Groups” option from the left-hand menu.
Identify the security group(s) that do not have descriptions.
Click on the checkbox next to the security group(s) to select it.
Click on the “Actions” dropdown menu and select “Edit description”.
Enter a meaningful description for the security group.
Click on the “Save” button to save the description.

Repeat the above steps for all the security groups that do not have descriptions. It is recommended to have a clear and concise description for each security group, which can help in identifying the purpose of the security group and its associated resources.

Using CLI

To remediate the misconfiguration “Security Groups Should Have Descriptions” in AWS using AWS CLI, follow these steps:

Open the AWS CLI on your local machine.
Run the following command to list all the security groups in your AWS account:

aws ec2 describe-security-groups

Identify the security group that does not have a description.
Run the following command to update the description of the security group:

aws ec2 update-security-group-rule-descriptions-ingress --group-id <security-group-id> --ip-permissions '[{"IpProtocol": "tcp", "FromPort": <port-number>, "ToPort": <port-number>, "IpRanges": [{"CidrIp": "<ip-address>/32", "Description": "<description>"}]}]'

Replace <security-group-id> with the ID of the security group that needs to be updated, <port-number> with the port number that needs to be opened, <ip-address> with the IP address that needs to be allowed, and <description> with the description of the security group.

Run the following command to verify that the description has been updated:

aws ec2 describe-security-groups --group-ids <security-group-id>

The output should show the updated description for the security group.

Repeat steps 3-5 for all the security groups that do not have descriptions.

Using Python

To remediate the misconfiguration “Security Groups Should Have Descriptions” in AWS using Python, you can follow these steps:

Import the necessary AWS SDK and libraries in your Python code.
Use the describe_security_groups method of the AWS EC2 client to retrieve a list of all security groups in your AWS account.
Loop through the list of security groups and check if each security group has a description.
If a security group does not have a description, use the update_security_group_rule_descriptions_ingress method of the AWS EC2 client to add a description to the security group.

Here is the sample Python code to remediate the misconfiguration “Security Groups Should Have Descriptions” in AWS:

import boto3

# Create an EC2 client
ec2 = boto3.client('ec2')

# Retrieve a list of all security groups in your AWS account
response = ec2.describe_security_groups()

# Loop through the list of security groups and add a description if it doesn't exist
for group in response['SecurityGroups']:
    if not group['Description']:
        group_id = group['GroupId']
        ec2.update_security_group_rule_descriptions_ingress(
            GroupId=group_id,
            IpPermissions=[
                {
                    'FromPort': 0,
                    'IpProtocol': '-1',
                    'IpRanges': [],
                    'Ipv6Ranges': [],
                    'PrefixListIds': [],
                    'ToPort': 65535,
                    'UserIdGroupPairs': []
                },
            ],
            DryRun=False
        )
        print(f"Added description to security group {group_id}")

This code will loop through all the security groups in your AWS account and add a description to any security group that does not have one.

Using Terraform

resource "aws_security_group" "EXAMPLE_SECURITY_GROUP" {
  name        = "EXAMPLE_SG_NAME"          # replace with your SG name
  description = "EXAMPLE_SECURITY_GROUP_DESCRIPTION"  # replace with a clear, operational description
  vpc_id      = aws_vpc.EXAMPLE_VPC.id     # replace with your VPC reference

  ingress {
    description = "EXAMPLE_INGRESS_RULE_DESCRIPTION"  # describe purpose of this rule
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    description = "EXAMPLE_EGRESS_RULE_DESCRIPTION"   # describe purpose of this rule
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "EXAMPLE_SG_TAG_NAME"         # optional, but recommended
  }
}

Updating description on the security group and on its rules is an in-place change and does not force replacement of the security group.Verification with terraform plan should show description being added or changed on the aws_security_group.EXAMPLE_SECURITY_GROUP resource and its ingress/egress blocks, with no -/+ replacement indicator for the resource.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Security Groups Should Have Descriptions

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: