Not every Security Group rule has a description misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_23
Category - Subcategory	Public Exposure - Ingress Controls
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

This rule ensures that each security group rule has a description to help identify the purpose of the rule. Descriptions improve the manageability and understanding of security group rules.

How to Fix

To mitigate this issue, ensure that the Description field is added to all security group rules in AWS::EC2::SecurityGroup, AWS::EC2::SecurityGroupIngress, and AWS::EC2::SecurityGroupEgress resources.

Example: [source,go]

{ "Resources": { "MySecurityGroup": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "My security group", "SecurityGroupIngress": [ { ...

• "Description": "Allow HTTP traffic" } ], "SecurityGroupEgress": [ { ...
• "Description": "Allow HTTPS traffic" } ] } } } }

---

Resources: MySecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: My security group SecurityGroupIngress:

• IpProtocol: tcp ...
• Description: Allow HTTP traffic SecurityGroupEgress:
• IpProtocol: tcp ...
• Description: Allow HTTPS traffic

---