Is there a way to add a description for AWS Security Group rules

Question

I have now 5 different security groups which I have tried to organize the best I can.

I sometimes need to open SSH access to some instances depending on what location I am in, so I add the rules from my current IP for inbound port 22. I can get in fine but in order to keep things tidy I would like to be able to specify that this IP is from Glasgow's office, this one's from London, NY etc. but I cannot see a way of putting that little bit or extra information.

We're several guys updating a security group and after a while some are forgetting to remove the temporary rules which can become a bit messy and make things difficult when we want to clean the security group and remove those temporary rules whilst keeping the permanent ones.

I cannot see anything in the docs that would allow me to add this little description beside each rule; did I miss something?

Answer 1

The answer to this question has recently changed.

Security group rules now have a Description field

AWS Announcement (August 31st, 2017) https://aws.amazon.com/about-aws/whats-new/2017/08/simplify-management-of-security-groups-with-security-group-rule-descriptions/

Amazon EC2 now allows customers to add a short description to individual security group rules. Using this functionality, customers can add details like when and why a certain security group rule was created or updated. This functionality simplifies management of security groups as customers no longer need to track this information using spreadsheets or documents.

Answer 2

No you did not miss some thing but there is no way where you can add description to the IPs in the security group. Another way you can arrange is create one master security group to the resource and multiple security groups by name of your office and attach those to the master security groups. And you will have to maintain separate documents for the IP address.

Answer 3

While there is no description field for security groups, you can (and should) use tags to add metadata to each security group.

I suggest you create tags for each security group called description and provide a detailed description there.

Other tags that can be useful for EC2 object in general are owner, function and environment.

So for an SSH SG, you can define tags like the following:

owner=rodrigo m
function=secure ssh access
environment=production
description=Glasgow's office IP x.x.x.x London Office IP y.y.y.y
updated_on=8/9/2016

Answer 4

I'm puzzled here, because it looks like the command

aws ec2 describe-security-groups --generate-cli-skeleton

allows for filters based on tag names and values

{
    "DryRun": true, 
    "GroupNames": [
        ""
    ], 
    "GroupIds": [
        ""
    ], 
    "Filters": [
        {
            "Name": "", 
            "Values": [
                ""
            ]
        }
    ]
}

which would answer directly your question of how to apply metadata to the security group that you want, but I don't see a way in any of the aws cli commands to set that metadata.

The other approach which I've seen used with some success to simplify security groups is to use a VPN configuration that gives your users a stable IP address endpoint, so that rather than poking holes in a security group, you move the trusted endpoint to a VPN that is cryptographically secured.