What’s in a Name? – AWS Security Group Naming Conventions

Trying to come up with a unique name on the spot leads to a jumbled mess as each developer uses a different naming pattern.

Thankfully, we aren’t alone in this naming challenge. The need for good naming schemes has been around for a long time. There are even whole fields of study dedicated to naming things. The solution is to define consistent, logical nomenclature that packs valuable information into the semantics of the name.

Significant Part Numbering System

Manufacturing engineers refer to this as a significant part numbering system.

From Wikipedia:

In a significant part numbering system, the part numbers are assigned intelligently, according to an encoding system, and thus they give an indication of salient characteristics of the component. For example, a screw may have the part number “HSC0424PP”; in this case, the letters indicate characteristics of the component:

• H = “Hardware”
• S = “Machine Screw”
• C0424 = “4-40, 3/4″ long”
• PP = “Panhead Phillips”

Setting Conventions

To save time, reduce mistakes, and increase security, a security group naming convention needs to do a few things.

Be consistent across your organization.

Once trained, anyone at the organization coming across the name should know what it does.

Be easily identifiable

The name should be simple enough that developers don’t need reference material to understand.

Provide enough information to be useful

Reduce misconfigurations due to misunderstanding of a group’s purpose. For example, a wrongly assigned security group could stop an asset from working correctly or provide overly permissive access creating a security risk.

Advantages

Using a significant security group numbering system provides several advantages.

1. Consistency
2. Good Governance
3. Organized groups
4. No collisions
5. Easier ownership

Examples

Let’s look at how others tackled their naming conventions. Organizations use various naming strategies for security groups. Below is an example strategy shared by the co-founder of Invisibl Cloud.

Below is another example of a naming convention that is somewhat descriptive, revealing information about the type of application and its streaming methodology.

An organization should consider what is important to them and then define code for applications that are well understood internally. When using an application code, the organization must have a written naming strategy that defines the mappings. Such as Blog = A001, and Gaming Application = A002. Avoid getting too complicated, or the process can become unwieldy.

Once defined, the next step is to automate and audit the use of the naming convention.

Automation

Automating the creation of security groups reduces errors and increases consistency. For example, teams can use Infrastructure-as-Code, like a CloudFormation template or a free, open-source Terraform script, to define their security groups. These templates or scripts create security groups the same way every time.

Auditing

Naming governance is only helpful if followed. Naming convention audits should regularly occur. After an organization adopts a naming convention, the first audit takes a disproportionate amount of time since nothing will be compliant. A free, open-source tool like Paladin Cloud can significantly speed up conducting audits by inventorying and monitoring your security groups.

In addition to existing malformed security group names, we have found that it is common for large organizations to discover thousands of unused security groups sitting around the first time they do an audit.

Notifying everyone and then removing those manually in AWS can be time-consuming. Using Paladin Cloud’s auto-fix, developers can get a list of all their unused security groups and automatically remediate them. The administrator defines a grace period for unused security group violations, often 48 hours after being unused for 90 days. After that, Paladin Cloud will notify the owners of security groups violating the unused security group policy. Then the system will automatically remove unused security groups if that group hasn’t been deleted or used by the end of the auto-fix grace period.

Paladin Cloud provides quick clean-up of current unused security groups and continuously monitors for security groups that are no longer in use.

Conclusion

The names we choose have a very real impact on the security of our cloud environment. Using a well-thought-out nomenclature for security groups makes identification more manageable and removes avenues for bad actors to exploit. Once an organization’s security group nomenclature has been defined and is part of the governance process, the implementation should be automated. After that, regular audits should be done to catch groups that may slip through the cracks. Using a tool like Paladin Cloud to assist in automating audits allows for real-time reporting on your security group policy violations.

 

For a deeper dive into this topic: AWS Security Group Naming Conventions.