- Newest
- Most votes
- Most comments
Currently, AWS does not provide a way to add descriptions to network ACLs or their rules, unlike security groups which do have description fields. This is a notable difference between these two network security components.
Security groups allow you to set descriptions when creating them and for their rules, making them more easily identifiable later. Network ACLs, which operate at the subnet level rather than the instance level, don't have this capability.
For your use case of documenting IP addresses in network ACL rules, you might need to use alternative approaches such as:
- Using AWS tagging for the network ACL itself (though this doesn't help with individual rules)
- Maintaining external documentation that maps IP addresses to their purposes
- Using naming conventions in other resources that help identify the purpose of specific network ACL rules
This is a valid feature request that would improve the manageability of complex network configurations, especially when revisiting them after some time has passed.
Sources
In Amazon EC2, how can I set/change the "security group name" and "description" | AWS re:Post
Example: Control access to instances in a subnet - Amazon Virtual Private Cloud
Relevant content
- asked 4 years ago
- asked 3 years ago
- asked 4 years ago
