diff --git a/builtin/providers/aws/resource_aws_security_group.go b/builtin/providers/aws/resource_aws_security_group.go
index 8a76d316f374..044d0afaaa3e 100644
--- a/builtin/providers/aws/resource_aws_security_group.go
+++ b/builtin/providers/aws/resource_aws_security_group.go
@@ -31,7 +31,8 @@ func resourceAwsSecurityGroup() *schema.Resource {
 
 			"description": &schema.Schema{
 				Type:     schema.TypeString,
-				Required: true,
+				Optional: true,
+				Default:  "Managed by Terraform",
 			},
 
 			"vpc_id": &schema.Schema{
diff --git a/builtin/providers/aws/resource_aws_security_group_test.go b/builtin/providers/aws/resource_aws_security_group_test.go
index b4ce116b9551..6d162ae79d75 100644
--- a/builtin/providers/aws/resource_aws_security_group_test.go
+++ b/builtin/providers/aws/resource_aws_security_group_test.go
@@ -197,6 +197,8 @@ func TestAccAWSSecurityGroup_generatedName(t *testing.T) {
 				Config: testAccAWSSecurityGroupConfig_generatedName,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSSecurityGroupExists("aws_security_group.web", &group),
+					resource.TestCheckResourceAttr(
+						"aws_security_group.web", "description", "Managed by Terraform"),
 					func(s *terraform.State) error {
 						if group.GroupName == nil {
 							return fmt.Errorf("bad: No SG name")
@@ -549,8 +551,6 @@ resource "aws_security_group" "foo" {
 
 const testAccAWSSecurityGroupConfig_generatedName = `
 resource "aws_security_group" "web" {
-  description = "Used in the terraform acceptance tests"
-
   ingress {
     protocol = "tcp"
     from_port = 80