The element is required in a because it defines which resources (URL patterns) are being protected. The other elements ( goes in , goes in , is a separate top-level element, goes in ) serve different purposes or are in different sections of the deployment descriptor.