diff --git a/fedora-atomic.ks b/fedora-atomic.ks
index 26e5353..e9c5848 100644
--- a/fedora-atomic.ks
+++ b/fedora-atomic.ks
@@ -25,6 +25,8 @@ auth --useshadow --passalgo=sha512
 selinux --enforcing
 rootpw --lock --iscrypted locked
 
+# Explicitly disable firewall since cloud providers generally provide
+# higher level firewall constructs (i.e. security groups).
 firewall --disabled
 
 # console=ttyAMA0 and console=hvc0 as kernel boot parameter to see