web-resource-name is mandatory. I think it can be used by third party tools, or container management tools to identify the restricted resource. You can give it any name you want.
url-pattern is also mandatory, with one or more element. Both http-method and auth-contraint or not mandatory.
(
Servlets Specification, SRV.13.4 Deployment Descriptor Diagram)