Merge pull request #7098 from Checkmarx/tf_bug_security_groups

fix(query): security groups not used query with false positive in aws_elasticache_instance resources

assets/queries/terraform/aws/security_groups_not_used/query.rego

@@ -32,6 +32,13 @@ is_used(securityGroupName, doc, resource) {
 	contains(securityGroupUsed, sprintf("aws_security_group.%s", [securityGroupName]))
 }
 
+# check security groups assigned to aws_elasticache_instance resources
+is_used(securityGroupName, doc, resource) {
+	[path, value] := walk(doc)
+	securityGroupUsed := value.security_group_ids[_]
+	contains(securityGroupUsed, sprintf("aws_security_group.%s", [securityGroupName]))
+}
+
 # check security groups assigned to aws_instance resources
 is_used(securityGroupName, doc, resource) {
 	[path, value] := walk(doc)

assets/queries/terraform/aws/security_groups_not_used/test/negative6.tf

@@ -0,0 +1,23 @@
+resource "aws_security_group" "example" {
+  name        = "example"
+  description = "Allow Redis traffic"
+  vpc_id      = data.aws_vpc.selected.id
+
+  ingress {
+
+    from_port   = 6379
+    to_port     = 6379
+    protocol    = "tcp"
+    cidr_blocks = [data.aws_vpc.selected.cidr_block]
+  }
+}
+
+resource "aws_elasticache_replication_group" "redis" {
+  replication_group_id       = "Example"
+  parameter_group_name       = "default.redis6.x"
+  engine                     = "redis"
+  engine_version             = "6.x"
+  automatic_failover_enabled = false
+
+  security_group_ids = [aws_security_group.example.id]
+}

assets/queries/terraform/aws/security_groups_not_used/test/positive5.tf

@@ -0,0 +1,22 @@
+resource "aws_security_group" "example" {
+  name        = "example"
+  description = "Allow Redis traffic"
+  vpc_id      = data.aws_vpc.selected.id
+
+  ingress {
+
+    from_port   = 6379
+    to_port     = 6379
+    protocol    = "tcp"
+    cidr_blocks = [data.aws_vpc.selected.cidr_block]
+  }
+}
+
+resource "aws_elasticache_replication_group" "redis" {
+  replication_group_id       = "Example"
+  parameter_group_name       = "default.redis6.x"
+  engine                     = "redis"
+  engine_version             = "6.x"
+  automatic_failover_enabled = false
+
+}

assets/queries/terraform/aws/security_groups_not_used/test/positive_expected_result.json

@@ -22,5 +22,11 @@
     "severity": "INFO",
     "line": 21,
     "filename": "positive4.tf"
+  },
+  {
+    "queryName": "Security Group Not Used",
+    "severity": "INFO",
+    "line": 1,
+    "filename": "positive5.tf"
   }
 ]