prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  security_groups in aws_security_group rule not supported
  **Describe the bug**
  referencing a `security_group` instead of `cidr_block` in a security group rule causes an exception
  
  **To Reproduce**
  Steps to reproduce the behavior:
  1. try to run checkov on the following resource:
  ```tf
  resource "aws_security_group" "bar-sg" {
    name        = "sg-bar"
    vpc_id      = aws_vpc.main.id
  
    ingress {
      from_port   = 22
      to_port     = 22
      protocol    = "tcp"
      security_groups = [aws_security_group.foo-sg.id]
      description = "foo"
    }
  
    egress {
      from_port       = 0
      to_port         = 0
      protocol        = "-1"
      cidr_blocks     = ["0.0.0.0/0"]
    }
  
  }
  
  ```
  result:
  ```
  Traceback (most recent call last):
    File "/path/tf-checks/bin/checkov", line 34, in <module>
      report = Runner().run(root_folder, external_checks_dir=args.external_checks_dir)
    File "/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/runner.py", line 38, in run
      results = resource_registry.scan(resource, scanned_file, skipped_checks)
    File "/pathtf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/registry.py", line 38, in scan
      resource_name=resource_name, resource_type=resource, skip_info=skip_info)
    File "/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/base_check.py", line 31, in run
      check_result['result'] = self.scan_resource_conf(resource_configuration)
    File "/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py", line 25, in scan_resource_conf
      if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[
  KeyError: 'cidr_blocks'
  ```
  
  **Expected behavior**
  such resource definition is perfectly valid
  
  
  **Desktop (please complete the following information):**
   - OS: Ubuntu `19.10`
   - Python: `3.7.5`
   - Checkov Version  `1.0.99`
  
  
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py`
  Content:
  ```
  1 from checkov.terraform.models.enums import CheckResult, CheckCategories
  2 from checkov.terraform.checks.resource.base_check import BaseResourceCheck
  3 
  4 PORT = 3389
  5 
  6 
  7 class SecurityGroupUnrestrictedIngress3389(BaseResourceCheck):
  8     def __init__(self):
  9         name = "Ensure no security groups allow ingress from 0.0.0.0:0 to port %d" % PORT
  10         id = "CKV_AWS_25"
  11         supported_resources = ['aws_security_group']
  12         categories = [CheckCategories.NETWORKING]
  13         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  14 
  15     def scan_resource_conf(self, conf):
  16         """
  17             Looks for configuration at security group ingress rules :
  18             https://www.terraform.io/docs/providers/aws/r/security_group.html
  19         :param conf: aws_security_group configuration
  20         :return: <CheckResult>
  21         """
  22         if 'ingress' in conf.keys():
  23             ingress_conf = conf['ingress']
  24             for rule in ingress_conf:
  25                 if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [
  26                     ["0.0.0.0/0"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():
  27                     return CheckResult.FAILED
  28 
  29         return CheckResult.PASSED
  30 
  31 
  32 check = SecurityGroupUnrestrictedIngress3389()
  33
  ```
  
  Path: `checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py`
  Content:
  ```
  1 from checkov.terraform.models.enums import CheckResult, CheckCategories
  2 from checkov.terraform.checks.resource.base_check import BaseResourceCheck
  3 
  4 PORT = 22
  5 
  6 
  7 class SecurityGroupUnrestrictedIngress22(BaseResourceCheck):
  8     def __init__(self):
  9         name = "Ensure no security groups allow ingress from 0.0.0.0:0 to port %d" % PORT
  10         id = "CKV_AWS_24"
  11         supported_resources = ['aws_security_group']
  12         categories = [CheckCategories.NETWORKING]
  13         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  14 
  15     def scan_resource_conf(self, conf):
  16         """
  17             Looks for configuration at security group ingress rules :
  18             https://www.terraform.io/docs/providers/aws/r/security_group.html
  19         :param conf: aws_security_group configuration
  20         :return: <CheckResult>
  21         """
  22         if 'ingress' in conf.keys():
  23             ingress_conf = conf['ingress']
  24             for rule in ingress_conf:
  25                 if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[
  26                     "0.0.0.0/0"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():
  27                     return CheckResult.FAILED
  28 
  29         return CheckResult.PASSED
  30 
  31 
  32 check = SecurityGroupUnrestrictedIngress22()
  33
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py
  --- a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py
  +++ b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py
  @@ -22,9 +22,10 @@
           if 'ingress' in conf.keys():
               ingress_conf = conf['ingress']
               for rule in ingress_conf:
  -                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[
  -                    "0.0.0.0/0"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():
  -                    return CheckResult.FAILED
  +                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT]:
  +                    if 'cidr_blocks' in rule.keys():
  +                        if rule['cidr_blocks'] == [["0.0.0.0/0"]] and 'security_groups' not in rule.keys():
  +                            return CheckResult.FAILED
   
           return CheckResult.PASSED
   
  diff --git a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py
  --- a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py
  +++ b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py
  @@ -22,9 +22,11 @@
           if 'ingress' in conf.keys():
               ingress_conf = conf['ingress']
               for rule in ingress_conf:
  -                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [
  -                    ["0.0.0.0/0"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():
  -                    return CheckResult.FAILED
  +                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT]:
  +                    if 'cidr_blocks' in rule.keys():
  +                        if rule['cidr_blocks'] == [["0.0.0.0/0"]] and 'security_groups' not in rule.keys():
  +                            return CheckResult.FAILED
  +
   
           return CheckResult.PASSED
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py\n--- a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py\n+++ b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py\n@@ -22,9 +22,10 @@\n         if 'ingress' in conf.keys():\n             ingress_conf = conf['ingress']\n             for rule in ingress_conf:\n-                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[\n-                    \"0.0.0.0/0\"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():\n-                    return CheckResult.FAILED\n+                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT]:\n+                    if 'cidr_blocks' in rule.keys():\n+                        if rule['cidr_blocks'] == [[\"0.0.0.0/0\"]] and 'security_groups' not in rule.keys():\n+                            return CheckResult.FAILED\n \n         return CheckResult.PASSED\n \ndiff --git a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py\n--- a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py\n+++ b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py\n@@ -22,9 +22,11 @@\n         if 'ingress' in conf.keys():\n             ingress_conf = conf['ingress']\n             for rule in ingress_conf:\n-                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [\n-                    [\"0.0.0.0/0\"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():\n-                    return CheckResult.FAILED\n+                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT]:\n+                    if 'cidr_blocks' in rule.keys():\n+                        if rule['cidr_blocks'] == [[\"0.0.0.0/0\"]] and 'security_groups' not in rule.keys():\n+                            return CheckResult.FAILED\n+\n \n         return CheckResult.PASSED\n", "issue": "security_groups in aws_security_group rule not supported\n**Describe the bug**\r\nreferencing a `security_group` instead of `cidr_block` in a security group rule causes an exception\r\n\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\n1. try to run checkov on the following resource:\r\n```tf\r\nresource \"aws_security_group\" \"bar-sg\" {\r\n  name        = \"sg-bar\"\r\n  vpc_id      = aws_vpc.main.id\r\n\r\n  ingress {\r\n    from_port   = 22\r\n    to_port     = 22\r\n    protocol    = \"tcp\"\r\n    security_groups = [aws_security_group.foo-sg.id]\r\n    description = \"foo\"\r\n  }\r\n\r\n  egress {\r\n    from_port       = 0\r\n    to_port         = 0\r\n    protocol        = \"-1\"\r\n    cidr_blocks     = [\"0.0.0.0/0\"]\r\n  }\r\n\r\n}\r\n\r\n```\r\nresult:\r\n```\r\nTraceback (most recent call last):\r\n  File \"/path/tf-checks/bin/checkov\", line 34, in <module>\r\n    report = Runner().run(root_folder, external_checks_dir=args.external_checks_dir)\r\n  File \"/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/runner.py\", line 38, in run\r\n    results = resource_registry.scan(resource, scanned_file, skipped_checks)\r\n  File \"/pathtf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/registry.py\", line 38, in scan\r\n    resource_name=resource_name, resource_type=resource, skip_info=skip_info)\r\n  File \"/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/base_check.py\", line 31, in run\r\n    check_result['result'] = self.scan_resource_conf(resource_configuration)\r\n  File \"/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py\", line 25, in scan_resource_conf\r\n    if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[\r\nKeyError: 'cidr_blocks'\r\n```\r\n\r\n**Expected behavior**\r\nsuch resource definition is perfectly valid\r\n\r\n\r\n**Desktop (please complete the following information):**\r\n - OS: Ubuntu `19.10`\r\n - Python: `3.7.5`\r\n - Checkov Version  `1.0.99`\r\n\r\n\r\n\n", "before_files": [{"content": "from checkov.terraform.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_check import BaseResourceCheck\n\nPORT = 3389\n\n\nclass SecurityGroupUnrestrictedIngress3389(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure no security groups allow ingress from 0.0.0.0:0 to port %d\" % PORT\n        id = \"CKV_AWS_25\"\n        supported_resources = ['aws_security_group']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for configuration at security group ingress rules :\n            https://www.terraform.io/docs/providers/aws/r/security_group.html\n        :param conf: aws_security_group configuration\n        :return: <CheckResult>\n        \"\"\"\n        if 'ingress' in conf.keys():\n            ingress_conf = conf['ingress']\n            for rule in ingress_conf:\n                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [\n                    [\"0.0.0.0/0\"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():\n                    return CheckResult.FAILED\n\n        return CheckResult.PASSED\n\n\ncheck = SecurityGroupUnrestrictedIngress3389()\n", "path": "checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py"}, {"content": "from checkov.terraform.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_check import BaseResourceCheck\n\nPORT = 22\n\n\nclass SecurityGroupUnrestrictedIngress22(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure no security groups allow ingress from 0.0.0.0:0 to port %d\" % PORT\n        id = \"CKV_AWS_24\"\n        supported_resources = ['aws_security_group']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for configuration at security group ingress rules :\n            https://www.terraform.io/docs/providers/aws/r/security_group.html\n        :param conf: aws_security_group configuration\n        :return: <CheckResult>\n        \"\"\"\n        if 'ingress' in conf.keys():\n            ingress_conf = conf['ingress']\n            for rule in ingress_conf:\n                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[\n                    \"0.0.0.0/0\"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():\n                    return CheckResult.FAILED\n\n        return CheckResult.PASSED\n\n\ncheck = SecurityGroupUnrestrictedIngress22()\n", "path": "checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py"}], "after_files": [{"content": "from checkov.terraform.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_check import BaseResourceCheck\n\nPORT = 3389\n\n\nclass SecurityGroupUnrestrictedIngress3389(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure no security groups allow ingress from 0.0.0.0:0 to port %d\" % PORT\n        id = \"CKV_AWS_25\"\n        supported_resources = ['aws_security_group']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for configuration at security group ingress rules :\n            https://www.terraform.io/docs/providers/aws/r/security_group.html\n        :param conf: aws_security_group configuration\n        :return: <CheckResult>\n        \"\"\"\n        if 'ingress' in conf.keys():\n            ingress_conf = conf['ingress']\n            for rule in ingress_conf:\n                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT]:\n                    if 'cidr_blocks' in rule.keys():\n                        if rule['cidr_blocks'] == [[\"0.0.0.0/0\"]] and 'security_groups' not in rule.keys():\n                            return CheckResult.FAILED\n\n\n        return CheckResult.PASSED\n\n\ncheck = SecurityGroupUnrestrictedIngress3389()\n", "path": "checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py"}, {"content": "from checkov.terraform.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_check import BaseResourceCheck\n\nPORT = 22\n\n\nclass SecurityGroupUnrestrictedIngress22(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure no security groups allow ingress from 0.0.0.0:0 to port %d\" % PORT\n        id = \"CKV_AWS_24\"\n        supported_resources = ['aws_security_group']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for configuration at security group ingress rules :\n            https://www.terraform.io/docs/providers/aws/r/security_group.html\n        :param conf: aws_security_group configuration\n        :return: <CheckResult>\n        \"\"\"\n        if 'ingress' in conf.keys():\n            ingress_conf = conf['ingress']\n            for rule in ingress_conf:\n                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT]:\n                    if 'cidr_blocks' in rule.keys():\n                        if rule['cidr_blocks'] == [[\"0.0.0.0/0\"]] and 'security_groups' not in rule.keys():\n                            return CheckResult.FAILED\n\n        return CheckResult.PASSED\n\n\ncheck = SecurityGroupUnrestrictedIngress22()\n", "path": "checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py"}]}