We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
security_groups in aws_security_group rule not supported
**Describe the bug**
referencing a `security_group` instead of `cidr_block` in a security group rule causes an exception

**To Reproduce**
Steps to reproduce the behavior:
1. try to run checkov on the following resource:
```tf
resource "aws_security_group" "bar-sg" {
  name        = "sg-bar"
  vpc_id      = aws_vpc.main.id

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    security_groups = [aws_security_group.foo-sg.id]
    description = "foo"
  }

  egress {
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    cidr_blocks     = ["0.0.0.0/0"]
  }

}

```
result:
```
Traceback (most recent call last):
  File "/path/tf-checks/bin/checkov", line 34, in <module>
    report = Runner().run(root_folder, external_checks_dir=args.external_checks_dir)
  File "/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/runner.py", line 38, in run
    results = resource_registry.scan(resource, scanned_file, skipped_checks)
  File "/pathtf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/registry.py", line 38, in scan
    resource_name=resource_name, resource_type=resource, skip_info=skip_info)
  File "/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/base_check.py", line 31, in run
    check_result['result'] = self.scan_resource_conf(resource_configuration)
  File "/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py", line 25, in scan_resource_conf
    if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[
KeyError: 'cidr_blocks'
```

**Expected behavior**
such resource definition is perfectly valid


**Desktop (please complete the following information):**
 - OS: Ubuntu `19.10`
 - Python: `3.7.5`
 - Checkov Version  `1.0.99`




--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py`
Content:
```
1 from checkov.terraform.models.enums import CheckResult, CheckCategories
2 from checkov.terraform.checks.resource.base_check import BaseResourceCheck
3 
4 PORT = 3389
5 
6 
7 class SecurityGroupUnrestrictedIngress3389(BaseResourceCheck):
8     def __init__(self):
9         name = "Ensure no security groups allow ingress from 0.0.0.0:0 to port %d" % PORT
10         id = "CKV_AWS_25"
11         supported_resources = ['aws_security_group']
12         categories = [CheckCategories.NETWORKING]
13         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
14 
15     def scan_resource_conf(self, conf):
16         """
17             Looks for configuration at security group ingress rules :
18             https://www.terraform.io/docs/providers/aws/r/security_group.html
19         :param conf: aws_security_group configuration
20         :return: <CheckResult>
21         """
22         if 'ingress' in conf.keys():
23             ingress_conf = conf['ingress']
24             for rule in ingress_conf:
25                 if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [
26                     ["0.0.0.0/0"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():
27                     return CheckResult.FAILED
28 
29         return CheckResult.PASSED
30 
31 
32 check = SecurityGroupUnrestrictedIngress3389()
33
```

Path: `checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py`
Content:
```
1 from checkov.terraform.models.enums import CheckResult, CheckCategories
2 from checkov.terraform.checks.resource.base_check import BaseResourceCheck
3 
4 PORT = 22
5 
6 
7 class SecurityGroupUnrestrictedIngress22(BaseResourceCheck):
8     def __init__(self):
9         name = "Ensure no security groups allow ingress from 0.0.0.0:0 to port %d" % PORT
10         id = "CKV_AWS_24"
11         supported_resources = ['aws_security_group']
12         categories = [CheckCategories.NETWORKING]
13         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
14 
15     def scan_resource_conf(self, conf):
16         """
17             Looks for configuration at security group ingress rules :
18             https://www.terraform.io/docs/providers/aws/r/security_group.html
19         :param conf: aws_security_group configuration
20         :return: <CheckResult>
21         """
22         if 'ingress' in conf.keys():
23             ingress_conf = conf['ingress']
24             for rule in ingress_conf:
25                 if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[
26                     "0.0.0.0/0"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():
27                     return CheckResult.FAILED
28 
29         return CheckResult.PASSED
30 
31 
32 check = SecurityGroupUnrestrictedIngress22()
33
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py
--- a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py
+++ b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py
@@ -22,9 +22,10 @@
         if 'ingress' in conf.keys():
             ingress_conf = conf['ingress']
             for rule in ingress_conf:
-                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[
-                    "0.0.0.0/0"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():
-                    return CheckResult.FAILED
+                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT]:
+                    if 'cidr_blocks' in rule.keys():
+                        if rule['cidr_blocks'] == [["0.0.0.0/0"]] and 'security_groups' not in rule.keys():
+                            return CheckResult.FAILED
 
         return CheckResult.PASSED
 
diff --git a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py
--- a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py
+++ b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py
@@ -22,9 +22,11 @@
         if 'ingress' in conf.keys():
             ingress_conf = conf['ingress']
             for rule in ingress_conf:
-                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [
-                    ["0.0.0.0/0"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():
-                    return CheckResult.FAILED
+                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT]:
+                    if 'cidr_blocks' in rule.keys():
+                        if rule['cidr_blocks'] == [["0.0.0.0/0"]] and 'security_groups' not in rule.keys():
+                            return CheckResult.FAILED
+
 
         return CheckResult.PASSED

{"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py\n--- a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py\n+++ b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py\n@@ -22,9 +22,10 @@\n         if 'ingress' in conf.keys():\n             ingress_conf = conf['ingress']\n             for rule in ingress_conf:\n-                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[\n-                    \"0.0.0.0/0\"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():\n-                    return CheckResult.FAILED\n+                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT]:\n+                    if 'cidr_blocks' in rule.keys():\n+                        if rule['cidr_blocks'] == [[\"0.0.0.0/0\"]] and 'security_groups' not in rule.keys():\n+                            return CheckResult.FAILED\n \n         return CheckResult.PASSED\n \ndiff --git a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py\n--- a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py\n+++ b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py\n@@ -22,9 +22,11 @@\n         if 'ingress' in conf.keys():\n             ingress_conf = conf['ingress']\n             for rule in ingress_conf:\n-                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [\n-                    [\"0.0.0.0/0\"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():\n-                    return CheckResult.FAILED\n+                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT]:\n+                    if 'cidr_blocks' in rule.keys():\n+                        if rule['cidr_blocks'] == [[\"0.0.0.0/0\"]] and 'security_groups' not in rule.keys():\n+                            return CheckResult.FAILED\n+\n \n         return CheckResult.PASSED\n", "issue": "security_groups in aws_security_group rule not supported\n**Describe the bug**\r\nreferencing a `security_group` instead of `cidr_block` in a security group rule causes an exception\r\n\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\n1. try to run checkov on the following resource:\r\n```tf\r\nresource \"aws_security_group\" \"bar-sg\" {\r\n  name        = \"sg-bar\"\r\n  vpc_id      = aws_vpc.main.id\r\n\r\n  ingress {\r\n    from_port   = 22\r\n    to_port     = 22\r\n    protocol    = \"tcp\"\r\n    security_groups = [aws_security_group.foo-sg.id]\r\n    description = \"foo\"\r\n  }\r\n\r\n  egress {\r\n    from_port       = 0\r\n    to_port         = 0\r\n    protocol        = \"-1\"\r\n    cidr_blocks     = [\"0.0.0.0/0\"]\r\n  }\r\n\r\n}\r\n\r\n```\r\nresult:\r\n```\r\nTraceback (most recent call last):\r\n  File \"/path/tf-checks/bin/checkov\", line 34, in <module>\r\n    report = Runner().run(root_folder, external_checks_dir=args.external_checks_dir)\r\n  File \"/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/runner.py\", line 38, in run\r\n    results = resource_registry.scan(resource, scanned_file, skipped_checks)\r\n  File \"/pathtf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/registry.py\", line 38, in scan\r\n    resource_name=resource_name, resource_type=resource, skip_info=skip_info)\r\n  File \"/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/base_check.py\", line 31, in run\r\n    check_result['result'] = self.scan_resource_conf(resource_configuration)\r\n  File \"/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py\", line 25, in scan_resource_conf\r\n    if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[\r\nKeyError: 'cidr_blocks'\r\n```\r\n\r\n**Expected behavior**\r\nsuch resource definition is perfectly valid\r\n\r\n\r\n**Desktop (please complete the following information):**\r\n - OS: Ubuntu `19.10`\r\n - Python: `3.7.5`\r\n - Checkov Version  `1.0.99`\r\n\r\n\r\n\n", "before_files": [{"content": "from checkov.terraform.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_check import BaseResourceCheck\n\nPORT = 3389\n\n\nclass SecurityGroupUnrestrictedIngress3389(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure no security groups allow ingress from 0.0.0.0:0 to port %d\" % PORT\n        id = \"CKV_AWS_25\"\n        supported_resources = ['aws_security_group']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for configuration at security group ingress rules :\n            https://www.terraform.io/docs/providers/aws/r/security_group.html\n        :param conf: aws_security_group configuration\n        :return: <CheckResult>\n        \"\"\"\n        if 'ingress' in conf.keys():\n            ingress_conf = conf['ingress']\n            for rule in ingress_conf:\n                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [\n                    [\"0.0.0.0/0\"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():\n                    return CheckResult.FAILED\n\n        return CheckResult.PASSED\n\n\ncheck = SecurityGroupUnrestrictedIngress3389()\n", "path": "checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py"}, {"content": "from checkov.terraform.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_check import BaseResourceCheck\n\nPORT = 22\n\n\nclass SecurityGroupUnrestrictedIngress22(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure no security groups allow ingress from 0.0.0.0:0 to port %d\" % PORT\n        id = \"CKV_AWS_24\"\n        supported_resources = ['aws_security_group']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for configuration at security group ingress rules :\n            https://www.terraform.io/docs/providers/aws/r/security_group.html\n        :param conf: aws_security_group configuration\n        :return: <CheckResult>\n        \"\"\"\n        if 'ingress' in conf.keys():\n            ingress_conf = conf['ingress']\n            for rule in ingress_conf:\n                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[\n                    \"0.0.0.0/0\"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():\n                    return CheckResult.FAILED\n\n        return CheckResult.PASSED\n\n\ncheck = SecurityGroupUnrestrictedIngress22()\n", "path": "checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py"}], "after_files": [{"content": "from checkov.terraform.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_check import BaseResourceCheck\n\nPORT = 3389\n\n\nclass SecurityGroupUnrestrictedIngress3389(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure no security groups allow ingress from 0.0.0.0:0 to port %d\" % PORT\n        id = \"CKV_AWS_25\"\n        supported_resources = ['aws_security_group']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for configuration at security group ingress rules :\n            https://www.terraform.io/docs/providers/aws/r/security_group.html\n        :param conf: aws_security_group configuration\n        :return: <CheckResult>\n        \"\"\"\n        if 'ingress' in conf.keys():\n            ingress_conf = conf['ingress']\n            for rule in ingress_conf:\n                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT]:\n                    if 'cidr_blocks' in rule.keys():\n                        if rule['cidr_blocks'] == [[\"0.0.0.0/0\"]] and 'security_groups' not in rule.keys():\n                            return CheckResult.FAILED\n\n\n        return CheckResult.PASSED\n\n\ncheck = SecurityGroupUnrestrictedIngress3389()\n", "path": "checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py"}, {"content": "from checkov.terraform.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_check import BaseResourceCheck\n\nPORT = 22\n\n\nclass SecurityGroupUnrestrictedIngress22(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure no security groups allow ingress from 0.0.0.0:0 to port %d\" % PORT\n        id = \"CKV_AWS_24\"\n        supported_resources = ['aws_security_group']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for configuration at security group ingress rules :\n            https://www.terraform.io/docs/providers/aws/r/security_group.html\n        :param conf: aws_security_group configuration\n        :return: <CheckResult>\n        \"\"\"\n        if 'ingress' in conf.keys():\n            ingress_conf = conf['ingress']\n            for rule in ingress_conf:\n                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT]:\n                    if 'cidr_blocks' in rule.keys():\n                        if rule['cidr_blocks'] == [[\"0.0.0.0/0\"]] and 'security_groups' not in rule.keys():\n                            return CheckResult.FAILED\n\n        return CheckResult.PASSED\n\n\ncheck = SecurityGroupUnrestrictedIngress22()\n", "path": "checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py"}]}