prompt: You will be provided with a partial code base and an issue statement explaining a problem to resolve.
  <issue>
  security_groups in aws_security_group rule not supported
  **Describe the bug**
  referencing a `security_group` instead of `cidr_block` in a security group rule causes an exception
  
  **To Reproduce**
  Steps to reproduce the behavior:
  1. try to run checkov on the following resource:
  ```tf
  resource "aws_security_group" "bar-sg" {
    name        = "sg-bar"
    vpc_id      = aws_vpc.main.id
  
    ingress {
      from_port   = 22
      to_port     = 22
      protocol    = "tcp"
      security_groups = [aws_security_group.foo-sg.id]
      description = "foo"
    }
  
    egress {
      from_port       = 0
      to_port         = 0
      protocol        = "-1"
      cidr_blocks     = ["0.0.0.0/0"]
    }
  
  }
  
  ```
  result:
  ```
  Traceback (most recent call last):
    File "/path/tf-checks/bin/checkov", line 34, in <module>
      report = Runner().run(root_folder, external_checks_dir=args.external_checks_dir)
    File "/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/runner.py", line 38, in run
      results = resource_registry.scan(resource, scanned_file, skipped_checks)
    File "/pathtf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/registry.py", line 38, in scan
      resource_name=resource_name, resource_type=resource, skip_info=skip_info)
    File "/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/base_check.py", line 31, in run
      check_result['result'] = self.scan_resource_conf(resource_configuration)
    File "/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py", line 25, in scan_resource_conf
      if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[
  KeyError: 'cidr_blocks'
  ```
  
  **Expected behavior**
  such resource definition is perfectly valid
  
  
  **Desktop (please complete the following information):**
   - OS: Ubuntu `19.10`
   - Python: `3.7.5`
   - Checkov Version  `1.0.99`
  
  
  
  
  </issue>
  <code>
  [start of checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py]
  1 from checkov.terraform.models.enums import CheckResult, CheckCategories
  2 from checkov.terraform.checks.resource.base_check import BaseResourceCheck
  3 
  4 PORT = 3389
  5 
  6 
  7 class SecurityGroupUnrestrictedIngress3389(BaseResourceCheck):
  8     def __init__(self):
  9         name = "Ensure no security groups allow ingress from 0.0.0.0:0 to port %d" % PORT
  10         id = "CKV_AWS_25"
  11         supported_resources = ['aws_security_group']
  12         categories = [CheckCategories.NETWORKING]
  13         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  14 
  15     def scan_resource_conf(self, conf):
  16         """
  17             Looks for configuration at security group ingress rules :
  18             https://www.terraform.io/docs/providers/aws/r/security_group.html
  19         :param conf: aws_security_group configuration
  20         :return: <CheckResult>
  21         """
  22         if 'ingress' in conf.keys():
  23             ingress_conf = conf['ingress']
  24             for rule in ingress_conf:
  25                 if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [
  26                     ["0.0.0.0/0"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():
  27                     return CheckResult.FAILED
  28 
  29         return CheckResult.PASSED
  30 
  31 
  32 check = SecurityGroupUnrestrictedIngress3389()
  33
  [end of checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py]
  [start of checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py]
  1 from checkov.terraform.models.enums import CheckResult, CheckCategories
  2 from checkov.terraform.checks.resource.base_check import BaseResourceCheck
  3 
  4 PORT = 22
  5 
  6 
  7 class SecurityGroupUnrestrictedIngress22(BaseResourceCheck):
  8     def __init__(self):
  9         name = "Ensure no security groups allow ingress from 0.0.0.0:0 to port %d" % PORT
  10         id = "CKV_AWS_24"
  11         supported_resources = ['aws_security_group']
  12         categories = [CheckCategories.NETWORKING]
  13         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  14 
  15     def scan_resource_conf(self, conf):
  16         """
  17             Looks for configuration at security group ingress rules :
  18             https://www.terraform.io/docs/providers/aws/r/security_group.html
  19         :param conf: aws_security_group configuration
  20         :return: <CheckResult>
  21         """
  22         if 'ingress' in conf.keys():
  23             ingress_conf = conf['ingress']
  24             for rule in ingress_conf:
  25                 if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[
  26                     "0.0.0.0/0"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():
  27                     return CheckResult.FAILED
  28 
  29         return CheckResult.PASSED
  30 
  31 
  32 check = SecurityGroupUnrestrictedIngress22()
  33
  [end of checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py]
  </code>
  
  I need you to solve this issue by generating a single patch file that I can apply directly to this repository using git apply. Please respond with a single patch file in the following format.
  <patch>
  diff --git a/file.py b/file.py
  --- a/file.py
  +++ b/file.py
  @@ -1,27 +1,35 @@
   def euclidean(a, b):
  -    while b:
  -        a, b = b, a % b
  -    return a
  +    if b == 0:
  +        return a
  +    return euclidean(b, a % b)
   
   
   def bresenham(x0, y0, x1, y1):
       points = []
       dx = abs(x1 - x0)
       dy = abs(y1 - y0)
  -    sx = 1 if x0 < x1 else -1
  -    sy = 1 if y0 < y1 else -1
  -    err = dx - dy
  +    x, y = x0, y0
  +    sx = -1 if x0 > x1 else 1
  +    sy = -1 if y0 > y1 else 1
   
  -    while True:
  -        points.append((x0, y0))
  -        if x0 == x1 and y0 == y1:
  -            break
  -        e2 = 2 * err
  -        if e2 > -dy:
  -            err -= dy
  -            x0 += sx
  -        if e2 < dx:
  -            err += dx
  -            y0 += sy
  +    if dx > dy:
  +        err = dx / 2.0
  +        while x != x1:
  +            points.append((x, y))
  +            err -= dy
  +            if err < 0:
  +                y += sy
  +                err += dx
  +            x += sx
  +    else:
  +        err = dy / 2.0
  +        while y != y1:
  +            points.append((x, y))
  +            err -= dx
  +            if err < 0:
  +                x += sx
  +                err += dy
  +            y += sy
  +
  +    points.append((x, y))
       return points
  
  </patch>
golden_diff: diff --git a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py
  --- a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py
  +++ b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py
  @@ -22,9 +22,10 @@
           if 'ingress' in conf.keys():
               ingress_conf = conf['ingress']
               for rule in ingress_conf:
  -                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[
  -                    "0.0.0.0/0"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():
  -                    return CheckResult.FAILED
  +                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT]:
  +                    if 'cidr_blocks' in rule.keys():
  +                        if rule['cidr_blocks'] == [["0.0.0.0/0"]] and 'security_groups' not in rule.keys():
  +                            return CheckResult.FAILED
   
           return CheckResult.PASSED
   
  diff --git a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py
  --- a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py
  +++ b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py
  @@ -22,9 +22,11 @@
           if 'ingress' in conf.keys():
               ingress_conf = conf['ingress']
               for rule in ingress_conf:
  -                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [
  -                    ["0.0.0.0/0"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():
  -                    return CheckResult.FAILED
  +                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT]:
  +                    if 'cidr_blocks' in rule.keys():
  +                        if rule['cidr_blocks'] == [["0.0.0.0/0"]] and 'security_groups' not in rule.keys():
  +                            return CheckResult.FAILED
  +
   
           return CheckResult.PASSED
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py\n--- a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py\n+++ b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py\n@@ -22,9 +22,10 @@\n         if 'ingress' in conf.keys():\n             ingress_conf = conf['ingress']\n             for rule in ingress_conf:\n-                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[\n-                    \"0.0.0.0/0\"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():\n-                    return CheckResult.FAILED\n+                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT]:\n+                    if 'cidr_blocks' in rule.keys():\n+                        if rule['cidr_blocks'] == [[\"0.0.0.0/0\"]] and 'security_groups' not in rule.keys():\n+                            return CheckResult.FAILED\n \n         return CheckResult.PASSED\n \ndiff --git a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py\n--- a/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py\n+++ b/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py\n@@ -22,9 +22,11 @@\n         if 'ingress' in conf.keys():\n             ingress_conf = conf['ingress']\n             for rule in ingress_conf:\n-                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [\n-                    [\"0.0.0.0/0\"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():\n-                    return CheckResult.FAILED\n+                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT]:\n+                    if 'cidr_blocks' in rule.keys():\n+                        if rule['cidr_blocks'] == [[\"0.0.0.0/0\"]] and 'security_groups' not in rule.keys():\n+                            return CheckResult.FAILED\n+\n \n         return CheckResult.PASSED\n", "issue": "security_groups in aws_security_group rule not supported\n**Describe the bug**\r\nreferencing a `security_group` instead of `cidr_block` in a security group rule causes an exception\r\n\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\n1. try to run checkov on the following resource:\r\n```tf\r\nresource \"aws_security_group\" \"bar-sg\" {\r\n  name        = \"sg-bar\"\r\n  vpc_id      = aws_vpc.main.id\r\n\r\n  ingress {\r\n    from_port   = 22\r\n    to_port     = 22\r\n    protocol    = \"tcp\"\r\n    security_groups = [aws_security_group.foo-sg.id]\r\n    description = \"foo\"\r\n  }\r\n\r\n  egress {\r\n    from_port       = 0\r\n    to_port         = 0\r\n    protocol        = \"-1\"\r\n    cidr_blocks     = [\"0.0.0.0/0\"]\r\n  }\r\n\r\n}\r\n\r\n```\r\nresult:\r\n```\r\nTraceback (most recent call last):\r\n  File \"/path/tf-checks/bin/checkov\", line 34, in <module>\r\n    report = Runner().run(root_folder, external_checks_dir=args.external_checks_dir)\r\n  File \"/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/runner.py\", line 38, in run\r\n    results = resource_registry.scan(resource, scanned_file, skipped_checks)\r\n  File \"/pathtf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/registry.py\", line 38, in scan\r\n    resource_name=resource_name, resource_type=resource, skip_info=skip_info)\r\n  File \"/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/base_check.py\", line 31, in run\r\n    check_result['result'] = self.scan_resource_conf(resource_configuration)\r\n  File \"/path/tf-checks/lib/python3.7/site-packages/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py\", line 25, in scan_resource_conf\r\n    if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[\r\nKeyError: 'cidr_blocks'\r\n```\r\n\r\n**Expected behavior**\r\nsuch resource definition is perfectly valid\r\n\r\n\r\n**Desktop (please complete the following information):**\r\n - OS: Ubuntu `19.10`\r\n - Python: `3.7.5`\r\n - Checkov Version  `1.0.99`\r\n\r\n\r\n\n", "before_files": [{"content": "from checkov.terraform.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_check import BaseResourceCheck\n\nPORT = 3389\n\n\nclass SecurityGroupUnrestrictedIngress3389(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure no security groups allow ingress from 0.0.0.0:0 to port %d\" % PORT\n        id = \"CKV_AWS_25\"\n        supported_resources = ['aws_security_group']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for configuration at security group ingress rules :\n            https://www.terraform.io/docs/providers/aws/r/security_group.html\n        :param conf: aws_security_group configuration\n        :return: <CheckResult>\n        \"\"\"\n        if 'ingress' in conf.keys():\n            ingress_conf = conf['ingress']\n            for rule in ingress_conf:\n                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [\n                    [\"0.0.0.0/0\"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():\n                    return CheckResult.FAILED\n\n        return CheckResult.PASSED\n\n\ncheck = SecurityGroupUnrestrictedIngress3389()\n", "path": "checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py"}, {"content": "from checkov.terraform.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_check import BaseResourceCheck\n\nPORT = 22\n\n\nclass SecurityGroupUnrestrictedIngress22(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure no security groups allow ingress from 0.0.0.0:0 to port %d\" % PORT\n        id = \"CKV_AWS_24\"\n        supported_resources = ['aws_security_group']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for configuration at security group ingress rules :\n            https://www.terraform.io/docs/providers/aws/r/security_group.html\n        :param conf: aws_security_group configuration\n        :return: <CheckResult>\n        \"\"\"\n        if 'ingress' in conf.keys():\n            ingress_conf = conf['ingress']\n            for rule in ingress_conf:\n                if rule['from_port'] == [PORT] and rule['to_port'] == [PORT] and rule['cidr_blocks'] == [[\n                    \"0.0.0.0/0\"]] and 'self' not in rule.keys() and 'security_groups' not in rule.keys():\n                    return CheckResult.FAILED\n\n        return CheckResult.PASSED\n\n\ncheck = SecurityGroupUnrestrictedIngress22()\n", "path": "checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py"}]}