diff --git a/checkov/terraform/checks/graph_checks/aws/VPCHasRestrictedSG.yaml b/checkov/terraform/checks/graph_checks/aws/VPCHasRestrictedSG.yaml index e121a9f3ae0..31a90903ef8 100644 --- a/checkov/terraform/checks/graph_checks/aws/VPCHasRestrictedSG.yaml +++ b/checkov/terraform/checks/graph_checks/aws/VPCHasRestrictedSG.yaml @@ -60,4 +60,16 @@ definition: - "aws_default_security_group" connected_resource_types: - "aws_security_group_rule" + operator: "not_exists" + - cond_type: "connection" + resource_types: + - "aws_default_security_group" + connected_resource_types: + - "aws_vpc_security_group_egress_rule" + operator: "not_exists" + - cond_type: "connection" + resource_types: + - "aws_default_security_group" + connected_resource_types: + - "aws_vpc_security_group_ingress_rule" operator: "not_exists" \ No newline at end of file diff --git a/tests/terraform/graph/checks/resources/VPCHasRestrictedSG/expected.yaml b/tests/terraform/graph/checks/resources/VPCHasRestrictedSG/expected.yaml index 528f4c5ad0a..fa0fa5a7fa1 100644 --- a/tests/terraform/graph/checks/resources/VPCHasRestrictedSG/expected.yaml +++ b/tests/terraform/graph/checks/resources/VPCHasRestrictedSG/expected.yaml @@ -4,3 +4,5 @@ fail: - "aws_vpc.not_ok_vpc" - "aws_vpc.not_ok_vpc_2" - "aws_vpc.not_ok_vpc_3" + - "aws_vpc.not_ok_vpc_4" + - "aws_vpc.not_ok_vpc_5" diff --git a/tests/terraform/graph/checks/resources/VPCHasRestrictedSG/main.tf b/tests/terraform/graph/checks/resources/VPCHasRestrictedSG/main.tf index fb988dd83a5..5e5cbb22339 100644 --- a/tests/terraform/graph/checks/resources/VPCHasRestrictedSG/main.tf +++ b/tests/terraform/graph/checks/resources/VPCHasRestrictedSG/main.tf @@ -47,3 +47,38 @@ resource "aws_security_group_rule" "default_sg_rule" { type = "-1" security_group_id = aws_default_security_group.default_3.id } + +resource "aws_vpc_security_group_ingress_rule" "pike" { + security_group_id = aws_default_security_group.default_4.id + + cidr_ipv4 = "10.0.0.0/8" + from_port = 80 + ip_protocol = "tcp" + to_port = 8080 +} + + +resource "aws_vpc_security_group_egress_rule" "pike" { + security_group_id = aws_default_security_group.default_5.id + + cidr_ipv4 = "10.0.0.0/8" + from_port = 80 + ip_protocol = "tcp" + to_port = 8080 +} + +resource "aws_vpc" "not_ok_vpc_4" { + cidr_block = "10.0.0.0/16" +} + +resource "aws_vpc" "not_ok_vpc_5" { + cidr_block = "10.0.0.0/16" +} + +resource "aws_default_security_group" "default_4" { + vpc_id = aws_vpc.not_ok_vpc_4.id +} + +resource "aws_default_security_group" "default_5" { + vpc_id = aws_vpc.not_ok_vpc_5.id +} \ No newline at end of file