Repository: bridgecrewio/checkov

Issue:
CKV2_AWS_5: Security group attached to an Elastic DocumentDB cluster is not recognized
**Issue**
Check CKV2_AWS_5 is failing when you try to create an Elastic DocumentDB cluster using Terraform because the Security Group attached to the cluster is not recognized.

**Example**
```terraform
resource "aws_security_group" "main" {
...
}

resource "aws_docdbelastic_cluster" "main" {
  name = "docdbelastic_cluster"

  vpc_security_group_ids = [aws_security_group.main.id]
...
}
```
```
Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource"
  FAILED for resource: aws_security_group.docdb_sg
  File: /main.tf:39-58
  Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis
```

 - Checkov Version: 3.2.236



Discussion:
I'll try to send a pull-request with the fix in a while...



Patch:
diff --git a/checkov/terraform/checks/graph_checks/aws/SGAttachedToResource.yaml b/checkov/terraform/checks/graph_checks/aws/SGAttachedToResource.yaml
index 5b7ea2c4f8..1915b1ac16 100644
--- a/checkov/terraform/checks/graph_checks/aws/SGAttachedToResource.yaml
+++ b/checkov/terraform/checks/graph_checks/aws/SGAttachedToResource.yaml
@@ -23,6 +23,7 @@ definition:
         - aws_db_instance
         - aws_dms_replication_instance
         - aws_docdb_cluster
+        - aws_docdbelastic_cluster
         - aws_ec2_client_vpn_endpoint
         - aws_ec2_client_vpn_network_association
         - aws_ec2_spot_fleet_request


Test patch:
diff --git a/tests/terraform/graph/checks/resources/SGAttachedToResource/expected.yaml b/tests/terraform/graph/checks/resources/SGAttachedToResource/expected.yaml
index 2da6e98fc0..050e1096c0 100644
--- a/tests/terraform/graph/checks/resources/SGAttachedToResource/expected.yaml
+++ b/tests/terraform/graph/checks/resources/SGAttachedToResource/expected.yaml
@@ -9,6 +9,7 @@ pass:
   - "aws_security_group.pass_dax_cluster"
   - "aws_security_group.pass_dms"
   - "aws_security_group.pass_docdb"
+  - "aws_security_group.pass_docdbelastic"
   - "aws_security_group.pass_ec2"
   - "aws_security_group.pass_ec2_client_vpn"
   - "aws_security_group.pass_ec2_client_vpn_endpoint"
diff --git a/tests/terraform/graph/checks/resources/SGAttachedToResource/main.tf b/tests/terraform/graph/checks/resources/SGAttachedToResource/main.tf
index 6cf99c8f22..2b9ecffaa7 100644
--- a/tests/terraform/graph/checks/resources/SGAttachedToResource/main.tf
+++ b/tests/terraform/graph/checks/resources/SGAttachedToResource/main.tf
@@ -157,6 +157,31 @@ resource "aws_docdb_cluster" "pass_docdb" {
   vpc_security_group_ids = [aws_security_group.pass_docdb.id]
 }
 
+# DocDB Elastic
+
+resource "aws_security_group" "pass_docdbelastic" {
+  ingress {
+    description = "TLS from VPC"
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_docdbelastic_cluster" "pass_docdbelastic" {
+  name = "docdbelastic_cluster"
+
+  admin_user_name     = "admin"
+  admin_user_password = "4dm1np4ssw0rd"
+
+  auth_type      = "PLAIN_TEXT"
+  shard_capacity = 2
+  shard_count    = 1
+
+  vpc_security_group_ids = [aws_security_group.pass_docdbelastic.id]
+}
+
 # EC2
 
 resource "aws_security_group" "pass_ec2" {