Repository: Checkmarx/kics (language: python)

Issue:
bug(terraform): wrong detection of unused security group
# Description

- Platform: Terraform
- Provider: AWS
- Query: 4849211b-ac39-479e-ae78-5694d506cb24

Attaching a security group to an elasticache instance does not mark the security group as used.

### Expected Behavior

No "Security Group Not Used" error returned.

### Actual Behavior

"Security Group Not Used" error is returned

### Steps to Reproduce the Problem

Create a security group and an elasticache instance which uses it.

Minimal resources (AWS provider and VPC data source omitted):
```
resource "aws_security_group" "example" {
  name        = "example"
  description = "Allow Redis traffic"
  vpc_id      = data.aws_vpc.selected.id

  ingress {
    
    from_port   = 6379
    to_port     = 6379
    protocol    = "tcp"
    cidr_blocks = [data.aws_vpc.selected.cidr_block]
  }
}

resource "aws_elasticache_replication_group" "redis" {
  replication_group_id       = "Example"
  parameter_group_name       = "default.redis6.x"
  engine                     = "redis"
  engine_version             = "6.x"
  automatic_failover_enabled = false

  security_group_ids = [aws_security_group.example.id]
}

```

returns

```
Security Group Not Used, Severity: INFO, Results: 1
Description: Security group must be used or not declared
Platform: Terraform
Learn more about this vulnerability: https://docs.kics.io/latest/queries/terraform-queries/aws/4849211b-ac39-479e-ae78-5694d506cb24

        [1]: ../../path/sg.tf:2

                001: 
                002: resource "aws_security_group" "example" {
                003:   name        = "example"
```

Command: `docker run --rm -t -v .:/path checkmarx/kics:latest scan -p /path -o "/path/"`

### Specifications

-   Version: v2.0.1
-   Platform: Terraform / Docker



Discussion / hints:

Fix patch:
diff --git a/assets/queries/terraform/aws/security_groups_not_used/query.rego b/assets/queries/terraform/aws/security_groups_not_used/query.rego
index 826cdc3cc9b..ca3c3ca9bad 100644
--- a/assets/queries/terraform/aws/security_groups_not_used/query.rego
+++ b/assets/queries/terraform/aws/security_groups_not_used/query.rego
@@ -32,6 +32,13 @@ is_used(securityGroupName, doc, resource) {
 	contains(securityGroupUsed, sprintf("aws_security_group.%s", [securityGroupName]))
 }
 
+# check security groups assigned to aws_elasticache_instance resources
+is_used(securityGroupName, doc, resource) {
+	[path, value] := walk(doc)
+	securityGroupUsed := value.security_group_ids[_]
+	contains(securityGroupUsed, sprintf("aws_security_group.%s", [securityGroupName]))
+}
+
 # check security groups assigned to aws_instance resources
 is_used(securityGroupName, doc, resource) {
 	[path, value] := walk(doc)


Test patch:
diff --git a/assets/queries/terraform/aws/security_groups_not_used/test/negative6.tf b/assets/queries/terraform/aws/security_groups_not_used/test/negative6.tf
new file mode 100644
index 00000000000..08d1becd945
--- /dev/null
+++ b/assets/queries/terraform/aws/security_groups_not_used/test/negative6.tf
@@ -0,0 +1,23 @@
+resource "aws_security_group" "example" {
+  name        = "example"
+  description = "Allow Redis traffic"
+  vpc_id      = data.aws_vpc.selected.id
+
+  ingress {
+    
+    from_port   = 6379
+    to_port     = 6379
+    protocol    = "tcp"
+    cidr_blocks = [data.aws_vpc.selected.cidr_block]
+  }
+}
+
+resource "aws_elasticache_replication_group" "redis" {
+  replication_group_id       = "Example"
+  parameter_group_name       = "default.redis6.x"
+  engine                     = "redis"
+  engine_version             = "6.x"
+  automatic_failover_enabled = false
+
+  security_group_ids = [aws_security_group.example.id]
+}
\ No newline at end of file
diff --git a/assets/queries/terraform/aws/security_groups_not_used/test/positive5.tf b/assets/queries/terraform/aws/security_groups_not_used/test/positive5.tf
new file mode 100644
index 00000000000..c21e6c3929f
--- /dev/null
+++ b/assets/queries/terraform/aws/security_groups_not_used/test/positive5.tf
@@ -0,0 +1,22 @@
+resource "aws_security_group" "example" {
+  name        = "example"
+  description = "Allow Redis traffic"
+  vpc_id      = data.aws_vpc.selected.id
+
+  ingress {
+    
+    from_port   = 6379
+    to_port     = 6379
+    protocol    = "tcp"
+    cidr_blocks = [data.aws_vpc.selected.cidr_block]
+  }
+}
+
+resource "aws_elasticache_replication_group" "redis" {
+  replication_group_id       = "Example"
+  parameter_group_name       = "default.redis6.x"
+  engine                     = "redis"
+  engine_version             = "6.x"
+  automatic_failover_enabled = false
+  
+}
\ No newline at end of file
diff --git a/assets/queries/terraform/aws/security_groups_not_used/test/positive_expected_result.json b/assets/queries/terraform/aws/security_groups_not_used/test/positive_expected_result.json
index ef3ba55f467..d38ad60cd11 100644
--- a/assets/queries/terraform/aws/security_groups_not_used/test/positive_expected_result.json
+++ b/assets/queries/terraform/aws/security_groups_not_used/test/positive_expected_result.json
@@ -22,5 +22,11 @@
     "severity": "INFO",
     "line": 21,
     "filename": "positive4.tf"
+  },
+  {
+    "queryName": "Security Group Not Used",
+    "severity": "INFO",
+    "line": 1,
+    "filename": "positive5.tf"
   }
 ]