Repository: Checkmarx/kics (language: python)

Issue:
Add/Update security_group_rules_without_description query for Terraform
### Platform
Terraform

### Provider
AWS

### Description
Currently the `security_group_rules_without_description` query only supports inline `ingress` and `egress` rules on the  `security_group` resource.
I would like to extend this query to support the [security_group_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) resource.

Note: the [unrestricted_security_group_ingress](https://github.com/Checkmarx/kics/blob/master/assets/queries/terraform/aws/unrestricted_security_group_ingress/query.rego) already implements a similar rule and includes 
* `security_group`
* `security_group_rule`
* `module` resources

Should each Terraform rule also be checking for resources created by modules?


Discussion / hints:

Fix patch:
diff --git a/assets/queries/terraform/aws/security_group_rules_without_description/query.rego b/assets/queries/terraform/aws/security_group_rules_without_description/query.rego
index cbee937fccb..03e15ecca72 100644
--- a/assets/queries/terraform/aws/security_group_rules_without_description/query.rego
+++ b/assets/queries/terraform/aws/security_group_rules_without_description/query.rego
@@ -41,3 +41,19 @@ CxPolicy[result] {
 		"searchLine": common_lib.build_search_line(["resource", "aws_security_group", name, types[y], resourceIndex], []),
 	}
 }
+
+CxPolicy[result] {
+	resource := input.document[i].resource.aws_security_group_rule[name]
+	not common_lib.valid_key(resource, "description")
+
+	result := {
+		"documentId": input.document[i].id,
+		"resourceType": "aws_security_group_rule",
+		"resourceName": tf_lib.get_resource_name(resource, name),
+		"searchKey": sprintf("aws_security_group_rule[{{%s}}].description", [name]),
+		"issueType": "MissingAttribute",
+		"keyExpectedValue": sprintf("aws_security_group_rule[{{%s}}] description should be defined and not null", [name]),
+		"keyActualValue": sprintf("aws_security_group_rule[{{%s}}] description is undefined or null", [name]),
+		"searchLine": common_lib.build_search_line(["resource", "aws_security_group_rule", name, "description"], []),
+	}
+}


Test patch:
diff --git a/assets/queries/terraform/aws/security_group_rules_without_description/test/negative3.tf b/assets/queries/terraform/aws/security_group_rules_without_description/test/negative3.tf
new file mode 100644
index 00000000000..7e56ae02aeb
--- /dev/null
+++ b/assets/queries/terraform/aws/security_group_rules_without_description/test/negative3.tf
@@ -0,0 +1,32 @@
+resource "aws_security_group" "negative3" {
+
+  name        = "${var.prefix}-external-http-https"
+  description = "Allow main HTTP / HTTPS"
+  vpc_id      = local.vpc_id
+
+  tags = {
+    Name = "${var.prefix}-external-http-https"
+  }
+}
+
+resource "aws_security_group_rule" "negative3a" {
+
+  from_port         = 80
+  to_port           = 80
+  protocol          = "tcp"
+  cidr_blocks       = ["0.0.0.0/0"]
+  security_group_id = aws_security_group.negative3.id
+  type              = "ingress"
+  description       = "Enable HTTP access for select VMs"
+}
+
+resource "aws_security_group_rule" "negative3b" {
+
+  from_port         = 443
+  to_port           = 443
+  protocol          = "tcp"
+  cidr_blocks       = ["0.0.0.0/0"]
+  security_group_id = aws_security_group.negative3.id
+  type              = "ingress"
+  description       = "Enable HTTPS access for select VMs"
+}
diff --git a/assets/queries/terraform/aws/security_group_rules_without_description/test/positive3.tf b/assets/queries/terraform/aws/security_group_rules_without_description/test/positive3.tf
new file mode 100644
index 00000000000..b0d8e0d02fe
--- /dev/null
+++ b/assets/queries/terraform/aws/security_group_rules_without_description/test/positive3.tf
@@ -0,0 +1,31 @@
+resource "aws_security_group" "positive3" {
+
+  name        = "${var.prefix}-external-http-https"
+  description = "Allow main HTTP / HTTPS"
+  vpc_id      = local.vpc_id
+
+  tags = {
+    Name = "${var.prefix}-external-http-https"
+  }
+}
+
+resource "aws_security_group_rule" "positive3a" {
+
+  description       = "Enable HTTP access for select VMs"
+  from_port         = 80
+  to_port           = 80
+  cidr_blocks       = ["0.0.0.0/0"]
+  protocol          = "tcp"
+  security_group_id = aws_security_group.positive3.id
+  type              = "ingress"
+}
+
+resource "aws_security_group_rule" "positive3b" {
+
+  from_port         = 443
+  to_port           = 443
+  cidr_blocks       = ["0.0.0.0/0"]
+  protocol          = "tcp"
+  security_group_id = aws_security_group.positive3.id
+  type              = "ingress"
+}
diff --git a/assets/queries/terraform/aws/security_group_rules_without_description/test/positive_expected_result.json b/assets/queries/terraform/aws/security_group_rules_without_description/test/positive_expected_result.json
index 94fc1bc7116..2b93c51722f 100644
--- a/assets/queries/terraform/aws/security_group_rules_without_description/test/positive_expected_result.json
+++ b/assets/queries/terraform/aws/security_group_rules_without_description/test/positive_expected_result.json
@@ -16,5 +16,10 @@
     "severity": "INFO",
     "line": 15,
     "filename": "positive2.tf"
-  }
-]
+  },
+  {
+    "queryName": "Security Group Rule Without Description",
+    "severity": "INFO",
+    "line": 23,
+    "filename": "positive3.tf"
+  }]