Repository: bridgecrewio/checkov (language: python)

Issue:
CKV2_AWS_5 fails to identify opensearch attachment
**Describe the issue**

checkov does not detect when a security group is attached to an AWS OpenSearch instance.

The check ID is `CKV2_AWS_5`

**Examples**

[Here's an example of a PR with the failing checkout configuration in question.](https://github.com/HHS/simpler-grants-gov/pull/2341/files#diff-609600cbb65809fe1d58326675dd804822d0ca9645e49d442b5a4308b177d5ea)

**Version:**
 - [Github Action version v12.2875.0](https://github.com/bridgecrewio/checkov-action/tree/v12.2875.0/)
 - [Checkov version v3.2.257](https://github.com/bridgecrewio/checkov/tree/3.2.257)

**Additional context**

I suspect that the problem is that `aws_opensearch_domain` needs to be added to this list: https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/SGAttachedToResource.yaml


Discussion / hints:
Linking the PR instead of the diff: https://github.com/HHS/simpler-grants-gov/pull/2341
@coilysiren Hi, thank you for pointing out the issue and providing the relevant details. We are investigating this issue internally and will update you with our findings.

Fix patch:
diff --git a/checkov/terraform/checks/graph_checks/aws/SGAttachedToResource.yaml b/checkov/terraform/checks/graph_checks/aws/SGAttachedToResource.yaml
index 8d5a2f9b0ae..690fd4d1892 100644
--- a/checkov/terraform/checks/graph_checks/aws/SGAttachedToResource.yaml
+++ b/checkov/terraform/checks/graph_checks/aws/SGAttachedToResource.yaml
@@ -51,6 +51,8 @@ definition:
         - aws_mwaa_environment
         - aws_neptune_cluster
         - aws_network_interface
+        - aws_opensearch_domain
+        - aws_opensearch_vpc_endpoint
         - aws_quicksight_vpc_connection
         - aws_rds_cluster
         - aws_redshift_cluster


Test patch:
diff --git a/tests/terraform/graph/checks/resources/SGAttachedToResource/expected.yaml b/tests/terraform/graph/checks/resources/SGAttachedToResource/expected.yaml
index f4009b9a389..98989ff89e0 100644
--- a/tests/terraform/graph/checks/resources/SGAttachedToResource/expected.yaml
+++ b/tests/terraform/graph/checks/resources/SGAttachedToResource/expected.yaml
@@ -38,6 +38,8 @@ pass:
   - "aws_security_group.pass_msk_connect"
   - "aws_security_group.pass_mwaa"
   - "aws_security_group.pass_neptune"
+  - "aws_security_group.pass_opensearch"
+  - "aws_security_group.pass_opensearch_vpc_endpoint"
   - "aws_security_group.pass_quicksight"
   - "aws_security_group.pass_rds"
   - "aws_security_group.pass_rds_cluster"
diff --git a/tests/terraform/graph/checks/resources/SGAttachedToResource/main.tf b/tests/terraform/graph/checks/resources/SGAttachedToResource/main.tf
index 794c7e91e31..509f85d46d9 100644
--- a/tests/terraform/graph/checks/resources/SGAttachedToResource/main.tf
+++ b/tests/terraform/graph/checks/resources/SGAttachedToResource/main.tf
@@ -766,6 +766,46 @@ resource "aws_neptune_cluster" "pass_neptune" {
   vpc_security_group_ids = [aws_security_group.pass_neptune.id]
 }
 
+# OpenSearch Domain
+
+resource "aws_security_group" "pass_opensearch" {
+  ingress {
+    description = "TLS from VPC"
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_opensearch_domain" "pass_opensearch" {
+  domain_name = "opensearch"
+  vpc_options {
+    security_group_ids = [aws_security_group.pass_opensearch.id]
+    subnet_ids         = ["aws_subnet.public_a.id"]
+  }
+}
+
+# OpenSearch VPC Endpoint
+
+resource "aws_security_group" "pass_opensearch_vpc_endpoint" {
+  ingress {
+    description = "TLS from VPC"
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_opensearch_vpc_endpoint" "pass_opensearch_vpc_endpoint" {
+  domain_arn = aws_elasticsearch_domain.domain_1.arn
+  vpc_options {
+    security_group_ids = [aws_security_group.pass_opensearch_vpc_endpoint.id]
+    subnet_ids         = [aws_subnet.test.id, aws_subnet.test2.id]
+  }
+}
+
 # Quicksight
 
 resource "aws_security_group" "pass_quicksight" {