Repository: aquasecurity/tfsec
Pull request #1340 (2022-01-14 18:52:54)

custom checks: requiresPresence's subMatches now get processed too
- did the above
- passing test case already exists, added fail test case

solves #1339 


Patch:
diff --git a/docs/getting-started/usage.md b/docs/getting-started/usage.md
index 94b766999..3d2b4c4bc 100644
--- a/docs/getting-started/usage.md
+++ b/docs/getting-started/usage.md
@@ -12,36 +12,35 @@ tfsec can by run with no arguments and will act on the current folder.
 For a richer experience, there are many additional command line arguments that you can make use of.
 
 
-| Argument                                              | Short Code | Description                                                                              |
-| :---------------------------------------------------- | :--------- | :--------------------------------------------------------------------------------------- |
-| `--allow-checks-to-panic`                             | `-p`       | Allow panics to propagate up from rule checking                                          |
-| `--concise-output`                                    |            | Reduce the amount of output and no statistics                                            |
-| `--config-file [path to config file]`                 |            | Config file to use during run                                                            |
-| `--custom-check-dir [path to checks dir]`             |            | Explicitly the custom checks dir location                                                |
-| `--debug`                                             |            | Enable verbose logging, same as `--verbose` but for people who prefer to say debug       |
-| `--detailed-exit-code`                                |            | Produce more detailed exit status codes.                                                 |
-| `--exclude [comma,separated,rule,ids]`                | `-e`       | Provide comma-separated list of rule IDs to exclude from run.                            |
-| `--exclude-path strings`                              |            | Path to exclude from parser, can be used multiple times                                  |
-| `--exclude-downloaded-modules`                        |            | Remove results for downloaded modules in .terraform folder                               |
-| `--filter-results [comma,separated,riles,to,check]`   |            | Filter results to return specific checks only (supports comma-delimited input).          |
-| `--force-all-dirs`                                    |            | Don't search for tf files, include everything below provided directory.                  |
-| `--format [default,json,csv,checkstyle,junit,sarif] ` | `-f`       | Select output format: default, json, csv, checkstyle, junit, sarif                       |
-| `--gif`                                               |            | Show a celebratory gif in the terminal if no problems are found (default formatter only) |
-| `--help`                                              | `-h`       | help for tfsec                                                                           |
-| `--ignore-hcl-errors`                                 |            | Stop and report an error if an HCL parse error is encountered                            |
-| `--include-ignored`                                   |            | Ignore comments with have no effect and all resources will be scanned                    |
-| `--include-passed`                                    |            | Resources that pass checks are included in the result output                             |
-| `--migrate-ignores`                                   |            | Migrate ignore codes to the new ID structure eg; AWS077 to aws-s3-enable-versioning      |
-| `--no-color`                                          |            | Disable colored output (American style!)                                                 |
-| `--no-colour`                                         |            | Disable coloured output                                                                  |
-| `--out [filepath to output to]`                       |            | Set output file                                                                          |
-| `--run-statistics`                                    |            | View statistics table of current findings.                                               |
-| `--soft-fail`                                         | `-s`       | Runs checks but suppresses error code                                                    |
-| `--sort-severity`                                     |            | Sort the results by severity from highest to lowest                                      |
-| `--tfvars-file strings`                               |            | Path to .tfvars file, can be used multiple times and evaluated in order of specification |
-| `--update`                                            |            | Update to latest version                                                                 |
-| `--verbose`                                           |            | Enable verbose logging                                                                   |
-| `--version`                                           | `-v`       | Show version information and exit                                                        |
-| `--workspace [terraform workspace]`                   | `-w`       | Specify a workspace for ignore limits                                                    |
+| Argument                                                 | Short Code | Description                                                                              |
+| :------------------------------------------------------- | :--------- | :--------------------------------------------------------------------------------------- |
+| `--allow-checks-to-panic`                                | `-p`       | Allow panics to propagate up from rule checking                                          |
+| `--concise-output`                                       |            | Reduce the amount of output and no statistics                                            |
+| `--config-file [path to config file]`                    |            | Config file to use during run                                                            |
+| `--custom-check-dir [path to checks dir]`                |            | Explicitly the custom checks dir location                                                |
+| `--debug`                                                |            | Enable verbose logging, same as `--verbose` but for people who prefer to say debug       |
+| `--detailed-exit-code`                                   |            | Produce more detailed exit status codes.                                                 |
+| `--exclude [comma,separated,rule,ids]`                   | `-e`       | Provide comma-separated list of rule IDs to exclude from run.                            |
+| `--exclude-path strings`                                 |            | Path to exclude from parser, can be used multiple times                                  |
+| `--exclude-downloaded-modules`                           |            | Remove results for downloaded modules in .terraform folder                               |
+| `--filter-results [comma,separated,riles,to,check]`      |            | Filter results to return specific checks only (supports comma-delimited input).          |
+| `--force-all-dirs`                                       |            | Don't search for tf files, include everything below provided directory.                  |
+| `--format [default,json,csv,checkstyle,junit,sarif,gif]` | `-f`       | Select output format: default, json, csv, checkstyle, junit, sarif                       |
+| `--help`                                                 | `-h`       | help for tfsec                                                                           |
+| `--ignore-hcl-errors`                                    |            | Stop and report an error if an HCL parse error is encountered                            |
+| `--include-ignored`                                      |            | Ignore comments with have no effect and all resources will be scanned                    |
+| `--include-passed`                                       |            | Resources that pass checks are included in the result output                             |
+| `--migrate-ignores`                                      |            | Migrate ignore codes to the new ID structure eg; AWS077 to aws-s3-enable-versioning      |
+| `--no-color`                                             |            | Disable colored output (American style!)                                                 |
+| `--no-colour`                                            |            | Disable coloured output                                                                  |
+| `--out [filepath to output to]`                          |            | Set output file                                                                          |
+| `--run-statistics`                                       |            | View statistics table of current findings.                                               |
+| `--soft-fail`                                            | `-s`       | Runs checks but suppresses error code                                                    |
+| `--sort-severity`                                        |            | Sort the results by severity from highest to lowest                                      |
+| `--tfvars-file strings`                                  |            | Path to .tfvars file, can be used multiple times and evaluated in order of specification |
+| `--update`                                               |            | Update to latest version                                                                 |
+| `--verbose`                                              |            | Enable verbose logging                                                                   |
+| `--version`                                              | `-v`       | Show version information and exit                                                        |
+| `--workspace [terraform workspace]`                      | `-w`       | Specify a workspace for ignore limits                                                    |
 
 This list can also be found by running `tfsec --help`
diff --git a/go.mod b/go.mod
index 0ac1b9813..7a3d9d22d 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@ go 1.17
 
 require (
 	github.com/apparentlymart/go-cidr v1.1.0
-	github.com/aquasecurity/defsec v0.3.13
+	github.com/aquasecurity/defsec v0.3.18
 	github.com/bmatcuk/doublestar v1.3.4
 	github.com/google/go-cmp v0.5.6
 	github.com/google/uuid v1.3.0
diff --git a/go.sum b/go.sum
index db72ac938..a887d7704 100644
--- a/go.sum
+++ b/go.sum
@@ -86,6 +86,12 @@ github.com/aquasecurity/defsec v0.3.12 h1:kNB6pCnY2DZzkK0HNR3l/uuMHcSRwAksXqWIus
 github.com/aquasecurity/defsec v0.3.12/go.mod h1:+7iLruZRqRy54zcVCBcEw05YKOtOK6Dd+tEWQjfQPEM=
 github.com/aquasecurity/defsec v0.3.13 h1:f2CKlYz/u8oAjbswFOD1L1SQx74D9XvuXtDswI5uSLk=
 github.com/aquasecurity/defsec v0.3.13/go.mod h1:+7iLruZRqRy54zcVCBcEw05YKOtOK6Dd+tEWQjfQPEM=
+github.com/aquasecurity/defsec v0.3.16 h1:qCsnAuu8pEQcSuUj4vMA7SWM+XzoJBFhDNkUE4h7zFc=
+github.com/aquasecurity/defsec v0.3.16/go.mod h1:+7iLruZRqRy54zcVCBcEw05YKOtOK6Dd+tEWQjfQPEM=
+github.com/aquasecurity/defsec v0.3.17 h1:crMKcMqc9mAQ7eFUTcT5lm24qECNG0VqiMO3U10pek4=
+github.com/aquasecurity/defsec v0.3.17/go.mod h1:+7iLruZRqRy54zcVCBcEw05YKOtOK6Dd+tEWQjfQPEM=
+github.com/aquasecurity/defsec v0.3.18 h1:dBU9I3WOMEjdMFnu2hgcn3ImHak4p/HKo681TDGH/xY=
+github.com/aquasecurity/defsec v0.3.18/go.mod h1:+7iLruZRqRy54zcVCBcEw05YKOtOK6Dd+tEWQjfQPEM=
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
 github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
 github.com/armon/go-metrics v0.3.10/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc=
diff --git a/internal/app/tfsec/adapter/aws/ecr/adapt.go b/internal/app/tfsec/adapter/aws/ecr/adapt.go
index eb73e508f..f7fc679f5 100644
--- a/internal/app/tfsec/adapter/aws/ecr/adapt.go
+++ b/internal/app/tfsec/adapter/aws/ecr/adapt.go
@@ -2,9 +2,84 @@ package ecr
 
 import (
 	"github.com/aquasecurity/defsec/provider/aws/ecr"
+	"github.com/aquasecurity/defsec/provider/aws/iam"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
+	"github.com/aquasecurity/tfsec/internal/app/tfsec/debug"
 )
 
 func Adapt(modules []block.Module) ecr.ECR {
-	return ecr.ECR{}
+	return ecr.ECR{
+		Repositories: adaptRepositories(modules),
+	}
+}
+
+func adaptRepositories(modules []block.Module) []ecr.Repository {
+	var repositories []ecr.Repository
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_ecr_repository") {
+			repositories = append(repositories, adaptRepository(resource, module))
+		}
+	}
+	return repositories
+}
+
+func adaptRepository(resource block.Block, module block.Module) ecr.Repository {
+
+	scanOnPushVal := types.BoolDefault(false, *resource.GetMetadata())
+	tagsImmutable := types.BoolDefault(false, *resource.GetMetadata())
+	encryptionTypeVal := types.StringDefault("AES256", *resource.GetMetadata())
+	kmsKeyVal := types.StringDefault("", *resource.GetMetadata())
+
+	var policyDoc iam.PolicyDocument
+
+	if resource.HasChild("image_scanning_configuration") {
+		imageScanningBlock := resource.GetBlock("image_scanning_configuration")
+		scanOnPushAttr := imageScanningBlock.GetAttribute("scan_on_push")
+		scanOnPushVal = scanOnPushAttr.AsBoolValueOrDefault(false, imageScanningBlock)
+	}
+
+	mutabilityAttr := resource.GetAttribute("image_tag_mutability")
+	if mutabilityAttr.Equals("IMMUTABLE") {
+		tagsImmutable = types.Bool(true, *mutabilityAttr.GetMetadata())
+	} else if mutabilityAttr.Equals("MUTABLE") {
+		tagsImmutable = types.Bool(false, *mutabilityAttr.GetMetadata())
+	}
+
+	policyBlocks := module.GetReferencingResources(resource, "aws_ecr_repository_policy", "repository")
+	for _, policyRes := range policyBlocks {
+		if policyRes.HasChild("policy") && policyRes.GetAttribute("policy").IsString() {
+			policyAttr := policyRes.GetAttribute("policy")
+			rawJSON := []byte(policyAttr.Value().AsString())
+			parsedPolicy, err := iam.ParsePolicyDocument(rawJSON, *policyAttr.GetMetadata())
+			if err != nil {
+				debug.Log("Error decoding IAM policy JSON at %s: %s", policyAttr.Range(), err)
+			}
+			if parsedPolicy != nil {
+				policyDoc = *parsedPolicy
+			}
+		}
+	}
+
+	if resource.HasChild("encryption_configuration") {
+		encryptBlock := resource.GetBlock("encryption_configuration")
+		encryptionTypeAttr := encryptBlock.GetAttribute("encryption_type")
+		encryptionTypeVal = encryptionTypeAttr.AsStringValueOrDefault("AES256", encryptBlock)
+
+		kmsKeyAttr := encryptBlock.GetAttribute("kms_key")
+		kmsKeyVal = kmsKeyAttr.AsStringValueOrDefault("", encryptBlock)
+	}
+
+	return ecr.Repository{
+		Metadata: *resource.GetMetadata(),
+		ImageScanning: ecr.ImageScanning{
+			ScanOnPush: scanOnPushVal,
+		},
+		ImageTagsImmutable: tagsImmutable,
+		Policy:             policyDoc,
+		Encryption: ecr.Encryption{
+			Type:     encryptionTypeVal,
+			KMSKeyID: kmsKeyVal,
+		},
+	}
 }
diff --git a/internal/app/tfsec/adapter/aws/msk/adapt.go b/internal/app/tfsec/adapter/aws/msk/adapt.go
index dbfd09eb5..188d50134 100644
--- a/internal/app/tfsec/adapter/aws/msk/adapt.go
+++ b/internal/app/tfsec/adapter/aws/msk/adapt.go
@@ -2,9 +2,84 @@ package msk
 
 import (
 	"github.com/aquasecurity/defsec/provider/aws/msk"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) msk.MSK {
-	return msk.MSK{}
+	return msk.MSK{
+		Clusters: adaptClusters(modules),
+	}
+}
+
+func adaptClusters(modules []block.Module) []msk.Cluster {
+	var clusters []msk.Cluster
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_msk_cluster") {
+			clusters = append(clusters, adaptCluster(resource))
+		}
+	}
+	return clusters
+}
+
+func adaptCluster(resource block.Block) msk.Cluster {
+	clientBrokerVal := types.StringDefault("TLS_PLAINTEXT", *resource.GetMetadata())
+
+	s3enabled := types.BoolDefault(false, *resource.GetMetadata())
+	cloudwatchEnabled := types.BoolDefault(false, *resource.GetMetadata())
+	firehoseEnabled := types.BoolDefault(false, *resource.GetMetadata())
+
+	if resource.HasChild("encryption_info") {
+		encryptBlock := resource.GetBlock("encryption_info")
+		if encryptBlock.HasChild("encryption_in_transit") {
+			encryptionInTransitBlock := encryptBlock.GetBlock("encryption_in_transit")
+			clientBrokerAttr := encryptionInTransitBlock.GetAttribute("client_broker")
+			if clientBrokerAttr.IsNotNil() {
+				clientBrokerVal = clientBrokerAttr.AsStringValueOrDefault("TLS", encryptionInTransitBlock)
+			}
+		}
+	}
+
+	if resource.HasChild("logging_info") {
+		logBlock := resource.GetBlock("logging_info")
+		if logBlock.HasChild("broker_logs") {
+			brokerLogsBlock := logBlock.GetBlock("broker_logs")
+
+			if brokerLogsBlock.HasChild("s3") {
+				s3Block := brokerLogsBlock.GetBlock("s3")
+				s3enabledAttr := s3Block.GetAttribute("enabled")
+				s3enabled = s3enabledAttr.AsBoolValueOrDefault(false, s3Block)
+			}
+			if brokerLogsBlock.HasChild("cloudwatch_logs") {
+				cloudwatchBlock := brokerLogsBlock.GetBlock("cloudwatch_logs")
+				cwEnabledAttr := cloudwatchBlock.GetAttribute("enabled")
+				cloudwatchEnabled = cwEnabledAttr.AsBoolValueOrDefault(false, cloudwatchBlock)
+			}
+			if brokerLogsBlock.HasChild("firehose") {
+				firehoseBlock := brokerLogsBlock.GetBlock("firehose")
+				firehoseEnabledAttr := firehoseBlock.GetAttribute("enabled")
+				firehoseEnabled = firehoseEnabledAttr.AsBoolValueOrDefault(false, firehoseBlock)
+			}
+		}
+	}
+
+	return msk.Cluster{
+		Metadata: *resource.GetMetadata(),
+		EncryptionInTransit: msk.EncryptionInTransit{
+			ClientBroker: clientBrokerVal,
+		},
+		Logging: msk.Logging{
+			Broker: msk.BrokerLogging{
+				S3: msk.S3Logging{
+					Enabled: s3enabled,
+				},
+				Cloudwatch: msk.CloudwatchLogging{
+					Enabled: cloudwatchEnabled,
+				},
+				Firehose: msk.FirehoseLogging{
+					Enabled: firehoseEnabled,
+				},
+			},
+		},
+	}
 }
diff --git a/internal/app/tfsec/adapter/aws/rds/adapt.go b/internal/app/tfsec/adapter/aws/rds/adapt.go
index 5eef12366..f2f886b9a 100644
--- a/internal/app/tfsec/adapter/aws/rds/adapt.go
+++ b/internal/app/tfsec/adapter/aws/rds/adapt.go
@@ -2,9 +2,117 @@ package rds
 
 import (
 	"github.com/aquasecurity/defsec/provider/aws/rds"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) rds.RDS {
-	return rds.RDS{}
+	return rds.RDS{
+		Instances: getInstances(modules),
+		Clusters:  getClusters(modules),
+		Classic:   getClassic(modules),
+	}
+}
+
+func getInstances(modules []block.Module) (instances []rds.Instance) {
+
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_db_instance") {
+			instances = append(instances, adaptInstance(resource, module))
+		}
+	}
+
+	return instances
+}
+
+func getClusters(modules []block.Module) (clusters []rds.Cluster) {
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_rds_cluster") {
+			clusters = append(clusters, adaptCluster(resource, module))
+		}
+	}
+
+	return clusters
+}
+
+func getClassic(modules []block.Module) (classic rds.Classic) {
+
+	var classicSecurityGroups []rds.DBSecurityGroup
+
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_db_security_group", "aws_redshift_security_group", "aws_elasticache_security_group") {
+			classicSecurityGroups = append(classicSecurityGroups, adaptClassicDBSecurityGroup(resource))
+		}
+	}
+
+	classic.DBSecurityGroups = classicSecurityGroups
+	return classic
+}
+
+func adaptClusterInstance(resource block.Block, module block.Module) rds.ClusterInstance {
+
+	return rds.ClusterInstance{
+		ClusterIdentifier: resource.GetAttribute("cluster_identfier").AsStringValueOrDefault("", resource),
+		Instance:          adaptInstance(resource, module),
+	}
+}
+
+func adaptClassicDBSecurityGroup(resource block.Block) rds.DBSecurityGroup {
+	return rds.DBSecurityGroup{
+		Metadata: *resource.GetMetadata(),
+	}
+}
+
+func adaptInstance(resource block.Block, module block.Module) rds.Instance {
+	replicaSource := resource.GetAttribute("replicate_source_db")
+	replicaSourceValue := ""
+	if replicaSource.IsNotNil() {
+		if referenced, err := module.GetReferencedBlock(replicaSource, resource); err == nil {
+			replicaSourceValue = referenced.ID()
+
+		}
+	}
+	return rds.Instance{
+		Metadata:                  *resource.GetMetadata(),
+		BackupRetentionPeriodDays: resource.GetAttribute("backup_retention_period").AsIntValueOrDefault(0, resource),
+		ReplicationSourceARN:      types.StringExplicit(replicaSourceValue, *resource.GetMetadata()),
+		PerformanceInsights:       adaptPerformanceInsights(resource),
+		Encryption:                adaptEncryption(resource),
+		PublicAccess:              resource.GetAttribute("publicly_accessible").AsBoolValueOrDefault(false, resource),
+	}
+}
+
+func adaptCluster(resource block.Block, module block.Module) rds.Cluster {
+
+	return rds.Cluster{
+		Metadata:                  *resource.GetMetadata(),
+		BackupRetentionPeriodDays: resource.GetAttribute("backup_retention_period").AsIntValueOrDefault(0, resource),
+		ReplicationSourceARN:      resource.GetAttribute("replicate_source_db").AsStringValueOrDefault("", resource),
+		PerformanceInsights:       adaptPerformanceInsights(resource),
+		Instances:                 getClusterInstances(resource, module),
+		Encryption:                adaptEncryption(resource),
+	}
+}
+
+func getClusterInstances(resource block.Block, module block.Module) (clusterInstances []rds.ClusterInstance) {
+	clusterInstanceResources := module.GetReferencingResources(resource, "aws_rds_cluster_instance", "cluster_identifier")
+
+	for _, ciResource := range clusterInstanceResources {
+		clusterInstances = append(clusterInstances, adaptClusterInstance(ciResource, module))
+	}
+	return clusterInstances
+}
+
+func adaptPerformanceInsights(resource block.Block) rds.PerformanceInsights {
+	return rds.PerformanceInsights{
+		Enabled:  resource.GetAttribute("performance_insights_enabled").AsBoolValueOrDefault(false, resource),
+		KMSKeyID: resource.GetAttribute("performance_insights_kms_key_id").AsStringValueOrDefault("", resource),
+	}
+}
+
+func adaptEncryption(resource block.Block) rds.Encryption {
+	return rds.Encryption{
+		EncryptStorage: resource.GetAttribute("storage_encrypted").AsBoolValueOrDefault(false, resource),
+		KMSKeyID:       resource.GetAttribute("kms_key_id").AsStringValueOrDefault("", resource),
+	}
 }
diff --git a/internal/app/tfsec/adapter/azure/database/adapt.go b/internal/app/tfsec/adapter/azure/database/adapt.go
index a1f5e5313..fda7392ae 100644
--- a/internal/app/tfsec/adapter/azure/database/adapt.go
+++ b/internal/app/tfsec/adapter/azure/database/adapt.go
@@ -2,9 +2,281 @@ package database
 
 import (
 	"github.com/aquasecurity/defsec/provider/azure/database"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) database.Database {
-	return database.Database{}
+	return database.Database{
+		MSSQLServers:      adaptMSSQLServers(modules),
+		MariaDBServers:    adaptMariaDBServers(modules),
+		MySQLServers:      adaptMySQLServers(modules),
+		PostgreSQLServers: adaptPostgreSQLServers(modules),
+	}
+}
+
+func adaptMSSQLServers(modules []block.Module) []database.MSSQLServer {
+	var MSSQLServers []database.MSSQLServer
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("azurerm_sql_server") {
+			MSSQLServers = append(MSSQLServers, adaptMSSQLServer(resource, module))
+		}
+		for _, resource := range module.GetResourcesByType("azurerm_mssql_server") {
+			MSSQLServers = append(MSSQLServers, adaptMSSQLServer(resource, module))
+		}
+	}
+	return MSSQLServers
+}
+func adaptMySQLServers(modules []block.Module) []database.MySQLServer {
+	var mySQLServers []database.MySQLServer
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("azurerm_mysql_server") {
+			mySQLServers = append(mySQLServers, adaptMySQLServer(resource, module))
+		}
+	}
+	return mySQLServers
+}
+
+func adaptMariaDBServers(modules []block.Module) []database.MariaDBServer {
+	var mariaDBServers []database.MariaDBServer
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("azurerm_mariadb_server") {
+			mariaDBServers = append(mariaDBServers, adaptMariaDBServer(resource, module))
+		}
+	}
+	return mariaDBServers
+}
+
+func adaptPostgreSQLServers(modules []block.Module) []database.PostgreSQLServer {
+	var PostgreSQLServers []database.PostgreSQLServer
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("azurerm_postgresql_server") {
+			PostgreSQLServers = append(PostgreSQLServers, adaptPostgreSQLServer(resource, module))
+		}
+	}
+	return PostgreSQLServers
+}
+
+func adaptMSSQLServer(resource block.Block, module block.Module) database.MSSQLServer {
+	minTLSVersionVal := types.StringDefault("", *resource.GetMetadata())
+	publicAccessVal := types.BoolDefault(true, *resource.GetMetadata())
+	enableSSLEnforcementVal := types.BoolDefault(false, *resource.GetMetadata())
+
+	var auditingPolicies []database.ExtendedAuditingPolicy
+	var alertPolicies []database.SecurityAlertPolicy
+	var firewallRules []database.FirewallRule
+
+	if resource.TypeLabel() == "azurerm_mssql_server" {
+		minTLSVersionAttr := resource.GetAttribute("minimum_tls_version")
+		minTLSVersionVal = minTLSVersionAttr.AsStringValueOrDefault("", resource)
+
+		publicAccessAttr := resource.GetAttribute("public_network_access_enabled")
+		publicAccessVal = publicAccessAttr.AsBoolValueOrDefault(true, resource)
+
+	}
+
+	alertPolicyBlocks := module.GetReferencingResources(resource, "azurerm_mssql_server_security_alert_policy", "server_name")
+	for _, alertBlock := range alertPolicyBlocks {
+		alertPolicies = append(alertPolicies, adaptMSSQLSecurityAlertPolicy(alertBlock))
+	}
+
+	auditingPoliciesBlocks := module.GetReferencingResources(resource, "azurerm_mssql_server_extended_auditing_policy", "server_id")
+	if resource.HasChild("extended_auditing_policy") {
+		auditingPoliciesBlocks = append(auditingPoliciesBlocks, resource.GetBlocks("extended_auditing_policy")...)
+	}
+
+	databasesRes := module.GetReferencingResources(resource, "azurerm_mssql_database", "server_id")
+	for _, databaseRes := range databasesRes {
+		dbAuditingBlocks := module.GetReferencingResources(databaseRes, "azurerm_mssql_database_extended_auditing_policy", "database_id")
+		auditingPoliciesBlocks = append(auditingPoliciesBlocks, dbAuditingBlocks...)
+	}
+
+	for _, auditBlock := range auditingPoliciesBlocks {
+		auditingPolicies = append(auditingPolicies, adaptMSSQLExtendedAuditingPolicy(auditBlock))
+	}
+
+	firewallRuleBlocks := module.GetReferencingResources(resource, "azurerm_sql_firewall_rule", "server_name")
+	for _, firewallBlock := range firewallRuleBlocks {
+		firewallRules = append(firewallRules, adaptFirewallRule(firewallBlock))
+	}
+
+	return database.MSSQLServer{
+		Server: database.Server{
+			Metadata:                  *resource.GetMetadata(),
+			EnableSSLEnforcement:      enableSSLEnforcementVal,
+			MinimumTLSVersion:         minTLSVersionVal,
+			EnablePublicNetworkAccess: publicAccessVal,
+			FirewallRules:             firewallRules,
+		},
+		ExtendedAuditingPolicies: auditingPolicies,
+		SecurityAlertPolicies:    alertPolicies,
+	}
+}
+
+func adaptMySQLServer(resource block.Block, module block.Module) database.MySQLServer {
+	var firewallRules []database.FirewallRule
+
+	enableSSLEnforcementAttr := resource.GetAttribute("ssl_enforcement_enabled")
+	enableSSLEnforcementVal := enableSSLEnforcementAttr.AsBoolValueOrDefault(false, resource)
+
+	minTLSVersionAttr := resource.GetAttribute("ssl_minimal_tls_version_enforced")
+	minTLSVersionVal := minTLSVersionAttr.AsStringValueOrDefault("TLSEnforcementDisabled", resource)
+
+	publicAccessAttr := resource.GetAttribute("public_network_access_enabled")
+	publicAccessVal := publicAccessAttr.AsBoolValueOrDefault(true, resource)
+
+	firewallRuleBlocks := module.GetReferencingResources(resource, "azurerm_mysql_firewall_rule", "server_name")
+	for _, firewallBlock := range firewallRuleBlocks {
+		firewallRules = append(firewallRules, adaptFirewallRule(firewallBlock))
+	}
+
+	return database.MySQLServer{
+		Server: database.Server{
+			Metadata:                  *resource.GetMetadata(),
+			EnableSSLEnforcement:      enableSSLEnforcementVal,
+			MinimumTLSVersion:         minTLSVersionVal,
+			EnablePublicNetworkAccess: publicAccessVal,
+			FirewallRules:             firewallRules,
+		},
+	}
+}
+
+func adaptMariaDBServer(resource block.Block, module block.Module) database.MariaDBServer {
+	var firewallRules []database.FirewallRule
+
+	enableSSLEnforcementAttr := resource.GetAttribute("ssl_enforcement_enabled")
+	enableSSLEnforcementVal := enableSSLEnforcementAttr.AsBoolValueOrDefault(false, resource)
+
+	publicAccessAttr := resource.GetAttribute("public_network_access_enabled")
+	publicAccessVal := publicAccessAttr.AsBoolValueOrDefault(true, resource)
+
+	firewallRuleBlocks := module.GetReferencingResources(resource, "azurerm_mariadb_firewall_rule", "server_name")
+	for _, firewallBlock := range firewallRuleBlocks {
+		firewallRules = append(firewallRules, adaptFirewallRule(firewallBlock))
+	}
+
+	return database.MariaDBServer{
+		Server: database.Server{
+			Metadata:                  *resource.GetMetadata(),
+			EnableSSLEnforcement:      enableSSLEnforcementVal,
+			EnablePublicNetworkAccess: publicAccessVal,
+			FirewallRules:             firewallRules,
+		},
+	}
+}
+
+func adaptPostgreSQLServer(resource block.Block, module block.Module) database.PostgreSQLServer {
+	var firewallRules []database.FirewallRule
+
+	config := database.PostgresSQLConfig{
+		LogCheckpoints:       types.BoolDefault(false, *resource.GetMetadata()),
+		ConnectionThrottling: types.BoolDefault(false, *resource.GetMetadata()),
+		LogConnections:       types.BoolDefault(false, *resource.GetMetadata()),
+	}
+
+	enableSSLEnforcementAttr := resource.GetAttribute("ssl_enforcement_enabled")
+	enableSSLEnforcementVal := enableSSLEnforcementAttr.AsBoolValueOrDefault(false, resource)
+
+	minTLSVersionAttr := resource.GetAttribute("ssl_minimal_tls_version_enforced")
+	minTLSVersionVal := minTLSVersionAttr.AsStringValueOrDefault("TLSEnforcementDisabled", resource)
+
+	publicAccessAttr := resource.GetAttribute("public_network_access_enabled")
+	publicAccessVal := publicAccessAttr.AsBoolValueOrDefault(true, resource)
+
+	firewallRuleBlocks := module.GetReferencingResources(resource, "azurerm_postgresql_firewall_rule", "server_name")
+	for _, firewallBlock := range firewallRuleBlocks {
+		firewallRules = append(firewallRules, adaptFirewallRule(firewallBlock))
+	}
+
+	configBlocks := module.GetReferencingResources(resource, "azurerm_postgresql_configuration", "server_name")
+	for _, configBlock := range configBlocks {
+		config = adaptPostgreSQLConfig(configBlock)
+	}
+
+	return database.PostgreSQLServer{
+		Server: database.Server{
+			Metadata:                  *resource.GetMetadata(),
+			EnableSSLEnforcement:      enableSSLEnforcementVal,
+			MinimumTLSVersion:         minTLSVersionVal,
+			EnablePublicNetworkAccess: publicAccessVal,
+			FirewallRules:             firewallRules,
+		},
+		Config: config,
+	}
+}
+
+func adaptPostgreSQLConfig(resource block.Block) database.PostgresSQLConfig {
+	nameAttr := resource.GetAttribute("name")
+	valAttr := resource.GetAttribute("value")
+
+	logCheckpoints := types.BoolDefault(false, *resource.GetMetadata())
+	connectionThrottling := types.BoolDefault(false, *resource.GetMetadata())
+	logConnections := types.BoolDefault(false, *resource.GetMetadata())
+
+	if valAttr.Equals("on") {
+		if nameAttr.Equals("log_checkpoints") {
+			logCheckpoints = types.Bool(true, *valAttr.GetMetadata())
+		}
+		if nameAttr.Equals("connection_throttling") {
+			connectionThrottling = types.Bool(true, *valAttr.GetMetadata())
+		}
+		if nameAttr.Equals("log_connections") {
+			logConnections = types.Bool(true, *valAttr.GetMetadata())
+		}
+	}
+
+	return database.PostgresSQLConfig{
+		LogCheckpoints:       logCheckpoints,
+		ConnectionThrottling: connectionThrottling,
+		LogConnections:       logConnections,
+	}
+}
+
+func adaptMSSQLSecurityAlertPolicy(resource block.Block) database.SecurityAlertPolicy {
+	var emailAddressesVal []types.StringValue
+	var disabledAlertsVal []types.StringValue
+
+	emailAddressesAttr := resource.GetAttribute("email_addresses")
+	emailAddresses := emailAddressesAttr.ValueAsStrings()
+	for _, email := range emailAddresses {
+		emailAddressesVal = append(emailAddressesVal, types.String(email, *emailAddressesAttr.GetMetadata()))
+	}
+
+	disabledAlertsAttr := resource.GetAttribute("disabled_alerts")
+	disabledAlerts := disabledAlertsAttr.ValueAsStrings()
+	for _, alert := range disabledAlerts {
+		disabledAlertsVal = append(disabledAlertsVal, types.String(alert, *disabledAlertsAttr.GetMetadata()))
+	}
+
+	emailAccountAdminsAttr := resource.GetAttribute("email_account_admins")
+	emailAccountAdminsVal := emailAccountAdminsAttr.AsBoolValueOrDefault(false, resource)
+
+	return database.SecurityAlertPolicy{
+		Metadata:           *resource.GetMetadata(),
+		EmailAddresses:     emailAddressesVal,
+		DisabledAlerts:     disabledAlertsVal,
+		EmailAccountAdmins: emailAccountAdminsVal,
+	}
+}
+
+func adaptFirewallRule(resource block.Block) database.FirewallRule {
+	startIPAttr := resource.GetAttribute("start_ip_address")
+	startIPVal := startIPAttr.AsStringValueOrDefault("", resource)
+
+	endIPAttr := resource.GetAttribute("end_ip_address")
+	endIPVal := endIPAttr.AsStringValueOrDefault("", resource)
+
+	return database.FirewallRule{
+		StartIP: startIPVal,
+		EndIP:   endIPVal,
+	}
+}
+
+func adaptMSSQLExtendedAuditingPolicy(resource block.Block) database.ExtendedAuditingPolicy {
+	retentionInDaysAttr := resource.GetAttribute("retention_in_days")
+	retentionInDaysVal := retentionInDaysAttr.AsIntValueOrDefault(0, resource)
+
+	return database.ExtendedAuditingPolicy{
+		RetentionInDays: retentionInDaysVal,
+	}
 }
diff --git a/internal/app/tfsec/adapter/azure/network/adapt.go b/internal/app/tfsec/adapter/azure/network/adapt.go
index 299b95c5e..afc1f284d 100644
--- a/internal/app/tfsec/adapter/azure/network/adapt.go
+++ b/internal/app/tfsec/adapter/azure/network/adapt.go
@@ -2,9 +2,158 @@ package network
 
 import (
 	"github.com/aquasecurity/defsec/provider/azure/network"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) network.Network {
-	return network.Network{}
+	return network.Network{
+		SecurityGroups:         adaptSecurityGroups(modules),
+		NetworkWatcherFlowLogs: adaptWatcherLogs(modules),
+	}
+}
+
+func adaptSecurityGroups(modules []block.Module) []network.SecurityGroup {
+	var securityGroups []network.SecurityGroup
+
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("azurerm_network_security_group") {
+			securityGroups = append(securityGroups, adaptSecurityGroup(resource, module))
+		}
+	}
+	return securityGroups
+}
+
+func adaptWatcherLogs(modules []block.Module) []network.NetworkWatcherFlowLog {
+	var watcherLogs []network.NetworkWatcherFlowLog
+
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("azurerm_network_watcher_flow_log") {
+			watcherLogs = append(watcherLogs, adaptWatcherLog(resource))
+		}
+	}
+	return watcherLogs
+}
+
+func adaptSecurityGroup(resource block.Block, module block.Module) network.SecurityGroup {
+	var inboundAllowRules []network.SecurityGroupRule
+	var inboundDenyRules []network.SecurityGroupRule
+	var outboundAllowRules []network.SecurityGroupRule
+	var outboundDenyRules []network.SecurityGroupRule
+
+	var securityRuleBlocks block.Blocks
+	if resource.HasChild("security_rule") {
+		securityRuleBlocks = append(securityRuleBlocks, resource.GetBlocks("security_rule")...)
+	}
+
+	securityRuleRes := module.GetReferencingResources(resource, "azurerm_network_security_rule", "network_security_group_name")
+	securityRuleBlocks = append(securityRuleBlocks, securityRuleRes...)
+
+	for _, ruleBlock := range securityRuleBlocks {
+		accessAttr := ruleBlock.GetAttribute("access")
+		directionAttr := ruleBlock.GetAttribute("direction")
+
+		if accessAttr.Equals("Allow") && directionAttr.Equals("Inbound") {
+			inboundAllowRules = append(inboundAllowRules, adaptSGRule(ruleBlock))
+		}
+		if accessAttr.Equals("Deny") && directionAttr.Equals("Inbound") {
+			inboundDenyRules = append(inboundDenyRules, adaptSGRule(ruleBlock))
+
+		}
+		if accessAttr.Equals("Allow") && directionAttr.Equals("Outbound") {
+			outboundAllowRules = append(outboundAllowRules, adaptSGRule(ruleBlock))
+		}
+		if accessAttr.Equals("Deny") && directionAttr.Equals("Outbound") {
+			outboundDenyRules = append(outboundDenyRules, adaptSGRule(ruleBlock))
+		}
+	}
+
+	return network.SecurityGroup{
+		InboundAllowRules:  inboundAllowRules,
+		InboundDenyRules:   inboundDenyRules,
+		OutboundAllowRules: outboundAllowRules,
+		OutboundDenyRules:  outboundDenyRules,
+	}
+}
+
+func adaptSGRule(resource block.Block) network.SecurityGroupRule {
+	var sourceAddresses []types.StringValue
+	var sourcePortRanges []types.StringValue
+	var destinationAddresses []types.StringValue
+	var destinationPortRanges []types.StringValue
+
+	sourceAddressAttr := resource.GetAttribute("source_address_prefix")
+	sourceAddresses = append(sourceAddresses, sourceAddressAttr.AsStringValueOrDefault("", resource))
+
+	sourceAddressPrefixesAttr := resource.GetAttribute("source_address_prefixes")
+	values := sourceAddressPrefixesAttr.ValueAsStrings()
+	for _, value := range values {
+		sourceAddresses = append(sourceAddresses, types.String(value, *resource.GetMetadata()))
+	}
+
+	sourcePortRangeAttr := resource.GetAttribute("source_port_range")
+	if sourcePortRangeAttr.IsIterable() {
+		values := sourcePortRangeAttr.ValueAsStrings()
+		for _, value := range values {
+			sourcePortRanges = append(sourcePortRanges, types.String(value, *resource.GetMetadata()))
+
+		}
+	} else {
+		sourcePortRanges = append(sourcePortRanges, sourcePortRangeAttr.AsStringValueOrDefault("", resource))
+	}
+
+	sourcePortRangesAttr := resource.GetAttribute("source_port_ranges")
+	sourcePortList := sourcePortRangesAttr.ValueAsStrings()
+	for _, sourcePort := range sourcePortList {
+		sourcePortRanges = append(sourcePortRanges, types.String(sourcePort, *resource.GetMetadata()))
+	}
+
+	destinationAddressPrefixAttr := resource.GetAttribute("destination_address_prefix")
+	destinationAddresses = append(destinationAddresses, destinationAddressPrefixAttr.AsStringValueOrDefault("", resource))
+
+	destinationAddressPrefixesAttr := resource.GetAttribute("destination_address_prefixes")
+	destinationAddList := destinationAddressPrefixesAttr.ValueAsStrings()
+	for _, destination := range destinationAddList {
+		destinationAddresses = append(destinationAddresses, types.String(destination, *resource.GetMetadata()))
+	}
+
+	destinationPortRangeAttr := resource.GetAttribute("destination_port_range")
+	if destinationPortRangeAttr.IsIterable() {
+		values := destinationPortRangeAttr.ValueAsStrings()
+		for _, value := range values {
+			destinationPortRanges = append(destinationPortRanges, types.String(value, *resource.GetMetadata()))
+		}
+	} else {
+		destinationPortRanges = append(destinationPortRanges, destinationPortRangeAttr.AsStringValueOrDefault("", resource))
+	}
+
+	destinationPortRangesAttr := resource.GetAttribute("destination_port_ranges")
+	destinationPortsList := destinationPortRangesAttr.ValueAsStrings()
+	for _, destination := range destinationPortsList {
+		destinationPortRanges = append(destinationPortRanges, types.String(destination, *resource.GetMetadata()))
+	}
+
+	return network.SecurityGroupRule{
+		SourceAddresses:       sourceAddresses,
+		SourcePortRanges:      sourcePortRanges,
+		DestinationAddresses:  destinationAddresses,
+		DestinationPortRanges: destinationPortRanges,
+	}
+}
+
+func adaptWatcherLog(resource block.Block) network.NetworkWatcherFlowLog {
+	retentionPolicyBlock := resource.GetBlock("retention_policy")
+
+	enabledAttr := retentionPolicyBlock.GetAttribute("enabled")
+	enabledVal := enabledAttr.AsBoolValueOrDefault(false, retentionPolicyBlock)
+
+	daysAttr := retentionPolicyBlock.GetAttribute("days")
+	daysVal := daysAttr.AsIntValueOrDefault(0, retentionPolicyBlock)
+
+	return network.NetworkWatcherFlowLog{
+		RetentionPolicy: network.RetentionPolicy{
+			Enabled: enabledVal,
+			Days:    daysVal,
+		},
+	}
 }
diff --git a/internal/app/tfsec/custom/processing.go b/internal/app/tfsec/custom/processing.go
index 7ee2e9af4..6216d5986 100644
--- a/internal/app/tfsec/custom/processing.go
+++ b/internal/app/tfsec/custom/processing.go
@@ -11,12 +11,12 @@ import (
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
 
-var matchFunctions = map[CheckAction]func(block.Block, *MatchSpec) bool{
-	IsPresent: func(block block.Block, spec *MatchSpec) bool {
+var matchFunctions = map[CheckAction]func(block.Block, *MatchSpec, block.Module) bool{
+	IsPresent: func(block block.Block, spec *MatchSpec, module block.Module) bool {
 		return block.HasChild(spec.Name) || spec.IgnoreUndefined
 	},
-	NotPresent: func(block block.Block, spec *MatchSpec) bool { return !block.HasChild(spec.Name) },
-	IsEmpty: func(block block.Block, spec *MatchSpec) bool {
+	NotPresent: func(block block.Block, spec *MatchSpec, module block.Module) bool { return !block.HasChild(spec.Name) },
+	IsEmpty: func(block block.Block, spec *MatchSpec, module block.Module) bool {
 		if block.MissingChild(spec.Name) {
 			return true
 		}
@@ -28,94 +28,95 @@ var matchFunctions = map[CheckAction]func(block.Block, *MatchSpec) bool{
 		childBlock := block.GetBlock(spec.Name)
 		return childBlock.IsEmpty()
 	},
-	StartsWith: func(block block.Block, spec *MatchSpec) bool {
+	StartsWith: func(block block.Block, spec *MatchSpec, module block.Module) bool {
 		attribute := block.GetAttribute(spec.Name)
 		if attribute.IsNil() {
 			return spec.IgnoreUndefined
 		}
 		return attribute.StartsWith(spec.MatchValue)
 	},
-	EndsWith: func(block block.Block, spec *MatchSpec) bool {
+	EndsWith: func(block block.Block, spec *MatchSpec, module block.Module) bool {
 		attribute := block.GetAttribute(spec.Name)
 		if attribute.IsNil() {
 			return spec.IgnoreUndefined
 		}
 		return attribute.EndsWith(spec.MatchValue)
 	},
-	Contains: func(b block.Block, spec *MatchSpec) bool {
+	Contains: func(b block.Block, spec *MatchSpec, module block.Module) bool {
 		attribute := b.GetAttribute(spec.Name)
 		if attribute.IsNil() {
 			return spec.IgnoreUndefined
 		}
 		return attribute.Contains(spec.MatchValue, block.IgnoreCase)
 	},
-	NotContains: func(block block.Block, spec *MatchSpec) bool {
+	NotContains: func(block block.Block, spec *MatchSpec, module block.Module) bool {
 		attribute := block.GetAttribute(spec.Name)
 		if attribute.IsNil() {
 			return spec.IgnoreUndefined
 		}
 		return !attribute.Contains(spec.MatchValue)
 	},
-	Equals: func(block block.Block, spec *MatchSpec) bool {
+	Equals: func(block block.Block, spec *MatchSpec, module block.Module) bool {
 		attribute := block.GetAttribute(spec.Name)
 		if attribute.IsNil() {
 			return spec.IgnoreUndefined
 		}
 		return attribute.Equals(spec.MatchValue)
 	},
-	NotEqual: func(block block.Block, spec *MatchSpec) bool {
+	NotEqual: func(block block.Block, spec *MatchSpec, module block.Module) bool {
 		attribute := block.GetAttribute(spec.Name)
 		if attribute.IsNil() {
 			return spec.IgnoreUndefined
 		}
 		return attribute.NotEqual(spec.MatchValue)
 	},
-	LessThan: func(block block.Block, spec *MatchSpec) bool {
+	LessThan: func(block block.Block, spec *MatchSpec, module block.Module) bool {
 		attribute := block.GetAttribute(spec.Name)
 		if attribute.IsNil() {
 			return spec.IgnoreUndefined
 		}
 		return attribute.LessThan(spec.MatchValue)
 	},
-	LessThanOrEqualTo: func(block block.Block, spec *MatchSpec) bool {
+	LessThanOrEqualTo: func(block block.Block, spec *MatchSpec, module block.Module) bool {
 		attribute := block.GetAttribute(spec.Name)
 		if attribute.IsNil() {
 			return spec.IgnoreUndefined
 		}
 		return attribute.LessThanOrEqualTo(spec.MatchValue)
 	},
-	GreaterThan: func(block block.Block, spec *MatchSpec) bool {
+	GreaterThan: func(block block.Block, spec *MatchSpec, module block.Module) bool {
 		attribute := block.GetAttribute(spec.Name)
 		if attribute.IsNil() {
 			return spec.IgnoreUndefined
 		}
 		return attribute.GreaterThan(spec.MatchValue)
 	},
-	GreaterThanOrEqualTo: func(block block.Block, spec *MatchSpec) bool {
+	GreaterThanOrEqualTo: func(block block.Block, spec *MatchSpec, module block.Module) bool {
 		attribute := block.GetAttribute(spec.Name)
 		if attribute.IsNil() {
 			return spec.IgnoreUndefined
 		}
 		return attribute.GreaterThanOrEqualTo(spec.MatchValue)
 	},
-	RegexMatches: func(block block.Block, spec *MatchSpec) bool {
+	RegexMatches: func(block block.Block, spec *MatchSpec, module block.Module) bool {
 		attribute := block.GetAttribute(spec.Name)
 		if attribute.IsNil() {
 			return spec.IgnoreUndefined
 		}
 		return attribute.RegexMatches(spec.MatchValue)
 	},
-	IsAny: func(block block.Block, spec *MatchSpec) bool {
+	IsAny: func(block block.Block, spec *MatchSpec, module block.Module) bool {
 		attribute := block.GetAttribute(spec.Name)
 		return attribute != nil && attribute.IsAny(unpackInterfaceToInterfaceSlice(spec.MatchValue)...)
 	},
-	IsNone: func(block block.Block, spec *MatchSpec) bool {
+	IsNone: func(block block.Block, spec *MatchSpec, module block.Module) bool {
 		attribute := block.GetAttribute(spec.Name)
 		if attribute.IsNil() {
 			return spec.IgnoreUndefined
 		}
 		return attribute.IsNone(unpackInterfaceToInterfaceSlice(spec.MatchValue)...)
 	},
+	RequiresPresence: func(block block.Block, spec *MatchSpec, module block.Module) bool { return resourceFound(spec, module) },
 }
 
 func processFoundChecks(checks ChecksFile) {
@@ -173,15 +174,13 @@ func evalMatchSpec(b block.Block, spec *MatchSpec, module block.Module) bool {
 	case InModule:
 		return b.InModule()
 	case RegexMatches:
-		if !matchFunctions[RegexMatches](b, spec) {
+		if !matchFunctions[RegexMatches](b, spec, module) {
 			return spec.IgnoreUnmatched
 		}
 	case HasTag:
 		return checkTags(b, spec, module)
 	case OfType:
 		return ofType(b, spec)
-	case RequiresPresence:
-		return resourceFound(spec, module)
 	case Not:
 		return notifyPredicate(b, spec, module)
 	case And:
@@ -189,11 +188,11 @@ func evalMatchSpec(b block.Block, spec *MatchSpec, module block.Module) bool {
 	case Or:
 		return processOrPredicate(spec, b, module)
 	default:
-		evalResult = matchFunctions[spec.Action](b, spec)
+		evalResult = matchFunctions[spec.Action](b, spec, module)
 	}
 
 	if spec.SubMatch != nil {
-		evalResult = processSubMatches(spec, b, evalResult)
+		evalResult = processSubMatches(spec, b, module, evalResult)
 	}
 
 	return evalResult
@@ -226,8 +225,15 @@ func processAndPredicate(spec *MatchSpec, b block.Block, module block.Module) bo
 	return len(set) == 1 && set[true]
 }
 
-func processSubMatches(spec *MatchSpec, b block.Block, evalResult bool) bool {
-	for _, b := range b.GetBlocks(spec.Name) {
+func processSubMatches(spec *MatchSpec, b block.Block, module block.Module, evalResult bool) bool {
+	var subMatchTargets []block.Block
+	switch spec.Action {
+	case RequiresPresence:
+		subMatchTargets = module.GetResourcesByType(spec.Name)
+	default:
+		subMatchTargets = b.GetBlocks(spec.Name)
+	}
+	for _, b := range subMatchTargets {
 		evalResult = evalMatchSpec(b, spec.SubMatch, nil)
 		if !evalResult {
 			break
diff --git a/internal/app/tfsec/rules/aws/ecr/enable_image_scans_rule.go b/internal/app/tfsec/rules/aws/ecr/enable_image_scans_rule.go
index 406ca8578..501451b2e 100644
--- a/internal/app/tfsec/rules/aws/ecr/enable_image_scans_rule.go
+++ b/internal/app/tfsec/rules/aws/ecr/enable_image_scans_rule.go
@@ -1,9 +1,7 @@
 package ecr
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/ecr"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -37,21 +35,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_ecr_repository"},
 		Base:           ecr.CheckEnableImageScans,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("image_scanning_configuration") {
-				results.Add("Resource defines a disabled ECR image scan.", resourceBlock)
-				return
-			}
-
-			ecrScanStatusAttr := resourceBlock.GetNestedAttribute("image_scanning_configuration.scan_on_push")
-			if ecrScanStatusAttr.IsNil() {
-				results.Add("Resource defines a disabled ECR image scan.", resourceBlock)
-			} else if ecrScanStatusAttr.IsFalse() {
-				results.Add("Resource defines a disabled ECR image scan.", ecrScanStatusAttr)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/ecr/enforce_immutable_repository_rule.go b/internal/app/tfsec/rules/aws/ecr/enforce_immutable_repository_rule.go
index 61f5591d0..5b7ab221f 100644
--- a/internal/app/tfsec/rules/aws/ecr/enforce_immutable_repository_rule.go
+++ b/internal/app/tfsec/rules/aws/ecr/enforce_immutable_repository_rule.go
@@ -1,9 +1,7 @@
 package ecr
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/ecr"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -37,19 +35,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_ecr_repository"},
 		Base:           ecr.CheckEnforceImmutableRepository,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			imageTagMutabilityAttr := resourceBlock.GetAttribute("image_tag_mutability")
-			if imageTagMutabilityAttr.IsNil() {
-				results.Add("Resource is missing `image_tag_mutability` attribute - it is required to make ecr image tag immutable.", resourceBlock)
-				return
-			}
-
-			if imageTagMutabilityAttr.NotEqual("IMMUTABLE") {
-				results.Add("Resource has `image_tag_mutability` attribute  not set to `IMMUTABLE`", imageTagMutabilityAttr)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/ecr/no_public_access_rule.go b/internal/app/tfsec/rules/aws/ecr/no_public_access_rule.go
index 2b794732e..3ec81d412 100644
--- a/internal/app/tfsec/rules/aws/ecr/no_public_access_rule.go
+++ b/internal/app/tfsec/rules/aws/ecr/no_public_access_rule.go
@@ -1,14 +1,7 @@
 package ecr
 
 import (
-	"encoding/json"
-	"strings"
-
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/ecr"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/debug"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/rules/aws/iam"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -101,38 +94,5 @@ func init() {
 			"aws_ecr_repository_policy",
 		},
 		Base: ecr.CheckNoPublicAccess,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			policyAttr := resourceBlock.GetAttribute("policy")
-			if policyAttr.IsNil() || !policyAttr.IsString() {
-				return
-			}
-
-			var document iam.PolicyDocument
-			if err := json.Unmarshal([]byte(policyAttr.Value().AsString()), &document); err != nil {
-				debug.Log("Error decoding IAM policy JSON at %s: %s", policyAttr.Range(), err)
-				return
-			}
-
-			for _, statement := range document.Statements {
-				var hasECRAction bool
-				for _, action := range statement.Action {
-					if strings.HasPrefix(action, "ecr:") {
-						hasECRAction = true
-						break
-					}
-				}
-				if !hasECRAction {
-					continue
-				}
-				for _, account := range statement.Principal.AWS {
-					if account == "*" {
-						results.Add("Resource provides public access to the ECR repository.", policyAttr)
-					}
-					return
-				}
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/ecr/repository_customer_key_rule.go b/internal/app/tfsec/rules/aws/ecr/repository_customer_key_rule.go
index 6dac9dfa0..18ef69d1a 100644
--- a/internal/app/tfsec/rules/aws/ecr/repository_customer_key_rule.go
+++ b/internal/app/tfsec/rules/aws/ecr/repository_customer_key_rule.go
@@ -1,9 +1,7 @@
 package ecr
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/ecr"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -46,24 +44,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_ecr_repository"},
 		Base:           ecr.CheckRepositoryCustomerKey,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("encryption_configuration") {
-				results.Add("Resource does not have CMK encryption configured", resourceBlock)
-				return
-			}
-
-			encBlock := resourceBlock.GetBlock("encryption_configuration")
-			if encBlock.MissingChild("kms_key") {
-				results.Add("Resource configures encryption without using CMK", encBlock)
-				return
-			}
-
-			if encBlock.MissingChild("encryption_type") || encBlock.GetAttribute("encryption_type").Equals("AES256") {
-				results.Add("Resource should have the encryption type set to KMS", encBlock)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/msk/enable_in_transit_encryption_rule.go b/internal/app/tfsec/rules/aws/msk/enable_in_transit_encryption_rule.go
index c7fdd3acc..5852b2e71 100644
--- a/internal/app/tfsec/rules/aws/msk/enable_in_transit_encryption_rule.go
+++ b/internal/app/tfsec/rules/aws/msk/enable_in_transit_encryption_rule.go
@@ -1,9 +1,7 @@
 package msk
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/msk"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -37,30 +35,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_msk_cluster"},
 		Base:           msk.CheckEnableInTransitEncryption,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			defaultBehaviorBlock := resourceBlock.GetBlock("encryption_info")
-			if defaultBehaviorBlock.IsNil() {
-				results.Add("Resource defines a MSK cluster that allows plaintext as well as TLS encrypted data in transit (missing encryption_info block).", resourceBlock)
-				return
-			}
-
-			encryptionInTransit := defaultBehaviorBlock.GetBlock("encryption_in_transit")
-			if encryptionInTransit.IsNil() {
-				results.Add("Resource defines a MSK cluster that allows plaintext as well as TLS encrypted data in transit (missing encryption_in_transit block).", defaultBehaviorBlock)
-				return
-			}
-
-			clientBrokerAttr := encryptionInTransit.GetAttribute("client_broker")
-			//nolint
-			if clientBrokerAttr.IsNil() {
-				results.Add("Resource defines a MSK cluster that allows plaintext as well as TLS encrypted data in transit (missing client_broker block).", encryptionInTransit)
-			} else if clientBrokerAttr.Value().AsString() == "PLAINTEXT" {
-				results.Add("Resource defines a MSK cluster that only allows plaintext data in transit.", clientBrokerAttr)
-			} else if clientBrokerAttr.Value().AsString() == "TLS_PLAINTEXT" {
-				results.Add("Resource defines a MSK cluster that allows plaintext as well as TLS encrypted data in transit.", clientBrokerAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/msk/enable_logging_rule.go b/internal/app/tfsec/rules/aws/msk/enable_logging_rule.go
index 04abda67e..5c39ce669 100644
--- a/internal/app/tfsec/rules/aws/msk/enable_logging_rule.go
+++ b/internal/app/tfsec/rules/aws/msk/enable_logging_rule.go
@@ -1,9 +1,7 @@
 package msk
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/msk"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -150,40 +148,5 @@ func init() {
 			"aws_msk_cluster",
 		},
 		Base: msk.CheckEnableLogging,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			loggingBlock := resourceBlock.GetBlock("logging_info")
-			if loggingBlock.IsNil() {
-				results.Add("Resource does not have any broker logging enabled", resourceBlock)
-				return
-			}
-
-			brokerBlock := loggingBlock.GetBlock("broker_logs")
-			if brokerBlock.IsNil() {
-				results.Add("Resource does not have any broker logging enabled", loggingBlock)
-				return
-			}
-
-			if cloudwatchBlock := brokerBlock.GetBlock("cloudwatch_logs"); cloudwatchBlock.IsNotNil() {
-				if cloudwatchBlock.GetAttribute("enabled").IsTrue() {
-					return
-				}
-			}
-
-			if firehoseBlock := brokerBlock.GetBlock("firehose"); firehoseBlock.IsNotNil() {
-				if firehoseBlock.GetAttribute("enabled").IsTrue() {
-					return
-				}
-			}
-
-			if s3Block := brokerBlock.GetBlock("s3"); s3Block.IsNotNil() {
-				if s3Block.GetAttribute("enabled").IsTrue() {
-					return
-				}
-			}
-
-			results.Add("Resource does not have any broker logging enabled", brokerBlock)
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/rds/backup_retention_specified_rule.go b/internal/app/tfsec/rules/aws/rds/backup_retention_specified_rule.go
index 63cc33704..911ea1e16 100644
--- a/internal/app/tfsec/rules/aws/rds/backup_retention_specified_rule.go
+++ b/internal/app/tfsec/rules/aws/rds/backup_retention_specified_rule.go
@@ -1,9 +1,7 @@
 package rds
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/rds"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -69,22 +67,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_rds_cluster", "aws_db_instance"},
 		Base:           rds.CheckBackupRetentionSpecified,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if resourceBlock.HasChild("replicate_source_db") {
-				return
-			}
-
-			if resourceBlock.MissingChild("backup_retention_period") {
-				results.Add("Resource does not have backup retention explicitly set", resourceBlock)
-				return
-			}
-
-			retentionAttr := resourceBlock.GetAttribute("backup_retention_period")
-			if retentionAttr.LessThanOrEqualTo(1) {
-				results.Add("Resource has backup retention period set to a low value", retentionAttr)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/rds/enable_performance_insights_rule.go b/internal/app/tfsec/rules/aws/rds/enable_performance_insights_rule.go
index 38f83bb8f..ffd65839b 100644
--- a/internal/app/tfsec/rules/aws/rds/enable_performance_insights_rule.go
+++ b/internal/app/tfsec/rules/aws/rds/enable_performance_insights_rule.go
@@ -1,9 +1,7 @@
 package rds
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/rds"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -32,20 +30,5 @@ resource "aws_rds_cluster_instance" "good_example" {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_rds_cluster_instance", "aws_db_instance"},
 		Base:           rds.CheckEnablePerformanceInsights,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.HasChild("performance_insights_enabled") && resourceBlock.GetAttribute("performance_insights_enabled").IsTrue() {
-				if resourceBlock.MissingChild("performance_insights_kms_key_id") {
-					results.Add("Resource defines Performance Insights without encryption key specified.", resourceBlock)
-					return
-				}
-
-				if keyAttr := resourceBlock.GetAttribute("performance_insights_kms_key_id"); keyAttr.IsEmpty() {
-					results.Add("Resource defines Performance Insights without encryption key specified.", keyAttr)
-				}
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/rds/encrypt_cluster_storage_data_rule.go b/internal/app/tfsec/rules/aws/rds/encrypt_cluster_storage_data_rule.go
index 0e1f356cb..b80f52036 100644
--- a/internal/app/tfsec/rules/aws/rds/encrypt_cluster_storage_data_rule.go
+++ b/internal/app/tfsec/rules/aws/rds/encrypt_cluster_storage_data_rule.go
@@ -1,9 +1,7 @@
 package rds
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/rds"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -28,22 +26,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_rds_cluster"},
 		Base:           rds.CheckEncryptClusterStorageData,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			kmsKeyIdAttr := resourceBlock.GetAttribute("kms_key_id")
-			storageEncryptedAttr := resourceBlock.GetAttribute("storage_encrypted")
-
-			//nolint
-			if storageEncryptedAttr.IsNil() {
-				results.Add("Storage encryption is not enabled.", resourceBlock)
-			} else if storageEncryptedAttr.IsFalse() {
-				results.Add("Storage encryption is not enabled.", storageEncryptedAttr)
-			} else if kmsKeyIdAttr.IsNil() {
-				results.Add("Storage encryption does not use a customer-managed key.", resourceBlock)
-			} else if kmsKeyIdAttr.IsEmpty() {
-				results.Add("Storage encryption does not use a customer-managed key.", kmsKeyIdAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/rds/encrypt_instance_storage_data_rule.go b/internal/app/tfsec/rules/aws/rds/encrypt_instance_storage_data_rule.go
index 899121640..ee0b5b6ff 100644
--- a/internal/app/tfsec/rules/aws/rds/encrypt_instance_storage_data_rule.go
+++ b/internal/app/tfsec/rules/aws/rds/encrypt_instance_storage_data_rule.go
@@ -1,9 +1,7 @@
 package rds
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/rds"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -27,18 +25,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_db_instance"},
 		Base:           rds.CheckEncryptInstanceStorageData,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("storage_encrypted") {
-				results.Add("Resource has no storage encryption defined.", resourceBlock)
-				return
-			}
-
-			storageEncryptedAttr := resourceBlock.GetAttribute("storage_encrypted")
-			if storageEncryptedAttr.IsFalse() {
-				results.Add("Resource has storage encrypted set to false", storageEncryptedAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/rds/no_public_db_access_rule.go b/internal/app/tfsec/rules/aws/rds/no_public_db_access_rule.go
index d71ceb7d2..47c533a35 100644
--- a/internal/app/tfsec/rules/aws/rds/no_public_db_access_rule.go
+++ b/internal/app/tfsec/rules/aws/rds/no_public_db_access_rule.go
@@ -1,9 +1,7 @@
 package rds
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/rds"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -27,12 +25,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_db_instance", "aws_dms_replication_instance", "aws_rds_cluster_instance", "aws_redshift_cluster"},
 		Base:           rds.CheckNoPublicDbAccess,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			publicAttr := resourceBlock.GetAttribute("publicly_accessible")
-			if publicAttr.IsTrue() {
-				results.Add("Resource is exposed publicly.", publicAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/database/all_threat_alerts_enabled_rule.go b/internal/app/tfsec/rules/azure/database/all_threat_alerts_enabled_rule.go
index aea0804bf..ced2c65e0 100644
--- a/internal/app/tfsec/rules/azure/database/all_threat_alerts_enabled_rule.go
+++ b/internal/app/tfsec/rules/azure/database/all_threat_alerts_enabled_rule.go
@@ -1,9 +1,7 @@
 package database
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/database"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -11,6 +9,10 @@ import (
 func init() {
 	scanner.RegisterCheckRule(rule.Rule{
 		BadExample: []string{`
+ resource "azurerm_sql_server" "example" {
+	name                         = "mysqlserver"
+ }
+
  resource "azurerm_mssql_server_security_alert_policy" "bad_example" {
    resource_group_name        = azurerm_resource_group.example.name
    server_name                = azurerm_sql_server.example.name
@@ -25,6 +27,10 @@ func init() {
  }
  `},
 		GoodExample: []string{`
+ resource "azurerm_sql_server" "example" {
+	name                         = "mysqlserver"
+ }
+
  resource "azurerm_mssql_server_security_alert_policy" "good_example" {
    resource_group_name        = azurerm_resource_group.example.name
    server_name                = azurerm_sql_server.example.name
@@ -45,11 +51,5 @@ func init() {
 			"azurerm_mssql_server_security_alert_policy",
 		},
 		Base: database.CheckAllThreatAlertsEnabled,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if disabledAlertsAttr := resourceBlock.GetAttribute("disabled_alerts"); disabledAlertsAttr.IsNotEmpty() {
-				results.Add("Resource has attribute disabled_alerts that is not empty", disabledAlertsAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/database/enable_audit_rule.go b/internal/app/tfsec/rules/azure/database/enable_audit_rule.go
index adc4e33b2..ea4a7b40d 100644
--- a/internal/app/tfsec/rules/azure/database/enable_audit_rule.go
+++ b/internal/app/tfsec/rules/azure/database/enable_audit_rule.go
@@ -1,9 +1,7 @@
 package database
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/database"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -44,19 +42,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"azurerm_sql_server", "azurerm_mssql_server"},
 		Base:           database.CheckEnableAudit,
-		CheckTerraform: func(resourceBlock block.Block, module block.Module) (results rules.Results) {
-
-			if resourceBlock.HasChild("extended_auditing_policy") {
-				return
-			}
-
-			blocks := module.GetReferencingResources(resourceBlock, "azurerm_mssql_server_extended_auditing_policy", "server_id")
-			if len(blocks) > 0 {
-				return
-			}
-
-			results.Add("Resource does not have an extended audit policy configured.", resourceBlock)
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/database/enable_ssl_enforcement_rule.go b/internal/app/tfsec/rules/azure/database/enable_ssl_enforcement_rule.go
index 127245e9b..84be83339 100644
--- a/internal/app/tfsec/rules/azure/database/enable_ssl_enforcement_rule.go
+++ b/internal/app/tfsec/rules/azure/database/enable_ssl_enforcement_rule.go
@@ -1,9 +1,7 @@
 package database
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/database"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -36,18 +34,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"azurerm_mariadb_server", "azurerm_mysql_server", "azurerm_postgresql_server"},
 		Base:           database.CheckEnableSslEnforcement,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("ssl_enforcement_enabled") {
-				results.Add("Resource is missing the required ssl_enforcement_enabled attribute", resourceBlock)
-				return
-			}
-
-			sslEnforceAttr := resourceBlock.GetAttribute("ssl_enforcement_enabled")
-			if sslEnforceAttr.IsFalse() {
-				results.Add("Resource has ssl_enforcement_enabled disabled", sslEnforceAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/database/no_public_access_rule.go b/internal/app/tfsec/rules/azure/database/no_public_access_rule.go
index 2506e748f..544c14e6e 100644
--- a/internal/app/tfsec/rules/azure/database/no_public_access_rule.go
+++ b/internal/app/tfsec/rules/azure/database/no_public_access_rule.go
@@ -1,9 +1,7 @@
 package database
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/database"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -36,18 +34,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"azurerm_mariadb_server", "azurerm_mssql_server", "azurerm_mysql_server", "azurerm_postgresql_server"},
 		Base:           database.CheckNoPublicAccess,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("public_network_access_enabled") {
-				results.Add("Resource has default public network access of enabled", resourceBlock)
-				return
-			}
-
-			publicAccessAttr := resourceBlock.GetAttribute("public_network_access_enabled")
-			if publicAccessAttr.IsTrue() {
-				results.Add("Resource has public access explicitly enabled", publicAccessAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/database/no_public_firewall_access_rule.go b/internal/app/tfsec/rules/azure/database/no_public_firewall_access_rule.go
index e08991678..ce6a18063 100644
--- a/internal/app/tfsec/rules/azure/database/no_public_firewall_access_rule.go
+++ b/internal/app/tfsec/rules/azure/database/no_public_firewall_access_rule.go
@@ -1,9 +1,7 @@
 package database
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/database"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -47,19 +45,5 @@ func init() {
 			"azurerm_mariadb_firewall_rule",
 		},
 		Base: database.CheckNoPublicFirewallAccess,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("start_ip_address") || resourceBlock.MissingChild("end_ip_address") {
-				return
-			}
-
-			sourceIpAttr := resourceBlock.GetAttribute("start_ip_address")
-			endIpAttr := resourceBlock.GetAttribute("end_ip_address")
-			if sourceIpAttr.Equals("0.0.0.0") && endIpAttr.NotEqual("0.0.0.0") {
-				results.Add("Resource has an open IP range set.", sourceIpAttr)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/database/postgres_configuration_log_checkpoints_rule.go b/internal/app/tfsec/rules/azure/database/postgres_configuration_log_checkpoints_rule.go
index 2c49d1f44..eb77cb3c5 100644
--- a/internal/app/tfsec/rules/azure/database/postgres_configuration_log_checkpoints_rule.go
+++ b/internal/app/tfsec/rules/azure/database/postgres_configuration_log_checkpoints_rule.go
@@ -1,9 +1,7 @@
 package database
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/database"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -66,17 +64,5 @@ func init() {
 			"azurerm_postgresql_server",
 		},
 		Base: database.CheckPostgresConfigurationLogCheckpoints,
-		CheckTerraform: func(resourceBlock block.Block, module block.Module) (results rules.Results) {
-			referencingBlocks := module.GetReferencingResources(resourceBlock, "azurerm_postgresql_configuration", "server_name")
-			for _, refBlock := range referencingBlocks {
-				if nameAttr := refBlock.GetAttribute("name"); nameAttr.IsNotNil() && nameAttr.Equals("log_checkpoints") {
-					if valAttr := refBlock.GetAttribute("value"); valAttr.IsNotNil() && valAttr.Equals("on", block.IgnoreCase) {
-						return
-					}
-				}
-			}
-			results.Add("Resource does not have a corresponding log configuration enabling 'log_checkpoints'", resourceBlock)
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/database/postgres_configuration_log_connection_throttling_rule.go b/internal/app/tfsec/rules/azure/database/postgres_configuration_log_connection_throttling_rule.go
index 6c5d0b460..83e0de4c6 100644
--- a/internal/app/tfsec/rules/azure/database/postgres_configuration_log_connection_throttling_rule.go
+++ b/internal/app/tfsec/rules/azure/database/postgres_configuration_log_connection_throttling_rule.go
@@ -1,9 +1,7 @@
 package database
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/database"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -66,17 +64,5 @@ func init() {
 			"azurerm_postgresql_server",
 		},
 		Base: database.CheckPostgresConfigurationLogConnectionThrottling,
-		CheckTerraform: func(resourceBlock block.Block, module block.Module) (results rules.Results) {
-			referencingBlocks := module.GetReferencingResources(resourceBlock, "azurerm_postgresql_configuration", "server_name")
-			for _, refBlock := range referencingBlocks {
-				if nameAttr := refBlock.GetAttribute("name"); nameAttr.IsNotNil() && nameAttr.Equals("connection_throttling") {
-					if valAttr := refBlock.GetAttribute("value"); valAttr.IsNotNil() && valAttr.Equals("on", block.IgnoreCase) {
-						return
-					}
-				}
-			}
-			results.Add("Resource does not have a corresponding log configuration enabling 'connection_throttling'", resourceBlock)
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/database/postgres_configuration_log_connections_rule.go b/internal/app/tfsec/rules/azure/database/postgres_configuration_log_connections_rule.go
index 62415cf22..497aed4f6 100644
--- a/internal/app/tfsec/rules/azure/database/postgres_configuration_log_connections_rule.go
+++ b/internal/app/tfsec/rules/azure/database/postgres_configuration_log_connections_rule.go
@@ -1,9 +1,7 @@
 package database
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/database"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -66,17 +64,5 @@ func init() {
 			"azurerm_postgresql_server",
 		},
 		Base: database.CheckPostgresConfigurationLogConnections,
-		CheckTerraform: func(resourceBlock block.Block, module block.Module) (results rules.Results) {
-			referencingBlocks := module.GetReferencingResources(resourceBlock, "azurerm_postgresql_configuration", "server_name")
-			for _, refBlock := range referencingBlocks {
-				if nameAttr := refBlock.GetAttribute("name"); nameAttr.IsNotNil() && nameAttr.Equals("log_connections") {
-					if valAttr := refBlock.GetAttribute("value"); valAttr.IsNotNil() && valAttr.Equals("on", block.IgnoreCase) {
-						return
-					}
-				}
-			}
-			results.Add("Resource does not have a corresponding log configuration enabling 'log_connections'", resourceBlock)
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/database/retention_period_set_rule.go b/internal/app/tfsec/rules/azure/database/retention_period_set_rule.go
index 485ac0098..35846ff92 100644
--- a/internal/app/tfsec/rules/azure/database/retention_period_set_rule.go
+++ b/internal/app/tfsec/rules/azure/database/retention_period_set_rule.go
@@ -1,9 +1,7 @@
 package database
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/database"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -43,29 +41,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"azurerm_sql_server", "azurerm_sql_server", "azurerm_mssql_database_extended_auditing_policy"},
 		Base:           database.CheckRetentionPeriodSet,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if !resourceBlock.IsResourceType("azurerm_mssql_database_extended_auditing_policy") {
-				if resourceBlock.MissingChild("extended_auditing_policy") {
-					return
-				}
-				resourceBlock = resourceBlock.GetBlock("extended_auditing_policy")
-			}
-
-			if resourceBlock.MissingChild("retention_in_days") {
-				// using default of unlimited
-				return
-			}
-
-			if resourceBlock.GetAttribute("retention_in_days").Equals(0) {
-				// using explicit unlimited
-				return
-			}
-
-			if resourceBlock.GetAttribute("retention_in_days").LessThan(90) {
-				results.Add("Resource specifies a retention period of less than 90 days.", resourceBlock)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/database/secure_tls_policy_rule.go b/internal/app/tfsec/rules/azure/database/secure_tls_policy_rule.go
index 24fb9e159..1b37a187b 100644
--- a/internal/app/tfsec/rules/azure/database/secure_tls_policy_rule.go
+++ b/internal/app/tfsec/rules/azure/database/secure_tls_policy_rule.go
@@ -1,11 +1,7 @@
 package database
 
 import (
-	"fmt"
-
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/database"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -58,34 +54,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"azurerm_mssql_server", "azurerm_mysql_server", "azurerm_postgresql_server"},
 		Base:           database.CheckSecureTlsPolicy,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			var attribute string
-			var requiredValue string
-
-			switch resourceBlock.TypeLabel() {
-			case "azurerm_mssql_server":
-				attribute = "minimum_tls_version"
-				requiredValue = "1.2"
-			case "azurerm_postgresql_server", "azurerm_mysql_server":
-				attribute = "ssl_minimal_tls_version_enforced"
-				requiredValue = "TLS1_2"
-			}
-
-			if resourceBlock.MissingChild(attribute) {
-				if resourceBlock.TypeLabel() == "azurerm_mssql_server" {
-					return
-				}
-
-				results.Add(fmt.Sprintf("Resource does not have '%s' set", attribute), resourceBlock)
-				return
-			}
-
-			tlsMinimumAttr := resourceBlock.GetAttribute(attribute)
-			if tlsMinimumAttr.NotEqual(requiredValue) {
-				results.Add(fmt.Sprintf("Resource does not have a minimum TLS policy of '%s'", requiredValue), tlsMinimumAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/database/threat_alert_email_set_rule.go b/internal/app/tfsec/rules/azure/database/threat_alert_email_set_rule.go
index 9e699455e..51438279f 100644
--- a/internal/app/tfsec/rules/azure/database/threat_alert_email_set_rule.go
+++ b/internal/app/tfsec/rules/azure/database/threat_alert_email_set_rule.go
@@ -1,9 +1,7 @@
 package database
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/database"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -11,6 +9,10 @@ import (
 func init() {
 	scanner.RegisterCheckRule(rule.Rule{
 		BadExample: []string{`
+ resource "azurerm_sql_server" "example" {
+   name                         = "mysqlserver"
+ }
+
  resource "azurerm_mssql_server_security_alert_policy" "bad_example" {
    resource_group_name        = azurerm_resource_group.example.name
    server_name                = azurerm_sql_server.example.name
@@ -25,6 +27,10 @@ func init() {
  }
  `},
 		GoodExample: []string{`
+ resource "azurerm_sql_server" "example" {
+	name                         = "mysqlserver"
+ }
+
  resource "azurerm_mssql_server_security_alert_policy" "good_example" {
    resource_group_name        = azurerm_resource_group.example.name
    server_name                = azurerm_sql_server.example.name
@@ -48,11 +54,5 @@ func init() {
 			"azurerm_mssql_server_security_alert_policy",
 		},
 		Base: database.CheckThreatAlertEmailSet,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if emailAddressesAttr := resourceBlock.GetAttribute("email_addresses"); emailAddressesAttr.IsNil() || emailAddressesAttr.IsEmpty() {
-				results.Add("Resource does not specified emails_addresses for alerts", resourceBlock)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/database/threat_alert_email_to_owner_rule.go b/internal/app/tfsec/rules/azure/database/threat_alert_email_to_owner_rule.go
index 0f8bdb2f9..416ce13ec 100644
--- a/internal/app/tfsec/rules/azure/database/threat_alert_email_to_owner_rule.go
+++ b/internal/app/tfsec/rules/azure/database/threat_alert_email_to_owner_rule.go
@@ -1,9 +1,7 @@
 package database
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/database"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -11,6 +9,10 @@ import (
 func init() {
 	scanner.RegisterCheckRule(rule.Rule{
 		BadExample: []string{`
+ resource "azurerm_sql_server" "example" {
+	name                         = "mysqlserver"
+ }
+
  resource "azurerm_mssql_server_security_alert_policy" "bad_example" {
    resource_group_name        = azurerm_resource_group.example.name
    server_name                = azurerm_sql_server.example.name
@@ -23,6 +25,10 @@ func init() {
  }
  `},
 		GoodExample: []string{`
+ resource "azurerm_sql_server" "example" {
+	name                         = "mysqlserver"
+ }
+
  resource "azurerm_mssql_server_security_alert_policy" "good_example" {
    resource_group_name        = azurerm_resource_group.example.name
    server_name                = azurerm_sql_server.example.name
@@ -44,13 +50,5 @@ func init() {
 			"azurerm_mssql_server_security_alert_policy",
 		},
 		Base: database.CheckThreatAlertEmailToOwner,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if emailAccountAdminsAttr := resourceBlock.GetAttribute("email_account_admins"); emailAccountAdminsAttr.IsNil() { // alert on use of default value
-				results.Add("Resource uses default value for email_account_admins", resourceBlock)
-			} else if emailAccountAdminsAttr.IsFalse() {
-				results.Add("Resource has attribute email_account_admins that is false", emailAccountAdminsAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/network/disable_rdp_from_internet_rule.go b/internal/app/tfsec/rules/azure/network/disable_rdp_from_internet_rule.go
index 7e0c2a706..378279cad 100644
--- a/internal/app/tfsec/rules/azure/network/disable_rdp_from_internet_rule.go
+++ b/internal/app/tfsec/rules/azure/network/disable_rdp_from_internet_rule.go
@@ -1,9 +1,7 @@
 package network
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/network"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -21,6 +19,7 @@ func init() {
       destination_port_range      = ["3389"]
       source_address_prefix       = "*"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  
  resource "azurerm_network_security_group" "example" {
@@ -46,6 +45,7 @@ func init() {
       destination_port_range      = ["3389"]
       source_address_prefix       = "4.53.160.75"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  
  resource "azurerm_network_security_group" "example" {
@@ -68,29 +68,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"azurerm_network_security_group", "azurerm_network_security_rule"},
 		Base:           network.CheckDisableRdpFromInternet,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			var securityRules block.Blocks
-			if resourceBlock.IsResourceType("azurerm_network_security_group") {
-				securityRules = resourceBlock.GetBlocks("security_rule")
-			} else {
-				securityRules = append(securityRules, resourceBlock)
-			}
-
-			for _, securityRule := range securityRules {
-				if securityRule.HasChild("access") && securityRule.GetAttribute("access").Equals("Deny", block.IgnoreCase) {
-					continue
-				}
-				if securityRule.HasChild("destination_port_range") && securityRule.GetAttribute("destination_port_range").Contains("3389") {
-					if securityRule.HasChild("source_address_prefix") {
-						sourceAddrAttr := securityRule.GetAttribute("source_address_prefix")
-						if sourceAddrAttr.IsAny("*", "0.0.0.0", "/0", "internet", "any") {
-							results.Add("Resource has a source address prefix of *, 0.0.0.0, /0, internet or an any. Consider using the Azure Bastion Service.", sourceAddrAttr)
-						}
-					}
-				}
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/network/no_public_egress_rule.go b/internal/app/tfsec/rules/azure/network/no_public_egress_rule.go
index 814ec132d..5bc9f1c50 100644
--- a/internal/app/tfsec/rules/azure/network/no_public_egress_rule.go
+++ b/internal/app/tfsec/rules/azure/network/no_public_egress_rule.go
@@ -1,32 +1,35 @@
 package network
 
 import (
-	"fmt"
-	"strings"
-
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/network"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/cidr"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
-	"github.com/zclconf/go-cty/cty"
 )
 
 func init() {
 	scanner.RegisterCheckRule(rule.Rule{
 		LegacyID: "AZU002",
 		BadExample: []string{`
+ resource "azurerm_network_security_group" "example" {
+	name                = "acceptanceTestSecurityGroup1"
+ }
+
  resource "azurerm_network_security_rule" "bad_example" {
  	direction = "Outbound"
  	destination_address_prefix = "0.0.0.0/0"
  	access = "Allow"
+	 network_security_group_name = azurerm_network_security_group.example.name
  }`},
 		GoodExample: []string{`
+ resource "azurerm_network_security_group" "example" {
+	name                = "acceptanceTestSecurityGroup1"
+ }
+
  resource "azurerm_network_security_rule" "good_example" {
  	direction = "Outbound"
  	destination_address_prefix = "10.0.0.0/16"
  	access = "Allow"
+	network_security_group_name = azurerm_network_security_group.example.name
  }`},
 		Links: []string{
 			"https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule",
@@ -34,30 +37,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"azurerm_network_security_rule"},
 		Base:           network.CheckNoPublicEgress,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			directionAttr := resourceBlock.GetAttribute("direction")
-			if directionAttr.IsNil() || directionAttr.Type() != cty.String || strings.ToUpper(directionAttr.Value().AsString()) != "OUTBOUND" {
-				return
-			}
-
-			if prefixAttr := resourceBlock.GetAttribute("destination_address_prefix"); prefixAttr.IsString() {
-				if cidr.IsAttributeOpen(prefixAttr) {
-					if accessAttr := resourceBlock.GetAttribute("access"); accessAttr.IsNotNil() && strings.ToUpper(accessAttr.Value().AsString()) == "ALLOW" {
-						results.Add(fmt.Sprintf("Resource defines a fully open %s network security group rule.", strings.ToLower(directionAttr.Value().AsString())), accessAttr)
-					}
-				}
-			}
-
-			if prefixesAttr := resourceBlock.GetAttribute("destination_address_prefixes"); !prefixesAttr.IsEmpty() {
-				if cidr.IsAttributeOpen(prefixesAttr) {
-					if accessAttr := resourceBlock.GetAttribute("access"); accessAttr.IsNotNil() && strings.ToUpper(accessAttr.Value().AsString()) == "ALLOW" {
-						results.Add("Resource defines a fully open security group rule.", accessAttr)
-					}
-				}
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/network/no_public_ingress_rule.go b/internal/app/tfsec/rules/azure/network/no_public_ingress_rule.go
index 4d13d1e3f..1596fddd5 100644
--- a/internal/app/tfsec/rules/azure/network/no_public_ingress_rule.go
+++ b/internal/app/tfsec/rules/azure/network/no_public_ingress_rule.go
@@ -1,13 +1,7 @@
 package network
 
 import (
-	"fmt"
-	"strings"
-
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/network"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/cidr"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -16,16 +10,26 @@ func init() {
 	scanner.RegisterCheckRule(rule.Rule{
 		LegacyID: "AZU001",
 		BadExample: []string{`
+ resource "azurerm_network_security_group" "example" {
+	name                = "acceptanceTestSecurityGroup1"
+ }
+
  resource "azurerm_network_security_rule" "bad_example" {
  	direction = "Inbound"
  	source_address_prefix = "0.0.0.0/0"
  	access = "Allow"
+	network_security_group_name = azurerm_network_security_group.example.name
  }`},
 		GoodExample: []string{`
+ resource "azurerm_network_security_group" "example" {
+	name                = "acceptanceTestSecurityGroup1"
+ }
+
  resource "azurerm_network_security_rule" "good_example" {
  	direction = "Inbound"
  	destination_address_prefix = "10.0.0.0/16"
  	access = "Allow"
+	network_security_group_name = azurerm_network_security_group.example.name
  }`},
 		Links: []string{
 			"https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule",
@@ -33,30 +37,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"azurerm_network_security_rule"},
 		Base:           network.CheckNoPublicIngress,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			directionAttr := resourceBlock.GetAttribute("direction")
-			if directionAttr.NotEqual("INBOUND", block.IgnoreCase) {
-				return
-			}
-
-			if prefixAttr := resourceBlock.GetAttribute("source_address_prefix"); prefixAttr.IsString() {
-				if cidr.IsAttributeOpen(prefixAttr) {
-					if accessAttr := resourceBlock.GetAttribute("access"); accessAttr.Equals("ALLOW", block.IgnoreCase) {
-						results.Add(fmt.Sprintf("Resource defines a fully open %s network security group rule.", strings.ToLower(directionAttr.Value().AsString())), accessAttr)
-					}
-				}
-			}
-
-			if prefixesAttr := resourceBlock.GetAttribute("source_address_prefixes"); !prefixesAttr.IsEmpty() {
-				if cidr.IsAttributeOpen(prefixesAttr) {
-					if accessAttr := resourceBlock.GetAttribute("access"); accessAttr.Equals("ALLOW", block.IgnoreCase) {
-						results.Add("Resource defines a fully open security group rule.", accessAttr)
-					}
-				}
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/network/retention_policy_set_rule.go b/internal/app/tfsec/rules/azure/network/retention_policy_set_rule.go
index 0f7fc65b6..1b07a2e6b 100644
--- a/internal/app/tfsec/rules/azure/network/retention_policy_set_rule.go
+++ b/internal/app/tfsec/rules/azure/network/retention_policy_set_rule.go
@@ -1,9 +1,7 @@
 package network
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/network"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -36,7 +34,7 @@ resource "azurerm_network_watcher_flow_log" "good_watcher" {
 
 	retention_policy {
 		enabled = true
-		days = 90
+		days = 365
 	}
 }
 	`},
@@ -46,30 +44,5 @@ resource "azurerm_network_watcher_flow_log" "good_watcher" {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"azurerm_network_watcher_flow_log"},
 		Base:           network.CheckRetentionPolicySet,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("retention_policy") {
-				results.Add("Resource is missing the required retention policy block", resourceBlock)
-				return
-			}
-
-			retentionPolicyBlock := resourceBlock.GetBlock("retention_policy")
-			if retentionPolicyBlock.MissingChild("enabled") || retentionPolicyBlock.MissingChild("days") {
-				results.Add("Resource is missing the required attributes retention policy block", retentionPolicyBlock)
-				return
-			}
-
-			enabledAttr := retentionPolicyBlock.GetAttribute("enabled")
-			daysAttr := retentionPolicyBlock.GetAttribute("days")
-
-			if enabledAttr.IsFalse() {
-				results.Add("Resource has retention policy turned off", enabledAttr)
-			}
-
-			if daysAttr.LessThan(90) {
-				results.Add("Resource has retention policy period of less than 90 days", daysAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/network/ssh_blocked_from_internet_rule.go b/internal/app/tfsec/rules/azure/network/ssh_blocked_from_internet_rule.go
index c769d8ac2..55ab49c78 100644
--- a/internal/app/tfsec/rules/azure/network/ssh_blocked_from_internet_rule.go
+++ b/internal/app/tfsec/rules/azure/network/ssh_blocked_from_internet_rule.go
@@ -1,9 +1,7 @@
 package network
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/network"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -21,6 +19,7 @@ func init() {
       destination_port_range      = ["22"]
       source_address_prefix       = "*"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  
  resource "azurerm_network_security_group" "example" {
@@ -46,6 +45,7 @@ func init() {
       destination_port_range      = ["22"]
       source_address_prefix       = "82.102.23.23"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  
  resource "azurerm_network_security_group" "example" {
@@ -68,28 +68,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"azurerm_network_security_group", "azurerm_network_security_rule"},
 		Base:           network.CheckSshBlockedFromInternet,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			var securityRules block.Blocks
-			if resourceBlock.IsResourceType("azurerm_network_security_group") {
-				securityRules = resourceBlock.GetBlocks("security_rule")
-			} else {
-				securityRules = append(securityRules, resourceBlock)
-			}
-
-			for _, securityRule := range securityRules {
-				if securityRule.HasChild("access") && securityRule.GetAttribute("access").Equals("Deny", block.IgnoreCase) {
-					continue
-				}
-				if securityRule.HasChild("destination_port_range") && securityRule.GetAttribute("destination_port_range").Contains("22") {
-					if securityRule.HasChild("source_address_prefix") {
-						if securityRule.GetAttribute("source_address_prefix").IsAny("*", "0.0.0.0", "/0", "internet", "any") {
-							results.Add("Resource has a .", securityRule)
-						}
-					}
-				}
-			}
-			return results
-		},
 	})
 }
diff --git a/vendor/github.com/aquasecurity/defsec/cidr/cidr.go b/vendor/github.com/aquasecurity/defsec/cidr/cidr.go
index 7a45b7b0c..6b02cbcf7 100644
--- a/vendor/github.com/aquasecurity/defsec/cidr/cidr.go
+++ b/vendor/github.com/aquasecurity/defsec/cidr/cidr.go
@@ -41,6 +41,9 @@ func isPrivate(ip net.IP) bool {
 // overflows an unsigned 64-bit int, the maximum value of an unsigned 64-bit int will be
 // returned.
 func CountAddresses(inputCIDR string) uint64 {
+	if inputCIDR == "*" || inputCIDR == "internet" || inputCIDR == "any" {
+		return 0xffffffffffffffff
+	}
 	if !strings.Contains(inputCIDR, "/") {
 		ip := net.ParseIP(inputCIDR)
 		if ip == nil {
diff --git a/vendor/github.com/aquasecurity/defsec/provider/aws/rds/rds.go b/vendor/github.com/aquasecurity/defsec/provider/aws/rds/rds.go
index 834b7d752..e79429b62 100644
--- a/vendor/github.com/aquasecurity/defsec/provider/aws/rds/rds.go
+++ b/vendor/github.com/aquasecurity/defsec/provider/aws/rds/rds.go
@@ -31,7 +31,10 @@ type Instance struct {
 	PublicAccess              types.BoolValue
 }
 
-type ClusterInstance Instance
+type ClusterInstance struct {
+	Instance
+	ClusterIdentifier types.StringValue
+}
 
 type PerformanceInsights struct {
 	Enabled  types.BoolValue
diff --git a/vendor/github.com/aquasecurity/defsec/rules/aws/rds/enable_performance_insights.go b/vendor/github.com/aquasecurity/defsec/rules/aws/rds/enable_performance_insights.go
index 9f1fd779f..7d3cbacea 100644
--- a/vendor/github.com/aquasecurity/defsec/rules/aws/rds/enable_performance_insights.go
+++ b/vendor/github.com/aquasecurity/defsec/rules/aws/rds/enable_performance_insights.go
@@ -22,39 +22,44 @@ The encryption key specified in ` + "`" + `performance_insights_kms_key_id` + "`
 		Links: []string{
 			"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.htm",
 		},
-		Terraform:   &rules.EngineMetadata{
-            GoodExamples:        terraformEnablePerformanceInsightsGoodExamples,
-            BadExamples:         terraformEnablePerformanceInsightsBadExamples,
-            Links:               terraformEnablePerformanceInsightsLinks,
-            RemediationMarkdown: terraformEnablePerformanceInsightsRemediationMarkdown,
-        },
-        CloudFormation:   &rules.EngineMetadata{
-            GoodExamples:        cloudFormationEnablePerformanceInsightsGoodExamples,
-            BadExamples:         cloudFormationEnablePerformanceInsightsBadExamples,
-            Links:               cloudFormationEnablePerformanceInsightsLinks,
-            RemediationMarkdown: cloudFormationEnablePerformanceInsightsRemediationMarkdown,
-        },
-        Severity: severity.High,
+		Terraform: &rules.EngineMetadata{
+			GoodExamples:        terraformEnablePerformanceInsightsGoodExamples,
+			BadExamples:         terraformEnablePerformanceInsightsBadExamples,
+			Links:               terraformEnablePerformanceInsightsLinks,
+			RemediationMarkdown: terraformEnablePerformanceInsightsRemediationMarkdown,
+		},
+		CloudFormation: &rules.EngineMetadata{
+			GoodExamples:        cloudFormationEnablePerformanceInsightsGoodExamples,
+			BadExamples:         cloudFormationEnablePerformanceInsightsBadExamples,
+			Links:               cloudFormationEnablePerformanceInsightsLinks,
+			RemediationMarkdown: cloudFormationEnablePerformanceInsightsRemediationMarkdown,
+		},
+		Severity: severity.High,
 	},
 	func(s *state.State) (results rules.Results) {
 		for _, cluster := range s.AWS.RDS.Clusters {
 			if !cluster.IsManaged() {
 				continue
 			}
-			if cluster.PerformanceInsights.Enabled.IsFalse() {
-				results.Add(
-					"Cluster does not have performance insights enabled.",
-					&cluster,
-					cluster.PerformanceInsights.Enabled,
-				)
-			} else if cluster.PerformanceInsights.KMSKeyID.IsEmpty() {
-				results.Add(
-					"Cluster has performance insights enabled without encryption.",
-					&cluster,
-					cluster.PerformanceInsights.KMSKeyID,
-				)
-			} else {
-				results.AddPassed(&cluster)
+			for _, instance := range cluster.Instances {
+				if !instance.IsManaged() {
+					continue
+				}
+				if instance.PerformanceInsights.Enabled.IsFalse() {
+					results.Add(
+						"Instance does not have performance insights enabled.",
+						&instance,
+						instance.PerformanceInsights.Enabled,
+					)
+				} else if instance.PerformanceInsights.KMSKeyID.IsEmpty() {
+					results.Add(
+						"Instance has performance insights enabled without encryption.",
+						&instance,
+						instance.PerformanceInsights.KMSKeyID,
+					)
+				} else {
+					results.AddPassed(&instance)
+				}
 			}
 		}
 		for _, instance := range s.AWS.RDS.Instances {
diff --git a/vendor/github.com/aquasecurity/defsec/rules/aws/rds/specify_backup_retention.go b/vendor/github.com/aquasecurity/defsec/rules/aws/rds/specify_backup_retention.go
index 410080257..4f4546030 100644
--- a/vendor/github.com/aquasecurity/defsec/rules/aws/rds/specify_backup_retention.go
+++ b/vendor/github.com/aquasecurity/defsec/rules/aws/rds/specify_backup_retention.go
@@ -20,19 +20,19 @@ var CheckBackupRetentionSpecified = rules.Register(
 		Links: []string{
 			"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html#USER_WorkingWithAutomatedBackups.BackupRetention",
 		},
-		Terraform:   &rules.EngineMetadata{
-            GoodExamples:        terraformSpecifyBackupRetentionGoodExamples,
-            BadExamples:         terraformSpecifyBackupRetentionBadExamples,
-            Links:               terraformSpecifyBackupRetentionLinks,
-            RemediationMarkdown: terraformSpecifyBackupRetentionRemediationMarkdown,
-        },
-        CloudFormation:   &rules.EngineMetadata{
-            GoodExamples:        cloudFormationSpecifyBackupRetentionGoodExamples,
-            BadExamples:         cloudFormationSpecifyBackupRetentionBadExamples,
-            Links:               cloudFormationSpecifyBackupRetentionLinks,
-            RemediationMarkdown: cloudFormationSpecifyBackupRetentionRemediationMarkdown,
-        },
-        Severity: severity.Medium,
+		Terraform: &rules.EngineMetadata{
+			GoodExamples:        terraformSpecifyBackupRetentionGoodExamples,
+			BadExamples:         terraformSpecifyBackupRetentionBadExamples,
+			Links:               terraformSpecifyBackupRetentionLinks,
+			RemediationMarkdown: terraformSpecifyBackupRetentionRemediationMarkdown,
+		},
+		CloudFormation: &rules.EngineMetadata{
+			GoodExamples:        cloudFormationSpecifyBackupRetentionGoodExamples,
+			BadExamples:         cloudFormationSpecifyBackupRetentionBadExamples,
+			Links:               cloudFormationSpecifyBackupRetentionLinks,
+			RemediationMarkdown: cloudFormationSpecifyBackupRetentionRemediationMarkdown,
+		},
+		Severity: severity.Medium,
 	},
 	func(s *state.State) (results rules.Results) {
 		for _, cluster := range s.AWS.RDS.Clusters {
@@ -53,6 +53,9 @@ var CheckBackupRetentionSpecified = rules.Register(
 			}
 		}
 		for _, instance := range s.AWS.RDS.Instances {
+			if !instance.ReplicationSourceARN.IsEmpty() {
+				continue
+			}
 			if !instance.IsManaged() {
 				continue
 			}
diff --git a/vendor/github.com/aquasecurity/defsec/rules/azure/database/secure_tls_policy.go b/vendor/github.com/aquasecurity/defsec/rules/azure/database/secure_tls_policy.go
index 83be70439..b679f60c4 100644
--- a/vendor/github.com/aquasecurity/defsec/rules/azure/database/secure_tls_policy.go
+++ b/vendor/github.com/aquasecurity/defsec/rules/azure/database/secure_tls_policy.go
@@ -18,16 +18,16 @@ var CheckSecureTlsPolicy = rules.Register(
 		Resolution:  "Use the most modern TLS policies available",
 		Explanation: `You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.`,
 		Links:       []string{},
-		Terraform:   &rules.EngineMetadata{
-            GoodExamples:        terraformSecureTlsPolicyGoodExamples,
-            BadExamples:         terraformSecureTlsPolicyBadExamples,
-            Links:               terraformSecureTlsPolicyLinks,
-            RemediationMarkdown: terraformSecureTlsPolicyRemediationMarkdown,
-        },
-        Severity:    severity.Medium,
+		Terraform: &rules.EngineMetadata{
+			GoodExamples:        terraformSecureTlsPolicyGoodExamples,
+			BadExamples:         terraformSecureTlsPolicyBadExamples,
+			Links:               terraformSecureTlsPolicyLinks,
+			RemediationMarkdown: terraformSecureTlsPolicyRemediationMarkdown,
+		},
+		Severity: severity.Medium,
 	},
 	func(s *state.State) (results rules.Results) {
-		for _, server := range s.Azure.Database.MariaDBServers {
+		for _, server := range s.Azure.Database.MSSQLServers {
 			if server.MinimumTLSVersion.NotEqualTo("1.2") {
 				results.Add(
 					"Database server does not require a secure TLS version.",
@@ -35,6 +35,22 @@ var CheckSecureTlsPolicy = rules.Register(
 				)
 			}
 		}
+		for _, server := range s.Azure.Database.MySQLServers {
+			if server.MinimumTLSVersion.NotEqualTo("TLS1_2") {
+				results.Add(
+					"Database server does not require a secure TLS version.",
+					server.MinimumTLSVersion,
+				)
+			}
+		}
+		for _, server := range s.Azure.Database.PostgreSQLServers {
+			if server.MinimumTLSVersion.NotEqualTo("TLS1_2") {
+				results.Add(
+					"Database server does not require a secure TLS version.",
+					server.MinimumTLSVersion,
+				)
+			}
+		}
 		return
 	},
 )
diff --git a/vendor/github.com/aquasecurity/defsec/rules/azure/network/disable_rdp_from_internet.go b/vendor/github.com/aquasecurity/defsec/rules/azure/network/disable_rdp_from_internet.go
index b08a42964..37d2cee4e 100644
--- a/vendor/github.com/aquasecurity/defsec/rules/azure/network/disable_rdp_from_internet.go
+++ b/vendor/github.com/aquasecurity/defsec/rules/azure/network/disable_rdp_from_internet.go
@@ -26,13 +26,13 @@ RDP access should not be permitted from the internet (*, 0.0.0.0, /0, internet,
 		Links: []string{
 			"https://docs.microsoft.com/en-us/azure/bastion/tutorial-create-host-portal",
 		},
-		Terraform:   &rules.EngineMetadata{
-            GoodExamples:        terraformDisableRdpFromInternetGoodExamples,
-            BadExamples:         terraformDisableRdpFromInternetBadExamples,
-            Links:               terraformDisableRdpFromInternetLinks,
-            RemediationMarkdown: terraformDisableRdpFromInternetRemediationMarkdown,
-        },
-        Severity: severity.Critical,
+		Terraform: &rules.EngineMetadata{
+			GoodExamples:        terraformDisableRdpFromInternetGoodExamples,
+			BadExamples:         terraformDisableRdpFromInternetBadExamples,
+			Links:               terraformDisableRdpFromInternetLinks,
+			RemediationMarkdown: terraformDisableRdpFromInternetRemediationMarkdown,
+		},
+		Severity: severity.Critical,
 	},
 	func(s *state.State) (results rules.Results) {
 		for _, group := range s.Azure.Network.SecurityGroups {
@@ -40,9 +40,9 @@ RDP access should not be permitted from the internet (*, 0.0.0.0, /0, internet,
 				for _, ports := range rule.DestinationPortRanges {
 					if portRangeContains(ports.Value(), 3389) {
 						for _, ip := range rule.SourceAddresses {
-							if cidr.IsPublic(ip.Value()) {
+							if cidr.IsPublic(ip.Value()) && cidr.CountAddresses(ip.Value()) > 1 {
 								results.Add(
-									"Security group rule allows ingress to RDP port from public internet.",
+									"Security group rule allows ingress to RDP port from multiple public internet addresses.",
 									ip,
 								)
 							}
diff --git a/vendor/github.com/aquasecurity/defsec/rules/azure/network/ssh_blocked_from_internet.go b/vendor/github.com/aquasecurity/defsec/rules/azure/network/ssh_blocked_from_internet.go
index bab93ebfc..acf52c4b2 100644
--- a/vendor/github.com/aquasecurity/defsec/rules/azure/network/ssh_blocked_from_internet.go
+++ b/vendor/github.com/aquasecurity/defsec/rules/azure/network/ssh_blocked_from_internet.go
@@ -20,14 +20,14 @@ var CheckSshBlockedFromInternet = rules.Register(
 		Explanation: `SSH access can be configured on either the network security group or in the network security group rule. 
 
 SSH access should not be permitted from the internet (*, 0.0.0.0, /0, internet, any)`,
-		Links:    []string{},
-		Terraform:   &rules.EngineMetadata{
-            GoodExamples:        terraformSshBlockedFromInternetGoodExamples,
-            BadExamples:         terraformSshBlockedFromInternetBadExamples,
-            Links:               terraformSshBlockedFromInternetLinks,
-            RemediationMarkdown: terraformSshBlockedFromInternetRemediationMarkdown,
-        },
-        Severity: severity.Critical,
+		Links: []string{},
+		Terraform: &rules.EngineMetadata{
+			GoodExamples:        terraformSshBlockedFromInternetGoodExamples,
+			BadExamples:         terraformSshBlockedFromInternetBadExamples,
+			Links:               terraformSshBlockedFromInternetLinks,
+			RemediationMarkdown: terraformSshBlockedFromInternetRemediationMarkdown,
+		},
+		Severity: severity.Critical,
 	},
 	func(s *state.State) (results rules.Results) {
 		for _, group := range s.Azure.Network.SecurityGroups {
@@ -35,9 +35,9 @@ SSH access should not be permitted from the internet (*, 0.0.0.0, /0, internet,
 				for _, ports := range rule.DestinationPortRanges {
 					if portRangeContains(ports.Value(), 22) {
 						for _, ip := range rule.SourceAddresses {
-							if cidr.IsPublic(ip.Value()) {
+							if cidr.IsPublic(ip.Value()) && cidr.CountAddresses(ip.Value()) > 1 {
 								results.Add(
-									"Security group rule allows ingress to RDP port from public internet.",
+									"Security group rule allows ingress to SSH port from multiple public internet addresses.",
 									ip,
 								)
 							}
diff --git a/vendor/github.com/aquasecurity/defsec/rules/google/compute/use_secure_tls_policy.go b/vendor/github.com/aquasecurity/defsec/rules/google/compute/use_secure_tls_policy.go
index 46efc62c2..4b866137e 100644
--- a/vendor/github.com/aquasecurity/defsec/rules/google/compute/use_secure_tls_policy.go
+++ b/vendor/github.com/aquasecurity/defsec/rules/google/compute/use_secure_tls_policy.go
@@ -18,13 +18,13 @@ var CheckUseSecureTlsPolicy = rules.Register(
 		Resolution:  "Enforce a minimum TLS version of 1.2",
 		Explanation: `TLS versions prior to 1.2 are outdated and insecure. You should use 1.2 as aminimum version.`,
 		Links:       []string{},
-		Terraform: &rules.EngineMetadata{
-			GoodExamples:        terraformUseSecureTlsPolicyGoodExamples,
-			BadExamples:         terraformUseSecureTlsPolicyBadExamples,
-			Links:               terraformUseSecureTlsPolicyLinks,
-			RemediationMarkdown: terraformUseSecureTlsPolicyRemediationMarkdown,
-		},
-		Severity: severity.Critical,
+		Terraform:   &rules.EngineMetadata{
+            GoodExamples:        terraformUseSecureTlsPolicyGoodExamples,
+            BadExamples:         terraformUseSecureTlsPolicyBadExamples,
+            Links:               terraformUseSecureTlsPolicyLinks,
+            RemediationMarkdown: terraformUseSecureTlsPolicyRemediationMarkdown,
+        },
+        Severity:    severity.Critical,
 	},
 	func(s *state.State) (results rules.Results) {
 		for _, policy := range s.Google.Compute.SSLPolicies {
diff --git a/vendor/github.com/aquasecurity/defsec/types/reference.go b/vendor/github.com/aquasecurity/defsec/types/reference.go
index ee52bf48f..09ae695ba 100644
--- a/vendor/github.com/aquasecurity/defsec/types/reference.go
+++ b/vendor/github.com/aquasecurity/defsec/types/reference.go
@@ -10,7 +10,7 @@ type FakeReference struct {
 }
 
 func (f *FakeReference) String() string {
-	return ""
+	return "something"
 }
 
 func (f *FakeReference) RefersTo(r Reference) bool {
@@ -18,5 +18,5 @@ func (f *FakeReference) RefersTo(r Reference) bool {
 }
 
 func (f *FakeReference) LogicalID() string {
-	return ""
+	return "something"
 }
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 49b46473a..d0bf874f6 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -28,7 +28,7 @@ github.com/apparentlymart/go-cidr/cidr
 # github.com/apparentlymart/go-textseg/v13 v13.0.0
 ## explicit; go 1.16
 github.com/apparentlymart/go-textseg/v13/textseg
-# github.com/aquasecurity/defsec v0.3.13
+# github.com/aquasecurity/defsec v0.3.18
 ## explicit; go 1.17
 github.com/aquasecurity/defsec/cidr
 github.com/aquasecurity/defsec/formatters


Test patch:
diff --git a/internal/app/tfsec/custom/processing_test.go b/internal/app/tfsec/custom/processing_test.go
index 3944e3036..d87e11052 100644
--- a/internal/app/tfsec/custom/processing_test.go
+++ b/internal/app/tfsec/custom/processing_test.go
@@ -32,7 +32,11 @@ func init() {
       "severity": "HIGH",
       "matchSpec": {
         "action": "requiresPresence",
-		"name": "aws_flow_log"
+		"name": "aws_flow_log",
+		"subMatch": {
+		  "action": "isPresent",
+		  "name": "log_destination"
+		}
       },
       "errorMessage": "VPCs should have an aws_flow_log associated with them",
       "relatedLinks": []
@@ -93,6 +97,7 @@ var testNestedMatchSpec = MatchSpec{
 		},
 	},
 }
+
 var testNotMatchSpec = MatchSpec{
 	Action: "not",
 	PredicateMatchSpec: []MatchSpec{
@@ -103,6 +108,7 @@ var testNotMatchSpec = MatchSpec{
 		},
 	},
 }
+
 var testPreConditionCheck = MatchSpec{
 	Action:     "equals",
 	Name:       "name",
@@ -136,6 +142,7 @@ resource "aws_flow_log" "example" {
 `)
 	assert.Len(t, scanResults, 0)
 }
+
 func TestRequiresPresenceWithResourceMissing(t *testing.T) {
 	scanResults := scanTerraform(t, `
 resource "aws_vpc" "main" {
@@ -150,6 +157,26 @@ resource "aws_vpc" "main" {
 	assert.Len(t, scanResults, 1)
 }
 
+func TestRequiresPresenceWithSubMatchFailing(t *testing.T) {
+	scanResults := scanTerraform(t, `
+resource "aws_vpc" "main" {
+  cidr_block       = "10.0.0.0/16"
+  instance_tenancy = "default"
+
+  tags = {
+    Name = "main"
+  }
+}
+
+resource "aws_flow_log" "example" {
+  iam_role_arn    = aws_iam_role.example.arn
+  traffic_type    = "ALL"
+  vpc_id          = aws_vpc.example.id
+}
+`)
+	assert.Len(t, scanResults, 1)
+}
+
 func TestOrMatchFunction(t *testing.T) {
 
 	var tests = []struct {
@@ -244,6 +271,7 @@ resource "aws_ami" "example" {
 		})
 	}
 }
+
 func TestNestedMatchFunction(t *testing.T) {
 	var tests = []struct {
 		name               string
diff --git a/internal/app/tfsec/rules/aws/rds/backup_retention_specified_rule_test.go b/internal/app/tfsec/rules/aws/rds/backup_retention_specified_rule_test.go
index 6f4724bb0..16d0cc6e6 100644
--- a/internal/app/tfsec/rules/aws/rds/backup_retention_specified_rule_test.go
+++ b/internal/app/tfsec/rules/aws/rds/backup_retention_specified_rule_test.go
@@ -18,136 +18,135 @@ func Test_AWSRDSRetentionPeriod(t *testing.T) {
 		{
 			name: "db instance with default retention fails check",
 			source: `
- 			resource "aws_db_instance" "bad_example" {
- 				allocated_storage    = 10
- 				engine               = "mysql"
- 				engine_version       = "5.7"
- 				instance_class       = "db.t3.micro"
- 				name                 = "mydb"
- 				username             = "foo"
- 				password             = "foobarbaz"
- 				parameter_group_name = "default.mysql5.7"
- 				skip_final_snapshot  = true
- 			}
- `,
+		 			resource "aws_db_instance" "bad_example" {
+		 				allocated_storage    = 10
+		 				engine               = "mysql"
+		 				engine_version       = "5.7"
+		 				instance_class       = "db.t3.micro"
+		 				name                 = "mydb"
+		 				username             = "foo"
+		 				password             = "foobarbaz"
+		 				parameter_group_name = "default.mysql5.7"
+		 				skip_final_snapshot  = true
+		 			}
+		 `,
 			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "rds cluster with default retention fails check",
 			source: `
- 			resource "aws_rds_cluster" "bad_example" {
- 				cluster_identifier      = "aurora-cluster-demo"
- 				engine                  = "aurora-mysql"
- 				engine_version          = "5.7.mysql_aurora.2.03.2"
- 				availability_zones      = ["us-west-2a", "us-west-2b", "us-west-2c"]
- 				database_name           = "mydb"
- 				master_username         = "foo"
- 				master_password         = "bar"
- 				preferred_backup_window = "07:00-09:00"
- 			}
- `,
+		 			resource "aws_rds_cluster" "bad_example" {
+		 				cluster_identifier      = "aurora-cluster-demo"
+		 				engine                  = "aurora-mysql"
+		 				engine_version          = "5.7.mysql_aurora.2.03.2"
+		 				availability_zones      = ["us-west-2a", "us-west-2b", "us-west-2c"]
+		 				database_name           = "mydb"
+		 				master_username         = "foo"
+		 				master_password         = "bar"
+		 				preferred_backup_window = "07:00-09:00"
+		 			}
+		 `,
 			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "db instance with explicit retention of 1 fails check",
 			source: `
- 			resource "aws_db_instance" "bad_example" {
- 				allocated_storage    = 10
- 				engine               = "mysql"
- 				engine_version       = "5.7"
- 				instance_class       = "db.t3.micro"
- 				name                 = "mydb"
- 				username             = "foo"
- 				password             = "foobarbaz"
- 				parameter_group_name = "default.mysql5.7"
- 				backup_retention_period = 1
- 				skip_final_snapshot  = true
- 			}
- `,
+		 			resource "aws_db_instance" "bad_example" {
+		 				allocated_storage    = 10
+		 				engine               = "mysql"
+		 				engine_version       = "5.7"
+		 				instance_class       = "db.t3.micro"
+		 				name                 = "mydb"
+		 				username             = "foo"
+		 				password             = "foobarbaz"
+		 				parameter_group_name = "default.mysql5.7"
+		 				backup_retention_period = 1
+		 				skip_final_snapshot  = true
+		 			}
+		 `,
 			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "rds cluster with explicit retention of 1 fails check",
 			source: `
- 			resource "aws_rds_cluster" "bad_example" {
- 				cluster_identifier      = "aurora-cluster-demo"
- 				engine                  = "aurora-mysql"
- 				engine_version          = "5.7.mysql_aurora.2.03.2"
- 				availability_zones      = ["us-west-2a", "us-west-2b", "us-west-2c"]
- 				database_name           = "mydb"
- 				master_username         = "foo"
- 				master_password         = "bar"
- 				backup_retention_period = 1
- 				preferred_backup_window = "07:00-09:00"
- 			}
- `,
+		 			resource "aws_rds_cluster" "bad_example" {
+		 				cluster_identifier      = "aurora-cluster-demo"
+		 				engine                  = "aurora-mysql"
+		 				engine_version          = "5.7.mysql_aurora.2.03.2"
+		 				availability_zones      = ["us-west-2a", "us-west-2b", "us-west-2c"]
+		 				database_name           = "mydb"
+		 				master_username         = "foo"
+		 				master_password         = "bar"
+		 				backup_retention_period = 1
+		 				preferred_backup_window = "07:00-09:00"
+		 			}
+		 `,
 			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "rds cluster with retention greater than default passes check",
 			source: `
- 			resource "aws_rds_cluster" "good_example" {
- 				cluster_identifier      = "aurora-cluster-demo"
- 				engine                  = "aurora-mysql"
- 				engine_version          = "5.7.mysql_aurora.2.03.2"
- 				availability_zones      = ["us-west-2a", "us-west-2b", "us-west-2c"]
- 				database_name           = "mydb"
- 				master_username         = "foo"
- 				master_password         = "bar"
- 				backup_retention_period = 5
- 				preferred_backup_window = "07:00-09:00"
- 			}
- `,
+		 			resource "aws_rds_cluster" "good_example" {
+		 				cluster_identifier      = "aurora-cluster-demo"
+		 				engine                  = "aurora-mysql"
+		 				engine_version          = "5.7.mysql_aurora.2.03.2"
+		 				availability_zones      = ["us-west-2a", "us-west-2b", "us-west-2c"]
+		 				database_name           = "mydb"
+		 				master_username         = "foo"
+		 				master_password         = "bar"
+		 				backup_retention_period = 5
+		 				preferred_backup_window = "07:00-09:00"
+		 			}
+		 `,
 			mustExcludeResultCode: expectedCode,
 		},
 		{
 			name: "db instance with retention greater than default passes check",
 			source: `
- 	        resource "aws_db_instance" "good_example" {
- 				allocated_storage       = 10
- 				engine                  = "mysql"
- 				engine_version          = "5.7"
- 				instance_class          = "db.t3.micro"
- 				name                    = "mydb"
- 				username                = "foo"
- 				password                = "foobarbaz"
- 				parameter_group_name    = "default.mysql5.7"
- 				backup_retention_period = 5
- 				skip_final_snapshot     = true
- 			}
- `,
+		 	        resource "aws_db_instance" "good_example" {
+		 				allocated_storage       = 10
+		 				engine                  = "mysql"
+		 				engine_version          = "5.7"
+		 				instance_class          = "db.t3.micro"
+		 				name                    = "mydb"
+		 				username                = "foo"
+		 				password                = "foobarbaz"
+		 				parameter_group_name    = "default.mysql5.7"
+		 				backup_retention_period = 5
+		 				skip_final_snapshot     = true
+		 			}
+		 `,
 			mustExcludeResultCode: expectedCode,
 		},
 		{
-			name: "db instance with which is a replica with no retention period set  passes check",
+			name: "db instance with which is a replica with no retention period set passes check",
 			source: `
- 			resource "aws_db_instance" "good_example" {
- 				allocated_storage       = 10
- 				engine                  = "mysql"
- 				engine_version          = "5.7"
- 				instance_class          = "db.t3.micro"
- 				name                    = "mydb"
- 				username                = "foo"
- 				password                = "foobarbaz"
- 				parameter_group_name    = "default.mysql5.7"
- 				backup_retention_period = 5
- 				skip_final_snapshot     = true
- 			}
- 
- 
- 	        resource "aws_db_instance" "good_example_replica" {
- 				allocated_storage       = 10
- 				engine                  = "mysql"
- 				engine_version          = "5.7"
- 				instance_class          = "db.t3.micro"
- 				name                    = "mydb"
- 				username                = "foo"
- 				password                = "foobarbaz"
- 				parameter_group_name    = "default.mysql5.7"
- 				replicate_source_db     = aws_db_instance.good_example_replica.id
- 				skip_final_snapshot     = true
- 			}
- `,
+		 			resource "aws_db_instance" "good_example" {
+		 				allocated_storage       = 10
+		 				engine                  = "mysql"
+		 				engine_version          = "5.7"
+		 				instance_class          = "db.t3.micro"
+		 				name                    = "mydb"
+		 				username                = "foo"
+		 				password                = "foobarbaz"
+		 				parameter_group_name    = "default.mysql5.7"
+		 				backup_retention_period = 5
+		 				skip_final_snapshot     = true
+		 			}
+
+		 	        resource "aws_db_instance" "good_example_replica" {
+		 				allocated_storage       = 10
+		 				engine                  = "mysql"
+		 				engine_version          = "5.7"
+		 				instance_class          = "db.t3.micro"
+		 				name                    = "mydb"
+		 				username                = "foo"
+		 				password                = "foobarbaz"
+		 				parameter_group_name    = "default.mysql5.7"
+		 				replicate_source_db     = aws_db_instance.good_example_replica.arn
+		 				skip_final_snapshot     = true
+		 			}
+		 `,
 			mustExcludeResultCode: expectedCode,
 		},
 	}
diff --git a/internal/app/tfsec/rules/aws/rds/enable_performance_insights_rule_test.go b/internal/app/tfsec/rules/aws/rds/enable_performance_insights_rule_test.go
index a767f2666..dc40f48fc 100644
--- a/internal/app/tfsec/rules/aws/rds/enable_performance_insights_rule_test.go
+++ b/internal/app/tfsec/rules/aws/rds/enable_performance_insights_rule_test.go
@@ -18,10 +18,15 @@ func Test_AWSRDSPerformanceInsughtsEncryptionNotEnabled(t *testing.T) {
 		{
 			name: "Performance insights enabled but no kms key provided",
 			source: `
+resource "aws_rds_cluster" "cluster1" {
+
+}
+
  resource "aws_rds_cluster_instance" "foo" {
-   name                 = "bar"
-   performance_insights_enabled = true
+   name                            = "bar"
+   performance_insights_enabled    = true
    performance_insights_kms_key_id = ""
+   cluster_identifier              = aws_rds_cluster.cluster1.id
  }
  `,
 			mustIncludeResultCode: expectedCode,
@@ -29,27 +34,43 @@ func Test_AWSRDSPerformanceInsughtsEncryptionNotEnabled(t *testing.T) {
 		{
 			name: "Performance insights disable",
 			source: `
+resource "aws_rds_cluster" "cluster1" {
+
+}
+
  resource "aws_rds_cluster_instance" "foo" {
-   name                 = "bar"
+   name                         = "bar"
    performance_insights_enabled = false
+   cluster_identifier           = aws_rds_cluster.cluster1.id
  
  }
  `,
-			mustExcludeResultCode: expectedCode,
+			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "Performance insights not mentioned",
 			source: `
+resource "aws_rds_cluster" "cluster1" {
+
+}
+
  resource "aws_rds_cluster_instance" "foo" {
+	cluster_identifier   = aws_rds_cluster.cluster1.id
    
- }
+   
+}
  `,
-			mustExcludeResultCode: expectedCode,
+			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "Performance insights enabled and kms key provided",
 			source: `
+resource "aws_rds_cluster" "cluster1" {
+
+}
+
  resource "aws_rds_cluster_instance" "foo" {
+   cluster_identifier   = aws_rds_cluster.cluster1.id
    name                 = "bar"
    performance_insights_enabled = true
    performance_insights_kms_key_id = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
@@ -77,7 +98,7 @@ func Test_AWSRDSPerformanceInsughtsEncryptionNotEnabled(t *testing.T) {
  
  }
  `,
-			mustExcludeResultCode: expectedCode,
+			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "Performance insights on aws_db_instance not mentioned",
@@ -86,7 +107,7 @@ func Test_AWSRDSPerformanceInsughtsEncryptionNotEnabled(t *testing.T) {
    
  }
  `,
-			mustExcludeResultCode: expectedCode,
+			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "Performance insights enabled on aws_db_instance and kms key provided",
@@ -102,11 +123,15 @@ func Test_AWSRDSPerformanceInsughtsEncryptionNotEnabled(t *testing.T) {
 		{
 			name: "Testing issue 506: error when performance insights enabled and kms included",
 			source: `
+resource "aws_rds_cluster" "cluster1" {
+
+}
+
  resource "aws_rds_cluster_instance" "covidshield_server_instances" {
    count                        = 3
  
    identifier           = "${var.rds_server_db_name}-instance-${count.index}"
-   cluster_identifier   = aws_rds_cluster.covidshield_server.id
+   cluster_identifier   = aws_rds_cluster.cluster1.id
    instance_class       = var.rds_server_instance_class
    db_subnet_group_name = aws_db_subnet_group.covidshield.name
  
diff --git a/internal/app/tfsec/rules/aws/rds/no_public_db_access_rule_test.go b/internal/app/tfsec/rules/aws/rds/no_public_db_access_rule_test.go
index d878ed594..797235700 100644
--- a/internal/app/tfsec/rules/aws/rds/no_public_db_access_rule_test.go
+++ b/internal/app/tfsec/rules/aws/rds/no_public_db_access_rule_test.go
@@ -20,41 +20,23 @@ func Test_AWSPublic(t *testing.T) {
 			source: `
  resource "aws_db_instance" "my-resource" {
  	publicly_accessible = true
- }`,
-			mustIncludeResultCode: expectedCode,
-		},
-		{
-			name: "check aws_dms_replication_instance when publicly exposed",
-			source: `
- resource "aws_dms_replication_instance" "my-resource" {
- 	publicly_accessible = true
  }`,
 			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "check aws_rds_cluster_instance when publicly exposed",
 			source: `
+resource "aws_rds_cluster" "cluster1" {
+
+}
+
+
  resource "aws_rds_cluster_instance" "my-resource" {
+	cluster_identifier = aws_rds_cluster.cluster1.id
  	publicly_accessible = true
  }`,
 			mustIncludeResultCode: expectedCode,
 		},
-		{
-			name: "check aws_redshift_cluster when publicly exposed",
-			source: `
- resource "aws_redshift_cluster" "my-resource" {
- 	publicly_accessible = true
- }`,
-			mustIncludeResultCode: expectedCode,
-		},
-		{
-			name: "check aws_redshift_cluster when not publicly exposed",
-			source: `
- resource "aws_redshift_cluster" "my-resource" {
- 	publicly_accessible = false
- }`,
-			mustExcludeResultCode: expectedCode,
-		},
 	}
 
 	for _, test := range tests {
diff --git a/internal/app/tfsec/rules/azure/database/no_public_firewall_access_rule_test.go b/internal/app/tfsec/rules/azure/database/no_public_firewall_access_rule_test.go
index e593fd51a..b8a4c2bef 100644
--- a/internal/app/tfsec/rules/azure/database/no_public_firewall_access_rule_test.go
+++ b/internal/app/tfsec/rules/azure/database/no_public_firewall_access_rule_test.go
@@ -18,10 +18,14 @@ func Test_AzureNoPublicFirewallAccess(t *testing.T) {
 		{
 			name: "rule with open ip range fails check",
 			source: `
- resource "azurerm_postgresql_firewall_rule" "bad_example" {
+ resource "azurerm_mssql_server" "example" {
+	name                         = "myserver"
+ }
+
+ resource "azurerm_sql_firewall_rule" "bad_example" {
    name                = "bad_example"
    resource_group_name = azurerm_resource_group.example.name
-   server_name         = azurerm_postgresql_server.example.name
+   server_name         = azurerm_mssql_server.example.name
    start_ip_address    = "0.0.0.0"
    end_ip_address      = "255.255.255.255"
  }
@@ -31,6 +35,10 @@ func Test_AzureNoPublicFirewallAccess(t *testing.T) {
 		{
 			name: "postgresql rule with open ip range fails check",
 			source: `
+resource "azurerm_postgresql_server" "example" {
+	name                         = "myserver"
+}
+			
  resource "azurerm_postgresql_firewall_rule" "bad_example" {
    name                = "bad_example"
    resource_group_name = azurerm_resource_group.example.name
@@ -42,9 +50,13 @@ func Test_AzureNoPublicFirewallAccess(t *testing.T) {
 			mustIncludeResultCode: expectedCode,
 		},
 		{
-			name: "rule with specific Azure services start and end ip passes check",
+			name: "rule with public start and end ip fails check",
 			source: `
- resource "azurerm_sql_firewall_rule" "good_example" {
+ resource "azurerm_sql_server" "example" {
+	name                         = "mysqlserver"
+ }
+				
+ resource "azurerm_sql_firewall_rule" "bad_example" {
    name                = "good_rule"
    resource_group_name = azurerm_resource_group.example.name
    server_name         = azurerm_sql_server.example.name
@@ -52,11 +64,19 @@ func Test_AzureNoPublicFirewallAccess(t *testing.T) {
    end_ip_address      = "0.0.0.0"
  }
  `,
-			mustExcludeResultCode: expectedCode,
+			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "rule with specific Azure services start and end ip passes check",
 			source: `
+ resource "azurerm_sql_server" "example" {
+	name                         = "mysqlserver"
+ }
+
+ resource "azurerm_postgresql_server" "example" {
+	name                         = "myserver"
+ }
+ 
  resource "azurerm_sql_firewall_rule" "good_example" {
    name                = "good_rule"
    resource_group_name = azurerm_resource_group.example.name
@@ -68,7 +88,7 @@ func Test_AzureNoPublicFirewallAccess(t *testing.T) {
  resource "azurerm_postgresql_firewall_rule" "good_example" {
  	name                = "good_rule"
  	resource_group_name = azurerm_resource_group.example.name
- 	server_name         = azurerm_sql_server.example.name
+ 	server_name         = azurerm_postgresql_server.example.name
  	start_ip_address    = "10.0.2.0"
  	end_ip_address      = "10.0.2.240"
    }
diff --git a/internal/app/tfsec/rules/azure/database/retention_period_set_rule_test.go b/internal/app/tfsec/rules/azure/database/retention_period_set_rule_test.go
index af65bdd44..5072c55fc 100644
--- a/internal/app/tfsec/rules/azure/database/retention_period_set_rule_test.go
+++ b/internal/app/tfsec/rules/azure/database/retention_period_set_rule_test.go
@@ -18,6 +18,15 @@ func Test_AZUDatabaseAuditingRetention90Days(t *testing.T) {
 		{
 			name: "check fails if retention period is less than 90",
 			source: `
+ resource "azurerm_mssql_server" "example" {
+  name                         = "example-sqlserver"
+ }
+
+ resource "azurerm_mssql_database" "example" {
+  name      = "example-db"
+  server_id = azurerm_mssql_server.example.id
+ }
+
  resource "azurerm_mssql_database_extended_auditing_policy" "bad_example" {
    database_id                             = azurerm_mssql_database.example.id
    storage_endpoint                        = azurerm_storage_account.example.primary_blob_endpoint
@@ -31,6 +40,15 @@ func Test_AZUDatabaseAuditingRetention90Days(t *testing.T) {
 		{
 			name: "check passes if retention period is unlimited (0)",
 			source: `
+ resource "azurerm_mssql_server" "example" {
+   name                         = "example-sqlserver"
+ }
+
+   resource "azurerm_mssql_database" "example" {
+   name      = "example-db"
+   server_id = azurerm_mssql_server.example.id
+ }
+      
  resource "azurerm_mssql_database_extended_auditing_policy" "unlimited_retention" {
    database_id                             = azurerm_mssql_database.example.id
    storage_endpoint                        = azurerm_storage_account.example.primary_blob_endpoint
@@ -44,6 +62,15 @@ func Test_AZUDatabaseAuditingRetention90Days(t *testing.T) {
 		{
 			name: "check fails if extended_auditing_policy has retention less than 90 days",
 			source: `
+ resource "azurerm_mssql_server" "example" {
+    name                         = "example-sqlserver"
+  }
+  
+ resource "azurerm_mssql_database" "example" {
+   name      = "example-db"
+   server_id = azurerm_mssql_server.example.id
+ }
+
  resource "azurerm_sql_server" "good_example" {
    name                         = "mssqlserver"
    resource_group_name          = azurerm_resource_group.example.name
@@ -65,6 +92,15 @@ func Test_AZUDatabaseAuditingRetention90Days(t *testing.T) {
 		{
 			name: "check passes if retention not specified",
 			source: `
+ resource "azurerm_mssql_server" "example" {
+   name                         = "example-sqlserver"
+ }
+
+ resource "azurerm_mssql_database" "example" {
+   name      = "example-db"
+   server_id = azurerm_mssql_server.example.id
+ }
+
  resource "azurerm_mssql_database_extended_auditing_policy" "good_example" {
    database_id                             = azurerm_mssql_database.example.id
    storage_endpoint                        = azurerm_storage_account.example.primary_blob_endpoint
@@ -96,6 +132,15 @@ func Test_AZUDatabaseAuditingRetention90Days(t *testing.T) {
 		{
 			name: "check passes if retention period is greater than or equal 90",
 			source: `
+ resource "azurerm_mssql_server" "example" {
+   name                         = "example-sqlserver"
+ }
+
+ resource "azurerm_mssql_database" "example" {
+   name      = "example-db"
+   server_id = azurerm_mssql_server.example.id
+ }
+
  resource "azurerm_mssql_database_extended_auditing_policy" "good_example" {
    database_id                             = azurerm_mssql_database.example.id
    storage_endpoint                        = azurerm_storage_account.example.primary_blob_endpoint
@@ -121,7 +166,7 @@ func Test_AZUDatabaseAuditingRetention90Days(t *testing.T) {
      storage_endpoint                        = azurerm_storage_account.example.primary_blob_endpoint
      storage_account_access_key              = azurerm_storage_account.example.primary_access_key
      storage_account_access_key_is_secondary = true
- 	retention_in_days                       = 90
+ 	   retention_in_days                       = 90
    }
  }
  `,
diff --git a/internal/app/tfsec/rules/azure/network/disable_rdp_from_internet_rule_test.go b/internal/app/tfsec/rules/azure/network/disable_rdp_from_internet_rule_test.go
index 2f107956f..4a86d8d7e 100644
--- a/internal/app/tfsec/rules/azure/network/disable_rdp_from_internet_rule_test.go
+++ b/internal/app/tfsec/rules/azure/network/disable_rdp_from_internet_rule_test.go
@@ -18,6 +18,10 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
 		{
 			name: "check RDP access from * causes a failure",
 			source: `
+ resource "azurerm_network_security_group" "example" {
+     name                = "acceptanceTestSecurityGroup1"
+ }
+
  resource "azurerm_network_security_rule" "bad_example" {
       name                        = "bad_example_security_rule"
       direction                   = "Inbound"
@@ -27,6 +31,7 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
       destination_port_range      = ["3389"]
       source_address_prefix       = "*"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  `,
 			mustIncludeResultCode: expectedCode,
@@ -34,6 +39,10 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
 		{
 			name: "check RDP access from * is ok when mode is deny",
 			source: `
+ resource "azurerm_network_security_group" "example" {
+     name                = "acceptanceTestSecurityGroup1"
+ }
+               
  resource "azurerm_network_security_rule" "example_deny" {
       name                        = "example_deny_security_rule"
       direction                   = "Inbound"
@@ -43,6 +52,7 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
       destination_port_range      = ["3389"]
       source_address_prefix       = "*"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  `,
 			mustExcludeResultCode: expectedCode,
@@ -50,6 +60,10 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
 		{
 			name: "check RDP access from 0.0.0.0 causes a failure",
 			source: `
+resource "azurerm_network_security_group" "example" {
+     name                = "acceptanceTestSecurityGroup1"
+}
+
  resource "azurerm_network_security_rule" "bad_example" {
       name                        = "bad_example_security_rule"
       direction                   = "Inbound"
@@ -59,6 +73,7 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
       destination_port_range      = ["3389"]
       source_address_prefix       = "*"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  `,
 			mustIncludeResultCode: expectedCode,
@@ -66,6 +81,10 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
 		{
 			name: "check RDP access from /0 causes a failure",
 			source: `
+resource "azurerm_network_security_group" "example" {
+     name                = "acceptanceTestSecurityGroup1"
+}
+                      
  resource "azurerm_network_security_rule" "bad_example" {
       name                        = "bad_example_security_rule"
       direction                   = "Inbound"
@@ -75,6 +94,7 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
       destination_port_range      = ["3389"]
       source_address_prefix       = "*"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  `,
 			mustIncludeResultCode: expectedCode,
@@ -82,6 +102,10 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
 		{
 			name: "check RDP access from internet causes a failure",
 			source: `
+resource "azurerm_network_security_group" "example" {
+     name                = "acceptanceTestSecurityGroup1"
+}
+               
  resource "azurerm_network_security_rule" "bad_example" {
       name                        = "bad_example_security_rule"
       direction                   = "Inbound"
@@ -91,6 +115,7 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
       destination_port_range      = ["3389"]
       source_address_prefix       = "*"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  `,
 			mustIncludeResultCode: expectedCode,
@@ -98,6 +123,10 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
 		{
 			name: "check RDP access from internet causes a failure",
 			source: `
+resource "azurerm_network_security_group" "example" {
+     name                = "acceptanceTestSecurityGroup1"
+}
+
  resource "azurerm_network_security_rule" "bad_example" {
       name                        = "bad_example_security_rule"
       direction                   = "Inbound"
@@ -107,6 +136,7 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
       destination_port_range      = ["3389"]
       source_address_prefix       = "*"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  `,
 			mustIncludeResultCode: expectedCode,
@@ -120,6 +150,8 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
    resource_group_name = azurerm_resource_group.example.name
    
    security_rule {
+      access                      = "Allow"
+      direction                   = "Inbound"
  	 source_port_range           = "any"
       destination_port_range      = ["3389", "80", "443"]
       source_address_prefix       = "*"
@@ -139,6 +171,7 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
    
    security_rule {
       access                      = "Deny"
+      direction                   = "Inbound"
       source_port_range           = "any"
       destination_port_range      = ["3389", "80", "443"]
       source_address_prefix       = "*"
@@ -157,6 +190,8 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
    resource_group_name = azurerm_resource_group.example.name
    
    security_rule {
+      access                      = "Allow"
+      direction                   = "Inbound"
  	 source_port_range           = "any"
       destination_port_range      = ["3389", "80", "443"]
       source_address_prefix       = "4.53.160.75"
@@ -164,6 +199,8 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
    }
  
    security_rule {
+      access                      = "Allow"
+      direction                   = "Inbound"
  	 source_port_range           = "any"
       destination_port_range      = ["3389", "80", "443"]
       source_address_prefix       = "internet"
@@ -176,6 +213,10 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
 		{
 			name: "check RDP is acceptable from a specific source",
 			source: `
+resource "azurerm_network_security_group" "example" {
+     name                = "acceptanceTestSecurityGroup1"
+}
+
  resource "azurerm_network_security_rule" "good_example" {
       name                        = "good_example_security_rule"
       direction                   = "Inbound"
@@ -185,6 +226,7 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
       destination_port_range      = ["3389"]
       source_address_prefix       = "4.53.160.75"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  `,
 			mustExcludeResultCode: expectedCode,
@@ -198,6 +240,8 @@ func Test_AZURDPAccessNotAllowedFromInternet(t *testing.T) {
    resource_group_name = azurerm_resource_group.example.name
    
    security_rule {
+      access                      = "Allow"
+      direction                   = "Inbound"
  	 source_port_range           = "any"
       destination_port_range      = ["3389"]
       source_address_prefix       = "4.53.160.75"
diff --git a/internal/app/tfsec/rules/azure/network/no_public_ingress_rule_test.go b/internal/app/tfsec/rules/azure/network/no_public_ingress_rule_test.go
index c52c911af..81f96bfc6 100644
--- a/internal/app/tfsec/rules/azure/network/no_public_ingress_rule_test.go
+++ b/internal/app/tfsec/rules/azure/network/no_public_ingress_rule_test.go
@@ -19,80 +19,120 @@ func Test_AzureOpenNetworkSecurityGroupRule(t *testing.T) {
 		{
 			name: "check azurerm_network_security_rule inbound on 0.0.0.0/0",
 			source: `
+ resource "azurerm_network_security_group" "example" {
+	name                = "acceptanceTestSecurityGroup1"
+ }
+
  resource "azurerm_network_security_rule" "my-rule" {
  	direction = "Inbound"
  	source_address_prefix = "0.0.0.0/0"
  	access = "Allow"
+	network_security_group_name = azurerm_network_security_group.example.name
  }`,
 			mustIncludeResultCode: expectedIngressCode,
 		},
 		{
 			name: "check azurerm_network_security_rule inbound on *",
 			source: `
+ resource "azurerm_network_security_group" "example" {
+	name                = "acceptanceTestSecurityGroup1"
+ }
+	
  resource "azurerm_network_security_rule" "my-rule" {
  	direction = "Inbound"
  	source_address_prefix = "*"
  	access = "Allow"
+	network_security_group_name = azurerm_network_security_group.example.name
  }`,
 			mustIncludeResultCode: expectedIngressCode,
 		},
 		{
 			name: "check azurerm_network_security_rule inbound on 0.0.0.0/0 in list",
 			source: `
+ resource "azurerm_network_security_group" "example" {
+	name                = "acceptanceTestSecurityGroup1"
+ }
+
  resource "azurerm_network_security_rule" "my-rule" {
  	direction = "Inbound"
  	source_address_prefixes = ["0.0.0.0/0"]
  	access = "Allow"
+	network_security_group_name = azurerm_network_security_group.example.name
  }`,
 			mustIncludeResultCode: expectedIngressCode,
 		},
 		{
 			name: "check azurerm_network_security_rule inbound on * in list",
 			source: `
+ resource "azurerm_network_security_group" "example" {
+	name                = "acceptanceTestSecurityGroup1"
+ }
+
  resource "azurerm_network_security_rule" "my-rule" {
  	direction = "Inbound"
  	source_address_prefixes = ["*"]
  	access = "Allow"
+	network_security_group_name = azurerm_network_security_group.example.name
  }`,
 			mustIncludeResultCode: expectedIngressCode,
 		},
 		{
 			name: "check azurerm_network_security_rule outbound on 0.0.0.0/0",
 			source: `
+resource "azurerm_network_security_group" "example" {
+	name                = "acceptanceTestSecurityGroup1"
+	}
+
  resource "azurerm_network_security_rule" "my-rule" {
  	direction = "Outbound"
  	destination_address_prefix = "0.0.0.0/0"
  	access = "Allow"
+	network_security_group_name = azurerm_network_security_group.example.name
  }`,
 			mustIncludeResultCode: expectedEgressCode,
 		},
 		{
 			name: "check azurerm_network_security_rule outbound on 0.0.0.0/0 in list",
 			source: `
+ resource "azurerm_network_security_group" "example" {
+	name                = "acceptanceTestSecurityGroup1"
+ }
+
  resource "azurerm_network_security_rule" "my-rule" {
  	direction = "Outbound"
  	destination_address_prefixes = ["0.0.0.0/0"]
  	access = "Allow"
+	network_security_group_name = azurerm_network_security_group.example.name
  }`,
 			mustIncludeResultCode: expectedEgressCode,
 		},
 		{
 			name: "check azurerm_network_security_rule outbound on 10.0.0.0/16",
 			source: `
+ resource "azurerm_network_security_group" "example" {
+	name                = "acceptanceTestSecurityGroup1"
+ }
+
  resource "azurerm_network_security_rule" "my-rule" {
  	direction = "Outbound"
  	destination_address_prefix = "10.0.0.0/16"
  	access = "Allow"
+	network_security_group_name = azurerm_network_security_group.example.name
  }`,
 			mustExcludeResultCode: expectedEgressCode,
 		},
 		{
 			name: "check azurerm_network_security_rule inbound on 0.0.0.0/0",
 			source: `
+ resource "azurerm_network_security_group" "example" {
+	name                = "acceptanceTestSecurityGroup1"
+ }
+			
  resource "azurerm_network_security_rule" "my-rule" {
  	direction = "Inbound"
  	source_address_prefix = "0.0.0.0/0"
  	access = "Deny"
+	network_security_group_name = azurerm_network_security_group.example.name
  }`,
 			mustExcludeResultCode: expectedIngressCode,
 		},
diff --git a/internal/app/tfsec/rules/azure/network/retention_policy_set_rule_test.go b/internal/app/tfsec/rules/azure/network/retention_policy_set_rule_test.go
index 6274a9be9..367d51c94 100644
--- a/internal/app/tfsec/rules/azure/network/retention_policy_set_rule_test.go
+++ b/internal/app/tfsec/rules/azure/network/retention_policy_set_rule_test.go
@@ -66,7 +66,7 @@ func Test_AzureRetentionPeriodSet(t *testing.T) {
  
    retention_policy {
      enabled = true
-     days    = 90
+     days    = 365
    }
  }
  `,
diff --git a/internal/app/tfsec/rules/azure/network/ssh_blocked_from_internet_rule_test.go b/internal/app/tfsec/rules/azure/network/ssh_blocked_from_internet_rule_test.go
index 7b22bffcc..4f123d0d0 100644
--- a/internal/app/tfsec/rules/azure/network/ssh_blocked_from_internet_rule_test.go
+++ b/internal/app/tfsec/rules/azure/network/ssh_blocked_from_internet_rule_test.go
@@ -18,6 +18,10 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
 		{
 			name: "check ssh access from * causes a failure",
 			source: `
+ resource "azurerm_network_security_group" "example" {
+     name                = "acceptanceTestSecurityGroup1"
+ }
+     
  resource "azurerm_network_security_rule" "bad_example" {
       name                        = "bad_example_security_rule"
       direction                   = "Inbound"
@@ -27,6 +31,7 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
       destination_port_range      = ["22"]
       source_address_prefix       = "*"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  `,
 			mustIncludeResultCode: expectedCode,
@@ -34,6 +39,10 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
 		{
 			name: "check ssh access from * is ok when mode is deny",
 			source: `
+ resource "azurerm_network_security_group" "example" {
+     name                = "acceptanceTestSecurityGroup1"
+ }
+     
  resource "azurerm_network_security_rule" "example_deny" {
       name                        = "example_deny_security_rule"
       direction                   = "Inbound"
@@ -43,6 +52,7 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
       destination_port_range      = ["22"]
       source_address_prefix       = "*"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  `,
 			mustExcludeResultCode: expectedCode,
@@ -50,6 +60,10 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
 		{
 			name: "check ssh access from 0.0.0.0 causes a failure",
 			source: `
+ resource "azurerm_network_security_group" "example" {
+     name                = "acceptanceTestSecurityGroup1"
+ }
+      
  resource "azurerm_network_security_rule" "bad_example" {
       name                        = "bad_example_security_rule"
       direction                   = "Inbound"
@@ -59,6 +73,7 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
       destination_port_range      = ["22"]
       source_address_prefix       = "*"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  `,
 			mustIncludeResultCode: expectedCode,
@@ -66,6 +81,10 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
 		{
 			name: "check ssh access from /0 causes a failure",
 			source: `
+ resource "azurerm_network_security_group" "example" {
+     name                = "acceptanceTestSecurityGroup1"
+ }
+        
  resource "azurerm_network_security_rule" "bad_example" {
       name                        = "bad_example_security_rule"
       direction                   = "Inbound"
@@ -75,6 +94,7 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
       destination_port_range      = ["22"]
       source_address_prefix       = "*"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  `,
 			mustIncludeResultCode: expectedCode,
@@ -82,6 +102,10 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
 		{
 			name: "check ssh access from internet causes a failure",
 			source: `
+ resource "azurerm_network_security_group" "example" {
+     name                = "acceptanceTestSecurityGroup1"
+ }
+    
  resource "azurerm_network_security_rule" "bad_example" {
       name                        = "bad_example_security_rule"
       direction                   = "Inbound"
@@ -91,6 +115,7 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
       destination_port_range      = ["22"]
       source_address_prefix       = "*"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  `,
 			mustIncludeResultCode: expectedCode,
@@ -98,6 +123,10 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
 		{
 			name: "check ssh access from internet causes a failure",
 			source: `
+ resource "azurerm_network_security_group" "example" {
+     name                = "acceptanceTestSecurityGroup1"
+ }
+         
  resource "azurerm_network_security_rule" "bad_example" {
       name                        = "bad_example_security_rule"
       direction                   = "Inbound"
@@ -107,6 +136,7 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
       destination_port_range      = ["22"]
       source_address_prefix       = "*"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  `,
 			mustIncludeResultCode: expectedCode,
@@ -121,9 +151,11 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
    
    security_rule {
  	 source_port_range           = "any"
-      destination_port_range      = ["22", "80", "443"]
-      source_address_prefix       = "*"
-      destination_address_prefix  = "*"
+     destination_port_range      = ["22", "80", "443"]
+     source_address_prefix       = "*"
+     destination_address_prefix  = "*"
+     direction           = "Inbound"
+     access              = "Allow"
    }
  }
  `,
@@ -139,6 +171,7 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
    
    security_rule {
       access                      = "Deny"
+      direction                   = "Inbound"
       source_port_range           = "any"
       destination_port_range      = ["22", "80", "443"]
       source_address_prefix       = "*"
@@ -157,17 +190,21 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
    resource_group_name = azurerm_resource_group.example.name
    
    security_rule {
+     direction           = "Inbound"
+     access              = "Allow"
  	 source_port_range           = "any"
-      destination_port_range      = ["22", "80", "443"]
-      source_address_prefix       = "82.102.32.32"
-      destination_address_prefix  = "*"
+     destination_port_range      = ["22", "80", "443"]
+     source_address_prefix       = "82.102.32.32"
+     destination_address_prefix  = "*"
    }
  
    security_rule {
+     direction           = "Inbound"
+     access              = "Allow"
  	 source_port_range           = "any"
-      destination_port_range      = ["22", "80", "443"]
-      source_address_prefix       = "internet"
-      destination_address_prefix  = "*"
+     destination_port_range      = ["22", "80", "443"]
+     source_address_prefix       = "internet"
+     destination_address_prefix  = "*"
    }
  }
  `,
@@ -176,6 +213,10 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
 		{
 			name: "check ssh is acceptable from a specific source",
 			source: `
+ resource "azurerm_network_security_group" "example" {
+     name                = "acceptanceTestSecurityGroup1"
+ }
+       
  resource "azurerm_network_security_rule" "good_example" {
       name                        = "good_example_security_rule"
       direction                   = "Inbound"
@@ -185,6 +226,7 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
       destination_port_range      = ["22"]
       source_address_prefix       = "82.102.23.23"
       destination_address_prefix  = "*"
+      network_security_group_name = azurerm_network_security_group.example.name
  }
  `,
 			mustExcludeResultCode: expectedCode,
@@ -198,10 +240,12 @@ func Test_AZUSSHAccessNotAllowedFromInternet(t *testing.T) {
    resource_group_name = azurerm_resource_group.example.name
    
    security_rule {
+     direction                   = "Inbound"
+     access                      = "Allow"
  	 source_port_range           = "any"
-      destination_port_range      = ["22"]
-      source_address_prefix       = "82.102.23.23"
-      destination_address_prefix  = "*"
+     destination_port_range      = ["22"]
+     source_address_prefix       = "82.102.23.23"
+     destination_address_prefix  = "*"
    }
  }
  `,