Repository: bridgecrewio/checkov

Issue:
Terraform scan - OpenStack provider ?
Hello,

Do you plan to support Terraform scans with OpenStack in the future ?

Regards

Discussion:
pascal-hofmann: There were some bogus / missing tests. These are fixed / added now. Ready for review.

Patch:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
deleted file mode 100644
index be81be6ca..000000000
--- a/.github/workflows/codeql-analysis.yml
+++ /dev/null
@@ -1,70 +0,0 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ master ]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ master ]
-  schedule:
-    - cron: '17 4 * * 2'
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'python' ]
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
-        # Learn more about CodeQL language support at https://git.io/codeql-language-support
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
-
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
diff --git a/checkov/terraform/checks/provider/__init__.py b/checkov/terraform/checks/provider/__init__.py
index 75aebe6d2..012f0222e 100644
--- a/checkov/terraform/checks/provider/__init__.py
+++ b/checkov/terraform/checks/provider/__init__.py
@@ -1,3 +1,4 @@
 from checkov.terraform.checks.provider.aws import *
 from checkov.terraform.checks.provider.linode import *
-from checkov.terraform.checks.provider.bridgecrew import *
\ No newline at end of file
+from checkov.terraform.checks.provider.bridgecrew import *
+from checkov.terraform.checks.provider.openstack import *
diff --git a/checkov/terraform/checks/provider/openstack/__init__.py b/checkov/terraform/checks/provider/openstack/__init__.py
new file mode 100644
index 000000000..c61994559
--- /dev/null
+++ b/checkov/terraform/checks/provider/openstack/__init__.py
@@ -0,0 +1,5 @@
+from os.path import dirname, basename, isfile, join
+import glob
+
+modules = glob.glob(join(dirname(__file__), "*.py"))
+__all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")]
diff --git a/checkov/terraform/checks/provider/openstack/credentials.py b/checkov/terraform/checks/provider/openstack/credentials.py
new file mode 100644
index 000000000..599ca78e8
--- /dev/null
+++ b/checkov/terraform/checks/provider/openstack/credentials.py
@@ -0,0 +1,28 @@
+from typing import Dict, List, Any
+
+from checkov.common.models.enums import CheckResult, CheckCategories
+from checkov.terraform.checks.provider.base_check import BaseProviderCheck
+
+
+class OpenstackCredentials(BaseProviderCheck):
+    def __init__(self) -> None:
+        name = "Ensure no hard coded OpenStack password, token, or application_credential_secret exists in provider"
+        id = "CKV_OPENSTACK_1"
+        supported_provider = ["openstack"]
+        categories = [CheckCategories.SECRETS]
+        super().__init__(name=name, id=id, categories=categories, supported_provider=supported_provider)
+
+    def scan_provider_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:
+        """
+        see: https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs#configuration-reference
+        """
+        if conf.get("password"):
+            return CheckResult.FAILED
+        if conf.get("token"):
+            return CheckResult.FAILED
+        if conf.get("application_credential_secret"):
+            return CheckResult.FAILED
+        return CheckResult.PASSED
+
+
+check = OpenstackCredentials()
diff --git a/checkov/terraform/checks/resource/__init__.py b/checkov/terraform/checks/resource/__init__.py
index 06a7a6c19..6915b7da5 100644
--- a/checkov/terraform/checks/resource/__init__.py
+++ b/checkov/terraform/checks/resource/__init__.py
@@ -3,4 +3,5 @@ from checkov.terraform.checks.resource.gcp import *
 from checkov.terraform.checks.resource.azure import *
 from checkov.terraform.checks.resource.github import *
 from checkov.terraform.checks.resource.linode import *
-from checkov.terraform.checks.resource.oci import *
\ No newline at end of file
+from checkov.terraform.checks.resource.oci import *
+from checkov.terraform.checks.resource.openstack import *
diff --git a/checkov/terraform/checks/resource/openstack/AbsSecurityGroupUnrestrictedIngress.py b/checkov/terraform/checks/resource/openstack/AbsSecurityGroupUnrestrictedIngress.py
new file mode 100644
index 000000000..c823505d9
--- /dev/null
+++ b/checkov/terraform/checks/resource/openstack/AbsSecurityGroupUnrestrictedIngress.py
@@ -0,0 +1,77 @@
+from checkov.common.models.enums import CheckResult, CheckCategories
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+from checkov.common.util.type_forcers import force_list
+from checkov.common.util.type_forcers import force_int
+
+
+class AbsSecurityGroupUnrestrictedIngress(BaseResourceCheck):
+    def __init__(self, check_id, port):
+        name = f"Ensure no security groups allow ingress from 0.0.0.0:0 to port {port:d} (tcp / udp)"
+        supported_resources = ['openstack_compute_secgroup_v2', 'openstack_networking_secgroup_rule_v2']
+        categories = [CheckCategories.NETWORKING]
+        super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources)
+        self.port = port
+
+    def scan_resource_conf(self, conf):
+        """
+            Looks for configuration at security group ingress rules:
+            https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs/resources/compute_secgroup_v2
+            https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs/resources/networking_secgroup_rule_v2
+
+            Return PASS if:
+            - the resource is an openstack_compute_secgroup_v2 that contains no violating rules (including if there are
+              no rules at all), OR
+            - the resource is an openstack_networking_secgroup_rule_v2 of type 'ingress' that does not violate the
+              check.
+
+            Return FAIL if:
+            - the resource is an openstack_compute_secgroup_v2 that contains a violating rule, OR
+            - the resource is an openstack_networking_secgroup_rule_v2 of type 'ingress' that violates the check.
+
+            Return UNKNOWN if:
+            - the resource is an openstack_networking_secgroup_rule_v2 of type 'egress'
+
+        :param conf: openstack_compute_secgroup_v2|openstack_networking_secgroup_rule_v2 configuration
+        :return: <CheckResult>
+        """
+
+        if 'rule' in conf:  # This means it's an SG resource with rule block(s)
+            rules = conf['rule']
+            for rule in rules:
+                if isinstance(rule, dict) and self.contains_violation(rule, 'ip_protocol', 'from_port', 'to_port',
+                                                                      'cidr'):
+                    self.evaluated_keys = [
+                        f'rule/[{rules.index(rule)}]/ip_protocol',
+                        f'rule/[{rules.index(rule)}]/from_port',
+                        f'rule/[{rules.index(rule)}]/to_port',
+                        f'rule/[{rules.index(rule)}]/cidr',
+                    ]
+                    return CheckResult.FAILED
+
+            return CheckResult.PASSED
+
+        if 'direction' in conf:  # This means it's an SG_rule resource.
+            direction = force_list(conf['direction'])[0]
+            if direction == 'ingress':
+                self.evaluated_keys = ['protocol', 'port_range_min', 'port_range_max', 'remote_ip_prefix']
+                if self.contains_violation(conf, 'protocol', 'port_range_min', 'port_range_max', 'remote_ip_prefix'):
+                    return CheckResult.FAILED
+                return CheckResult.PASSED
+            return CheckResult.UNKNOWN
+
+        # The result for an SG with no ingress block
+        return CheckResult.PASSED
+
+    def contains_violation(self, conf, protocol_key, from_port_key, to_port_key, cidr_key):
+        protocol = force_list(conf.get(protocol_key, [{-1}]))[0]
+        from_port = force_int(force_list(conf.get(from_port_key, [{-1}]))[0])
+        to_port = force_int(force_list(conf.get(to_port_key, [{-1}]))[0])
+
+        if protocol == "icmp":
+            return False
+
+        if from_port is not None and to_port is not None and (from_port <= self.port <= to_port):
+            cidr = conf.get(cidr_key, [])
+            if len(cidr) > 0 and cidr[0] in ['0.0.0.0/0', '::/0', '0000:0000:0000:0000:0000:0000:0000:0000/0']:
+                return True
+        return False
diff --git a/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress22.py b/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress22.py
new file mode 100644
index 000000000..5e836d042
--- /dev/null
+++ b/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress22.py
@@ -0,0 +1,9 @@
+from checkov.terraform.checks.resource.openstack.AbsSecurityGroupUnrestrictedIngress import AbsSecurityGroupUnrestrictedIngress
+
+
+class SecurityGroupUnrestrictedIngress22(AbsSecurityGroupUnrestrictedIngress):
+    def __init__(self):
+        super().__init__(check_id="CKV_OPENSTACK_2", port=22)
+
+
+check = SecurityGroupUnrestrictedIngress22()
diff --git a/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress3389.py b/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress3389.py
new file mode 100644
index 000000000..6a1cb8bd4
--- /dev/null
+++ b/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress3389.py
@@ -0,0 +1,9 @@
+from checkov.terraform.checks.resource.openstack.AbsSecurityGroupUnrestrictedIngress import AbsSecurityGroupUnrestrictedIngress
+
+
+class SecurityGroupUnrestrictedIngress3389(AbsSecurityGroupUnrestrictedIngress):
+    def __init__(self):
+        super().__init__(check_id="CKV_OPENSTACK_3", port=3389)
+
+
+check = SecurityGroupUnrestrictedIngress3389()
diff --git a/checkov/terraform/checks/resource/openstack/__init__.py b/checkov/terraform/checks/resource/openstack/__init__.py
new file mode 100644
index 000000000..1cb91d4ca
--- /dev/null
+++ b/checkov/terraform/checks/resource/openstack/__init__.py
@@ -0,0 +1,4 @@
+from os.path import dirname, basename, isfile, join
+import glob
+modules = glob.glob(join(dirname(__file__), "*.py"))
+__all__ = [ basename(f)[:-3] for f in modules if isfile(f) and not f.endswith('__init__.py')]
\ No newline at end of file
diff --git a/checkov/version.py b/checkov/version.py
index bdc40d7a1..16f406b21 100644
--- a/checkov/version.py
+++ b/checkov/version.py
@@ -1,1 +1,1 @@
-version = '2.0.617'
+version = '2.0.616'
diff --git a/docs/5.Policy Index/all.md b/docs/5.Policy Index/all.md
index 5161e8b53..c790fb28c 100644
--- a/docs/5.Policy Index/all.md
+++ b/docs/5.Policy Index/all.md
@@ -376,17 +376,17 @@ nav_order: 1
 |  365 | CKV_AWS_191   | resource                         | aws_elasticache_replication_group                                            | Ensure Elasticache replication group is encrypted by KMS using a customer managed Key (CMK)                                                                                                              | Terraform      |
 |  366 | CKV2_AWS_1    | resource                         | aws_subnet                                                                   | Ensure that all NACL are attached to subnets                                                                                                                                                             | Terraform      |
 |  367 | CKV2_AWS_1    | resource                         | aws_network_acl                                                              | Ensure that all NACL are attached to subnets                                                                                                                                                             | Terraform      |
-|  368 | CKV2_AWS_2    | resource                         | aws_ebs_volume                                                               | Ensure that only encrypted EBS volumes are attached to EC2 instances                                                                                                                                     | Terraform      |
-|  369 | CKV2_AWS_2    | resource                         | aws_volume_attachment                                                        | Ensure that only encrypted EBS volumes are attached to EC2 instances                                                                                                                                     | Terraform      |
-|  370 | CKV2_AWS_3    | resource                         | aws_guardduty_detector                                                       | Ensure GuardDuty is enabled to specific org/region                                                                                                                                                       | Terraform      |
-|  371 | CKV2_AWS_3    | resource                         | aws_guardduty_organization_configuration                                     | Ensure GuardDuty is enabled to specific org/region                                                                                                                                                       | Terraform      |
-|  372 | CKV2_AWS_4    | resource                         | aws_api_gateway_method_settings                                              | Ensure API Gateway stage have logging level defined as appropriate                                                                                                                                       | Terraform      |
-|  373 | CKV2_AWS_4    | resource                         | aws_api_gateway_stage                                                        | Ensure API Gateway stage have logging level defined as appropriate                                                                                                                                       | Terraform      |
+|  368 | CKV2_AWS_2    | resource                         | aws_volume_attachment                                                        | Ensure that only encrypted EBS volumes are attached to EC2 instances                                                                                                                                     | Terraform      |
+|  369 | CKV2_AWS_2    | resource                         | aws_ebs_volume                                                               | Ensure that only encrypted EBS volumes are attached to EC2 instances                                                                                                                                     | Terraform      |
+|  370 | CKV2_AWS_3    | resource                         | aws_guardduty_organization_configuration                                     | Ensure GuardDuty is enabled to specific org/region                                                                                                                                                       | Terraform      |
+|  371 | CKV2_AWS_3    | resource                         | aws_guardduty_detector                                                       | Ensure GuardDuty is enabled to specific org/region                                                                                                                                                       | Terraform      |
+|  372 | CKV2_AWS_4    | resource                         | aws_api_gateway_stage                                                        | Ensure API Gateway stage have logging level defined as appropriate                                                                                                                                       | Terraform      |
+|  373 | CKV2_AWS_4    | resource                         | aws_api_gateway_method_settings                                              | Ensure API Gateway stage have logging level defined as appropriate                                                                                                                                       | Terraform      |
 |  374 | CKV2_AWS_5    | resource                         | aws_security_group                                                           | Ensure that Security Groups are attached to another resource                                                                                                                                             | Terraform      |
 |  375 | CKV2_AWS_6    | resource                         | aws_s3_bucket_public_access_block                                            | Ensure that S3 bucket has a Public Access block                                                                                                                                                          | Terraform      |
 |  376 | CKV2_AWS_6    | resource                         | aws_s3_bucket                                                                | Ensure that S3 bucket has a Public Access block                                                                                                                                                          | Terraform      |
-|  377 | CKV2_AWS_7    | resource                         | aws_security_group                                                           | Ensure that Amazon EMR clusters' security groups are not open to the world                                                                                                                               | Terraform      |
-|  378 | CKV2_AWS_7    | resource                         | aws_emr_cluster                                                              | Ensure that Amazon EMR clusters' security groups are not open to the world                                                                                                                               | Terraform      |
+|  377 | CKV2_AWS_7    | resource                         | aws_emr_cluster                                                              | Ensure that Amazon EMR clusters' security groups are not open to the world                                                                                                                               | Terraform      |
+|  378 | CKV2_AWS_7    | resource                         | aws_security_group                                                           | Ensure that Amazon EMR clusters' security groups are not open to the world                                                                                                                               | Terraform      |
 |  379 | CKV2_AWS_8    | resource                         | aws_rds_cluster                                                              | Ensure that RDS clusters has backup plan of AWS Backup                                                                                                                                                   | Terraform      |
 |  380 | CKV2_AWS_9    | resource                         | aws_backup_selection                                                         | Ensure that EBS are added in the backup plans of AWS Backup                                                                                                                                              | Terraform      |
 |  381 | CKV2_AWS_10   | resource                         | aws_cloudtrail                                                               | Ensure CloudTrail trails are integrated with CloudWatch Logs                                                                                                                                             | Terraform      |
@@ -401,26 +401,26 @@ nav_order: 1
 |  390 | CKV2_AWS_16   | resource                         | aws_appautoscaling_target                                                    | Ensure that Auto Scaling is enabled on your DynamoDB tables                                                                                                                                              | Terraform      |
 |  391 | CKV2_AWS_16   | resource                         | aws_dynamodb_table                                                           | Ensure that Auto Scaling is enabled on your DynamoDB tables                                                                                                                                              | Terraform      |
 |  392 | CKV2_AWS_18   | resource                         | aws_backup_selection                                                         | Ensure that Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup                                                                                                    | Terraform      |
-|  393 | CKV2_AWS_19   | resource                         | aws_eip                                                                      | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances                                                                                                                           | Terraform      |
-|  394 | CKV2_AWS_19   | resource                         | aws_eip_association                                                          | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances                                                                                                                           | Terraform      |
-|  395 | CKV2_AWS_20   | resource                         | aws_lb                                                                       | Ensure that ALB redirects HTTP requests into HTTPS ones                                                                                                                                                  | Terraform      |
-|  396 | CKV2_AWS_20   | resource                         | aws_alb                                                                      | Ensure that ALB redirects HTTP requests into HTTPS ones                                                                                                                                                  | Terraform      |
-|  397 | CKV2_AWS_20   | resource                         | aws_alb_listener                                                             | Ensure that ALB redirects HTTP requests into HTTPS ones                                                                                                                                                  | Terraform      |
-|  398 | CKV2_AWS_20   | resource                         | aws_lb_listener                                                              | Ensure that ALB redirects HTTP requests into HTTPS ones                                                                                                                                                  | Terraform      |
+|  393 | CKV2_AWS_19   | resource                         | aws_eip_association                                                          | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances                                                                                                                           | Terraform      |
+|  394 | CKV2_AWS_19   | resource                         | aws_eip                                                                      | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances                                                                                                                           | Terraform      |
+|  395 | CKV2_AWS_20   | resource                         | aws_alb                                                                      | Ensure that ALB redirects HTTP requests into HTTPS ones                                                                                                                                                  | Terraform      |
+|  396 | CKV2_AWS_20   | resource                         | aws_lb                                                                       | Ensure that ALB redirects HTTP requests into HTTPS ones                                                                                                                                                  | Terraform      |
+|  397 | CKV2_AWS_20   | resource                         | aws_lb_listener                                                              | Ensure that ALB redirects HTTP requests into HTTPS ones                                                                                                                                                  | Terraform      |
+|  398 | CKV2_AWS_20   | resource                         | aws_alb_listener                                                             | Ensure that ALB redirects HTTP requests into HTTPS ones                                                                                                                                                  | Terraform      |
 |  399 | CKV2_AWS_21   | resource                         | aws_iam_group_membership                                                     | Ensure that all IAM users are members of at least one IAM group.                                                                                                                                         | Terraform      |
 |  400 | CKV2_AWS_22   | resource                         | aws_iam_user                                                                 | Ensure an IAM User does not have access to the console                                                                                                                                                   | Terraform      |
 |  401 | CKV2_AWS_23   | resource                         | aws_route53_record                                                           | Route53 A Record has Attached Resource                                                                                                                                                                   | Terraform      |
 |  402 | CKV2_AWS_27   | resource                         | aws_rds_cluster_parameter_group                                              | Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled                                                                                                                                         | Terraform      |
 |  403 | CKV2_AWS_27   | resource                         | aws_rds_cluster                                                              | Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled                                                                                                                                         | Terraform      |
-|  404 | CKV2_AWS_28   | resource                         | aws_lb                                                                       | Ensure public facing ALB are protected by WAF                                                                                                                                                            | Terraform      |
-|  405 | CKV2_AWS_28   | resource                         | aws_alb                                                                      | Ensure public facing ALB are protected by WAF                                                                                                                                                            | Terraform      |
-|  406 | CKV2_AWS_29   | resource                         | aws_api_gateway_rest_api                                                     | Ensure public API gateway are protected by WAF                                                                                                                                                           | Terraform      |
-|  407 | CKV2_AWS_29   | resource                         | aws_api_gateway_stage                                                        | Ensure public API gateway are protected by WAF                                                                                                                                                           | Terraform      |
+|  404 | CKV2_AWS_28   | resource                         | aws_alb                                                                      | Ensure public facing ALB are protected by WAF                                                                                                                                                            | Terraform      |
+|  405 | CKV2_AWS_28   | resource                         | aws_lb                                                                       | Ensure public facing ALB are protected by WAF                                                                                                                                                            | Terraform      |
+|  406 | CKV2_AWS_29   | resource                         | aws_api_gateway_stage                                                        | Ensure public API gateway are protected by WAF                                                                                                                                                           | Terraform      |
+|  407 | CKV2_AWS_29   | resource                         | aws_api_gateway_rest_api                                                     | Ensure public API gateway are protected by WAF                                                                                                                                                           | Terraform      |
 |  408 | CKV2_AWS_30   | resource                         | aws_db_instance                                                              | Ensure Postgres RDS as aws_db_instance has Query Logging enabled                                                                                                                                         | Terraform      |
 |  409 | CKV2_AWS_30   | resource                         | aws_db_parameter_group                                                       | Ensure Postgres RDS as aws_db_instance has Query Logging enabled                                                                                                                                         | Terraform      |
 |  410 | CKV2_AWS_31   | resource                         | aws_wafv2_web_acl                                                            | Ensure WAF2 has a Logging Configuration                                                                                                                                                                  | Terraform      |
-|  411 | CKV2_AWS_32   | resource                         | aws_cloudfront_distribution                                                  | Ensure CloudFront distribution has a strict security headers policy attached                                                                                                                             | Terraform      |
-|  412 | CKV2_AWS_32   | resource                         | aws_cloudfront_response_headers_policy                                       | Ensure CloudFront distribution has a strict security headers policy attached                                                                                                                             | Terraform      |
+|  411 | CKV2_AWS_32   | resource                         | aws_cloudfront_response_headers_policy                                       | Ensure CloudFront distribution has a strict security headers policy attached                                                                                                                             | Terraform      |
+|  412 | CKV2_AWS_32   | resource                         | aws_cloudfront_distribution                                                  | Ensure CloudFront distribution has a strict security headers policy attached                                                                                                                             | Terraform      |
 |  413 | CKV_AZURE_1   | resource                         | azurerm_virtual_machine                                                      | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead)                                                                                                                             | Terraform      |
 |  414 | CKV_AZURE_1   | resource                         | azurerm_linux_virtual_machine                                                | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead)                                                                                                                             | Terraform      |
 |  415 | CKV_AZURE_1   | resource                         | Microsoft.Compute/virtualMachines                                            | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead)                                                                                                                             | arm            |
@@ -478,8 +478,8 @@ nav_order: 1
 |  467 | CKV_AZURE_22  | resource                         | azurerm_security_center_contact                                              | Ensure that 'Send email notification for high severity alerts' is set to 'On'                                                                                                                            | Terraform      |
 |  468 | CKV_AZURE_22  | resource                         | Microsoft.Security/securityContacts                                          | Ensure that 'Send email notification for high severity alerts' is set to 'On'                                                                                                                            | arm            |
 |  469 | CKV_AZURE_23  | resource                         | azurerm_sql_server                                                           | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                                                                    | Terraform      |
-|  470 | CKV_AZURE_23  | resource                         | azurerm_mssql_server_extended_auditing_policy                                | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                                                                    | Terraform      |
-|  471 | CKV_AZURE_23  | resource                         | azurerm_mssql_server                                                         | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                                                                    | Terraform      |
+|  470 | CKV_AZURE_23  | resource                         | azurerm_mssql_server                                                         | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                                                                    | Terraform      |
+|  471 | CKV_AZURE_23  | resource                         | azurerm_mssql_server_extended_auditing_policy                                | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                                                                    | Terraform      |
 |  472 | CKV_AZURE_23  | resource                         | Microsoft.Sql/servers                                                        | Ensure that 'Auditing' is set to 'Enabled' for SQL servers                                                                                                                                               | arm            |
 |  473 | CKV_AZURE_24  | resource                         | azurerm_sql_server                                                           | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers                                                                                                                               | Terraform      |
 |  474 | CKV_AZURE_24  | resource                         | azurerm_mssql_server                                                         | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers                                                                                                                               | Terraform      |
@@ -624,48 +624,48 @@ nav_order: 1
 |  613 | CKV_AZURE_132 | resource                         | azurerm_cosmosdb_account                                                     | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes                                                                                                             | Terraform      |
 |  614 | CKV_AZURE_132 | resource                         | Microsoft.DocumentDB/databaseAccounts                                        | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes                                                                                                             | arm            |
 |  615 | CKV2_AZURE_1  | resource                         | azurerm_storage_account                                                      | Ensure storage for critical data are encrypted with Customer Managed Key                                                                                                                                 | Terraform      |
-|  616 | CKV2_AZURE_2  | resource                         | azurerm_mssql_server_security_alert_policy                                   | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account                                                                                                        | Terraform      |
-|  617 | CKV2_AZURE_2  | resource                         | azurerm_sql_server                                                           | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account                                                                                                        | Terraform      |
-|  618 | CKV2_AZURE_3  | resource                         | azurerm_mssql_server_security_alert_policy                                   | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server                                                                                                                               | Terraform      |
-|  619 | CKV2_AZURE_3  | resource                         | azurerm_sql_server                                                           | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server                                                                                                                               | Terraform      |
+|  616 | CKV2_AZURE_2  | resource                         | azurerm_sql_server                                                           | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account                                                                                                        | Terraform      |
+|  617 | CKV2_AZURE_2  | resource                         | azurerm_mssql_server_security_alert_policy                                   | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account                                                                                                        | Terraform      |
+|  618 | CKV2_AZURE_3  | resource                         | azurerm_sql_server                                                           | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server                                                                                                                               | Terraform      |
+|  619 | CKV2_AZURE_3  | resource                         | azurerm_mssql_server                                                         | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server                                                                                                                               | Terraform      |
 |  620 | CKV2_AZURE_3  | resource                         | azurerm_mssql_server_vulnerability_assessment                                | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server                                                                                                                               | Terraform      |
-|  621 | CKV2_AZURE_3  | resource                         | azurerm_mssql_server                                                         | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server                                                                                                                               | Terraform      |
-|  622 | CKV2_AZURE_4  | resource                         | azurerm_mssql_server_security_alert_policy                                   | Ensure Azure SQL server ADS VA Send scan reports to is configured                                                                                                                                        | Terraform      |
-|  623 | CKV2_AZURE_4  | resource                         | azurerm_sql_server                                                           | Ensure Azure SQL server ADS VA Send scan reports to is configured                                                                                                                                        | Terraform      |
+|  621 | CKV2_AZURE_3  | resource                         | azurerm_mssql_server_security_alert_policy                                   | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server                                                                                                                               | Terraform      |
+|  622 | CKV2_AZURE_4  | resource                         | azurerm_sql_server                                                           | Ensure Azure SQL server ADS VA Send scan reports to is configured                                                                                                                                        | Terraform      |
+|  623 | CKV2_AZURE_4  | resource                         | azurerm_mssql_server                                                         | Ensure Azure SQL server ADS VA Send scan reports to is configured                                                                                                                                        | Terraform      |
 |  624 | CKV2_AZURE_4  | resource                         | azurerm_mssql_server_vulnerability_assessment                                | Ensure Azure SQL server ADS VA Send scan reports to is configured                                                                                                                                        | Terraform      |
-|  625 | CKV2_AZURE_4  | resource                         | azurerm_mssql_server                                                         | Ensure Azure SQL server ADS VA Send scan reports to is configured                                                                                                                                        | Terraform      |
-|  626 | CKV2_AZURE_5  | resource                         | azurerm_mssql_server_security_alert_policy                                   | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server                                                                                         | Terraform      |
-|  627 | CKV2_AZURE_5  | resource                         | azurerm_sql_server                                                           | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server                                                                                         | Terraform      |
+|  625 | CKV2_AZURE_4  | resource                         | azurerm_mssql_server_security_alert_policy                                   | Ensure Azure SQL server ADS VA Send scan reports to is configured                                                                                                                                        | Terraform      |
+|  626 | CKV2_AZURE_5  | resource                         | azurerm_sql_server                                                           | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server                                                                                         | Terraform      |
+|  627 | CKV2_AZURE_5  | resource                         | azurerm_mssql_server                                                         | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server                                                                                         | Terraform      |
 |  628 | CKV2_AZURE_5  | resource                         | azurerm_mssql_server_vulnerability_assessment                                | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server                                                                                         | Terraform      |
-|  629 | CKV2_AZURE_5  | resource                         | azurerm_mssql_server                                                         | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server                                                                                         | Terraform      |
+|  629 | CKV2_AZURE_5  | resource                         | azurerm_mssql_server_security_alert_policy                                   | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server                                                                                         | Terraform      |
 |  630 | CKV2_AZURE_6  | resource                         | azurerm_sql_server                                                           | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled                                                                                                                       | Terraform      |
 |  631 | CKV2_AZURE_6  | resource                         | azurerm_sql_firewall_rule                                                    | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled                                                                                                                       | Terraform      |
 |  632 | CKV2_AZURE_7  | resource                         | azurerm_sql_server                                                           | Ensure that Azure Active Directory Admin is configured                                                                                                                                                   | Terraform      |
-|  633 | CKV2_AZURE_8  | resource                         | azurerm_monitor_activity_log_alert                                           | Ensure the storage container storing the activity logs is not publicly accessible                                                                                                                        | Terraform      |
-|  634 | CKV2_AZURE_8  | resource                         | azurerm_storage_container                                                    | Ensure the storage container storing the activity logs is not publicly accessible                                                                                                                        | Terraform      |
+|  633 | CKV2_AZURE_8  | resource                         | azurerm_storage_container                                                    | Ensure the storage container storing the activity logs is not publicly accessible                                                                                                                        | Terraform      |
+|  634 | CKV2_AZURE_8  | resource                         | azurerm_monitor_activity_log_alert                                           | Ensure the storage container storing the activity logs is not publicly accessible                                                                                                                        | Terraform      |
 |  635 | CKV2_AZURE_9  | resource                         | azurerm_virtual_machine                                                      | Ensure Virtual Machines are utilizing Managed Disks                                                                                                                                                      | Terraform      |
 |  636 | CKV2_AZURE_10 | resource                         | azurerm_virtual_machine_extension                                            | Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines                                                                                                            | Terraform      |
 |  637 | CKV2_AZURE_10 | resource                         | azurerm_virtual_machine                                                      | Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines                                                                                                            | Terraform      |
 |  638 | CKV2_AZURE_11 | resource                         | azurerm_kusto_cluster                                                        | Ensure that Azure Data Explorer encryption at rest uses a customer-managed key                                                                                                                           | Terraform      |
 |  639 | CKV2_AZURE_12 | resource                         | azurerm_virtual_machine                                                      | Ensure that virtual machines are backed up using Azure Backup                                                                                                                                            | Terraform      |
-|  640 | CKV2_AZURE_13 | resource                         | azurerm_mssql_server_security_alert_policy                                   | Ensure that sql servers enables data security policy                                                                                                                                                     | Terraform      |
-|  641 | CKV2_AZURE_13 | resource                         | azurerm_sql_server                                                           | Ensure that sql servers enables data security policy                                                                                                                                                     | Terraform      |
-|  642 | CKV2_AZURE_14 | resource                         | azurerm_virtual_machine                                                      | Ensure that Unattached disks are encrypted                                                                                                                                                               | Terraform      |
-|  643 | CKV2_AZURE_14 | resource                         | azurerm_managed_disk                                                         | Ensure that Unattached disks are encrypted                                                                                                                                                               | Terraform      |
+|  640 | CKV2_AZURE_13 | resource                         | azurerm_sql_server                                                           | Ensure that sql servers enables data security policy                                                                                                                                                     | Terraform      |
+|  641 | CKV2_AZURE_13 | resource                         | azurerm_mssql_server_security_alert_policy                                   | Ensure that sql servers enables data security policy                                                                                                                                                     | Terraform      |
+|  642 | CKV2_AZURE_14 | resource                         | azurerm_managed_disk                                                         | Ensure that Unattached disks are encrypted                                                                                                                                                               | Terraform      |
+|  643 | CKV2_AZURE_14 | resource                         | azurerm_virtual_machine                                                      | Ensure that Unattached disks are encrypted                                                                                                                                                               | Terraform      |
 |  644 | CKV2_AZURE_15 | resource                         | azurerm_data_factory                                                         | Ensure that Azure data factories are encrypted with a customer-managed key                                                                                                                               | Terraform      |
-|  645 | CKV2_AZURE_16 | resource                         | azurerm_mysql_server                                                         | Ensure that MySQL server enables customer-managed key for encryption                                                                                                                                     | Terraform      |
-|  646 | CKV2_AZURE_16 | resource                         | azurerm_mysql_server_key                                                     | Ensure that MySQL server enables customer-managed key for encryption                                                                                                                                     | Terraform      |
-|  647 | CKV2_AZURE_17 | resource                         | azurerm_postgresql_server                                                    | Ensure that PostgreSQL server enables customer-managed key for encryption                                                                                                                                | Terraform      |
-|  648 | CKV2_AZURE_17 | resource                         | azurerm_postgresql_server_key                                                | Ensure that PostgreSQL server enables customer-managed key for encryption                                                                                                                                | Terraform      |
+|  645 | CKV2_AZURE_16 | resource                         | azurerm_mysql_server_key                                                     | Ensure that MySQL server enables customer-managed key for encryption                                                                                                                                     | Terraform      |
+|  646 | CKV2_AZURE_16 | resource                         | azurerm_mysql_server                                                         | Ensure that MySQL server enables customer-managed key for encryption                                                                                                                                     | Terraform      |
+|  647 | CKV2_AZURE_17 | resource                         | azurerm_postgresql_server_key                                                | Ensure that PostgreSQL server enables customer-managed key for encryption                                                                                                                                | Terraform      |
+|  648 | CKV2_AZURE_17 | resource                         | azurerm_postgresql_server                                                    | Ensure that PostgreSQL server enables customer-managed key for encryption                                                                                                                                | Terraform      |
 |  649 | CKV2_AZURE_18 | resource                         | azurerm_storage_account                                                      | Ensure that Storage Accounts use customer-managed key for encryption                                                                                                                                     | Terraform      |
 |  650 | CKV2_AZURE_18 | resource                         | azurerm_storage_account_customer_managed_key                                 | Ensure that Storage Accounts use customer-managed key for encryption                                                                                                                                     | Terraform      |
 |  651 | CKV2_AZURE_19 | resource                         | azurerm_synapse_workspace                                                    | Ensure that Azure Synapse workspaces have no IP firewall rules attached                                                                                                                                  | Terraform      |
 |  652 | CKV2_AZURE_20 | resource                         | azurerm_storage_account                                                      | Ensure Storage logging is enabled for Table service for read requests                                                                                                                                    | Terraform      |
 |  653 | CKV2_AZURE_20 | resource                         | azurerm_log_analytics_storage_insights                                       | Ensure Storage logging is enabled for Table service for read requests                                                                                                                                    | Terraform      |
 |  654 | CKV2_AZURE_20 | resource                         | azurerm_storage_table                                                        | Ensure Storage logging is enabled for Table service for read requests                                                                                                                                    | Terraform      |
-|  655 | CKV2_AZURE_21 | resource                         | azurerm_storage_account                                                      | Ensure Storage logging is enabled for Blob service for read requests                                                                                                                                     | Terraform      |
-|  656 | CKV2_AZURE_21 | resource                         | azurerm_log_analytics_storage_insights                                       | Ensure Storage logging is enabled for Blob service for read requests                                                                                                                                     | Terraform      |
-|  657 | CKV2_AZURE_21 | resource                         | azurerm_storage_container                                                    | Ensure Storage logging is enabled for Blob service for read requests                                                                                                                                     | Terraform      |
+|  655 | CKV2_AZURE_21 | resource                         | azurerm_storage_container                                                    | Ensure Storage logging is enabled for Blob service for read requests                                                                                                                                     | Terraform      |
+|  656 | CKV2_AZURE_21 | resource                         | azurerm_storage_account                                                      | Ensure Storage logging is enabled for Blob service for read requests                                                                                                                                     | Terraform      |
+|  657 | CKV2_AZURE_21 | resource                         | azurerm_log_analytics_storage_insights                                       | Ensure Storage logging is enabled for Blob service for read requests                                                                                                                                     | Terraform      |
 |  658 | CKV_BCW_1     | provider                         | bridgecrew                                                                   | Ensure no hard coded API token exist in the provider                                                                                                                                                     | Terraform      |
 |  659 | CKV_DOCKER_1  | dockerfile                       | EXPOSE                                                                       | Ensure port 22 is not exposed                                                                                                                                                                            | dockerfile     |
 |  660 | CKV_DOCKER_2  | dockerfile                       | *                                                                            | Ensure that HEALTHCHECK instructions have been added to container images                                                                                                                                 | dockerfile     |
@@ -762,13 +762,13 @@ nav_order: 1
 |  751 | CKV2_GCP_3    | resource                         | google_service_account_key                                                   | Ensure that there are only GCP-managed service account keys for each service account                                                                                                                     | Terraform      |
 |  752 | CKV2_GCP_4    | resource                         | google_logging_project_sink                                                  | Ensure that retention policies on log buckets are configured using Bucket Lock                                                                                                                           | Terraform      |
 |  753 | CKV2_GCP_4    | resource                         | google_logging_organization_sink                                             | Ensure that retention policies on log buckets are configured using Bucket Lock                                                                                                                           | Terraform      |
-|  754 | CKV2_GCP_4    | resource                         | google_storage_bucket                                                        | Ensure that retention policies on log buckets are configured using Bucket Lock                                                                                                                           | Terraform      |
-|  755 | CKV2_GCP_4    | resource                         | google_logging_folder_sink                                                   | Ensure that retention policies on log buckets are configured using Bucket Lock                                                                                                                           | Terraform      |
-|  756 | CKV2_GCP_5    | resource                         | google_project                                                               | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project                                                                                                  | Terraform      |
-|  757 | CKV2_GCP_5    | resource                         | google_project_iam_audit_config                                              | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project                                                                                                  | Terraform      |
+|  754 | CKV2_GCP_4    | resource                         | google_logging_folder_sink                                                   | Ensure that retention policies on log buckets are configured using Bucket Lock                                                                                                                           | Terraform      |
+|  755 | CKV2_GCP_4    | resource                         | google_storage_bucket                                                        | Ensure that retention policies on log buckets are configured using Bucket Lock                                                                                                                           | Terraform      |
+|  756 | CKV2_GCP_5    | resource                         | google_project_iam_audit_config                                              | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project                                                                                                  | Terraform      |
+|  757 | CKV2_GCP_5    | resource                         | google_project                                                               | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project                                                                                                  | Terraform      |
 |  758 | CKV2_GCP_6    | resource                         | google_kms_crypto_key                                                        | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible                                                                                                                              | Terraform      |
-|  759 | CKV2_GCP_6    | resource                         | google_kms_crypto_key_iam_member                                             | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible                                                                                                                              | Terraform      |
-|  760 | CKV2_GCP_6    | resource                         | google_kms_crypto_key_iam_binding                                            | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible                                                                                                                              | Terraform      |
+|  759 | CKV2_GCP_6    | resource                         | google_kms_crypto_key_iam_binding                                            | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible                                                                                                                              | Terraform      |
+|  760 | CKV2_GCP_6    | resource                         | google_kms_crypto_key_iam_member                                             | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible                                                                                                                              | Terraform      |
 |  761 | CKV2_GCP_7    | resource                         | google_sql_database_instance                                                 | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges                                                                                                    | Terraform      |
 |  762 | CKV2_GCP_7    | resource                         | google_sql_user                                                              | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges                                                                                                    | Terraform      |
 |  763 | CKV_GIT_1     | resource                         | github_repository                                                            | Ensure Repository is Private                                                                                                                                                                             | Terraform      |
diff --git a/docs/5.Policy Index/terraform.md b/docs/5.Policy Index/terraform.md
index 40fddeeae..0bbc711f1 100644
--- a/docs/5.Policy Index/terraform.md
+++ b/docs/5.Policy Index/terraform.md
@@ -229,37 +229,37 @@ nav_order: 1
 | 218 | CKV_AWS_191   | resource | aws_elasticache_replication_group               | Ensure Elasticache replication group is encrypted by KMS using a customer managed Key (CMK)                                                                                                              | Terraform |
 | 219 | CKV2_AWS_1    | resource | aws_network_acl                                 | Ensure that all NACL are attached to subnets                                                                                                                                                             | Terraform |
 | 220 | CKV2_AWS_1    | resource | aws_subnet                                      | Ensure that all NACL are attached to subnets                                                                                                                                                             | Terraform |
-| 221 | CKV2_AWS_2    | resource | aws_ebs_volume                                  | Ensure that only encrypted EBS volumes are attached to EC2 instances                                                                                                                                     | Terraform |
-| 222 | CKV2_AWS_2    | resource | aws_volume_attachment                           | Ensure that only encrypted EBS volumes are attached to EC2 instances                                                                                                                                     | Terraform |
+| 221 | CKV2_AWS_2    | resource | aws_volume_attachment                           | Ensure that only encrypted EBS volumes are attached to EC2 instances                                                                                                                                     | Terraform |
+| 222 | CKV2_AWS_2    | resource | aws_ebs_volume                                  | Ensure that only encrypted EBS volumes are attached to EC2 instances                                                                                                                                     | Terraform |
 | 223 | CKV2_AWS_3    | resource | aws_guardduty_organization_configuration        | Ensure GuardDuty is enabled to specific org/region                                                                                                                                                       | Terraform |
 | 224 | CKV2_AWS_3    | resource | aws_guardduty_detector                          | Ensure GuardDuty is enabled to specific org/region                                                                                                                                                       | Terraform |
-| 225 | CKV2_AWS_4    | resource | aws_api_gateway_method_settings                 | Ensure API Gateway stage have logging level defined as appropriate                                                                                                                                       | Terraform |
-| 226 | CKV2_AWS_4    | resource | aws_api_gateway_stage                           | Ensure API Gateway stage have logging level defined as appropriate                                                                                                                                       | Terraform |
+| 225 | CKV2_AWS_4    | resource | aws_api_gateway_stage                           | Ensure API Gateway stage have logging level defined as appropriate                                                                                                                                       | Terraform |
+| 226 | CKV2_AWS_4    | resource | aws_api_gateway_method_settings                 | Ensure API Gateway stage have logging level defined as appropriate                                                                                                                                       | Terraform |
 | 227 | CKV2_AWS_5    | resource | aws_security_group                              | Ensure that Security Groups are attached to another resource                                                                                                                                             | Terraform |
-| 228 | CKV2_AWS_6    | resource | aws_s3_bucket                                   | Ensure that S3 bucket has a Public Access block                                                                                                                                                          | Terraform |
-| 229 | CKV2_AWS_6    | resource | aws_s3_bucket_public_access_block               | Ensure that S3 bucket has a Public Access block                                                                                                                                                          | Terraform |
-| 230 | CKV2_AWS_7    | resource | aws_security_group                              | Ensure that Amazon EMR clusters' security groups are not open to the world                                                                                                                               | Terraform |
-| 231 | CKV2_AWS_7    | resource | aws_emr_cluster                                 | Ensure that Amazon EMR clusters' security groups are not open to the world                                                                                                                               | Terraform |
+| 228 | CKV2_AWS_6    | resource | aws_s3_bucket_public_access_block               | Ensure that S3 bucket has a Public Access block                                                                                                                                                          | Terraform |
+| 229 | CKV2_AWS_6    | resource | aws_s3_bucket                                   | Ensure that S3 bucket has a Public Access block                                                                                                                                                          | Terraform |
+| 230 | CKV2_AWS_7    | resource | aws_emr_cluster                                 | Ensure that Amazon EMR clusters' security groups are not open to the world                                                                                                                               | Terraform |
+| 231 | CKV2_AWS_7    | resource | aws_security_group                              | Ensure that Amazon EMR clusters' security groups are not open to the world                                                                                                                               | Terraform |
 | 232 | CKV2_AWS_8    | resource | aws_rds_cluster                                 | Ensure that RDS clusters has backup plan of AWS Backup                                                                                                                                                   | Terraform |
 | 233 | CKV2_AWS_9    | resource | aws_backup_selection                            | Ensure that EBS are added in the backup plans of AWS Backup                                                                                                                                              | Terraform |
 | 234 | CKV2_AWS_10   | resource | aws_cloudtrail                                  | Ensure CloudTrail trails are integrated with CloudWatch Logs                                                                                                                                             | Terraform |
 | 235 | CKV2_AWS_11   | resource | aws_vpc                                         | Ensure VPC flow logging is enabled in all VPCs                                                                                                                                                           | Terraform |
-| 236 | CKV2_AWS_12   | resource | aws_vpc                                         | Ensure the default security group of every VPC restricts all traffic                                                                                                                                     | Terraform |
-| 237 | CKV2_AWS_12   | resource | aws_default_security_group                      | Ensure the default security group of every VPC restricts all traffic                                                                                                                                     | Terraform |
+| 236 | CKV2_AWS_12   | resource | aws_default_security_group                      | Ensure the default security group of every VPC restricts all traffic                                                                                                                                     | Terraform |
+| 237 | CKV2_AWS_12   | resource | aws_vpc                                         | Ensure the default security group of every VPC restricts all traffic                                                                                                                                     | Terraform |
 | 238 | CKV2_AWS_13   | resource | aws_redshift_cluster                            | Ensure that Redshift clusters has backup plan of AWS Backup                                                                                                                                              | Terraform |
 | 239 | CKV2_AWS_14   | resource | aws_iam_group                                   | Ensure that IAM groups includes at least one IAM user                                                                                                                                                    | Terraform |
 | 240 | CKV2_AWS_14   | resource | aws_iam_group_membership                        | Ensure that IAM groups includes at least one IAM user                                                                                                                                                    | Terraform |
-| 241 | CKV2_AWS_15   | resource | aws_autoscaling_group                           | Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks.                                                                                | Terraform |
-| 242 | CKV2_AWS_15   | resource | aws_elb                                         | Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks.                                                                                | Terraform |
+| 241 | CKV2_AWS_15   | resource | aws_elb                                         | Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks.                                                                                | Terraform |
+| 242 | CKV2_AWS_15   | resource | aws_autoscaling_group                           | Ensure that auto Scaling groups that are associated with a load balancer, are using Elastic Load Balancing health checks.                                                                                | Terraform |
 | 243 | CKV2_AWS_16   | resource | aws_appautoscaling_target                       | Ensure that Auto Scaling is enabled on your DynamoDB tables                                                                                                                                              | Terraform |
 | 244 | CKV2_AWS_16   | resource | aws_dynamodb_table                              | Ensure that Auto Scaling is enabled on your DynamoDB tables                                                                                                                                              | Terraform |
 | 245 | CKV2_AWS_18   | resource | aws_backup_selection                            | Ensure that Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup                                                                                                    | Terraform |
 | 246 | CKV2_AWS_19   | resource | aws_eip_association                             | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances                                                                                                                           | Terraform |
 | 247 | CKV2_AWS_19   | resource | aws_eip                                         | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances                                                                                                                           | Terraform |
 | 248 | CKV2_AWS_20   | resource | aws_alb                                         | Ensure that ALB redirects HTTP requests into HTTPS ones                                                                                                                                                  | Terraform |
-| 249 | CKV2_AWS_20   | resource | aws_lb_listener                                 | Ensure that ALB redirects HTTP requests into HTTPS ones                                                                                                                                                  | Terraform |
-| 250 | CKV2_AWS_20   | resource | aws_lb                                          | Ensure that ALB redirects HTTP requests into HTTPS ones                                                                                                                                                  | Terraform |
-| 251 | CKV2_AWS_20   | resource | aws_alb_listener                                | Ensure that ALB redirects HTTP requests into HTTPS ones                                                                                                                                                  | Terraform |
+| 249 | CKV2_AWS_20   | resource | aws_lb                                          | Ensure that ALB redirects HTTP requests into HTTPS ones                                                                                                                                                  | Terraform |
+| 250 | CKV2_AWS_20   | resource | aws_alb_listener                                | Ensure that ALB redirects HTTP requests into HTTPS ones                                                                                                                                                  | Terraform |
+| 251 | CKV2_AWS_20   | resource | aws_lb_listener                                 | Ensure that ALB redirects HTTP requests into HTTPS ones                                                                                                                                                  | Terraform |
 | 252 | CKV2_AWS_21   | resource | aws_iam_group_membership                        | Ensure that all IAM users are members of at least one IAM group.                                                                                                                                         | Terraform |
 | 253 | CKV2_AWS_22   | resource | aws_iam_user                                    | Ensure an IAM User does not have access to the console                                                                                                                                                   | Terraform |
 | 254 | CKV2_AWS_23   | resource | aws_route53_record                              | Route53 A Record has Attached Resource                                                                                                                                                                   | Terraform |
@@ -269,8 +269,8 @@ nav_order: 1
 | 258 | CKV2_AWS_28   | resource | aws_lb                                          | Ensure public facing ALB are protected by WAF                                                                                                                                                            | Terraform |
 | 259 | CKV2_AWS_29   | resource | aws_api_gateway_rest_api                        | Ensure public API gateway are protected by WAF                                                                                                                                                           | Terraform |
 | 260 | CKV2_AWS_29   | resource | aws_api_gateway_stage                           | Ensure public API gateway are protected by WAF                                                                                                                                                           | Terraform |
-| 261 | CKV2_AWS_30   | resource | aws_db_parameter_group                          | Ensure Postgres RDS as aws_db_instance has Query Logging enabled                                                                                                                                         | Terraform |
-| 262 | CKV2_AWS_30   | resource | aws_db_instance                                 | Ensure Postgres RDS as aws_db_instance has Query Logging enabled                                                                                                                                         | Terraform |
+| 261 | CKV2_AWS_30   | resource | aws_db_instance                                 | Ensure Postgres RDS as aws_db_instance has Query Logging enabled                                                                                                                                         | Terraform |
+| 262 | CKV2_AWS_30   | resource | aws_db_parameter_group                          | Ensure Postgres RDS as aws_db_instance has Query Logging enabled                                                                                                                                         | Terraform |
 | 263 | CKV2_AWS_31   | resource | aws_wafv2_web_acl                               | Ensure WAF2 has a Logging Configuration                                                                                                                                                                  | Terraform |
 | 264 | CKV2_AWS_32   | resource | aws_cloudfront_response_headers_policy          | Ensure CloudFront distribution has a strict security headers policy attached                                                                                                                             | Terraform |
 | 265 | CKV2_AWS_32   | resource | aws_cloudfront_distribution                     | Ensure CloudFront distribution has a strict security headers policy attached                                                                                                                             | Terraform |
@@ -302,9 +302,9 @@ nav_order: 1
 | 291 | CKV_AZURE_20  | resource | azurerm_security_center_contact                 | Ensure that security contact 'Phone number' is set                                                                                                                                                       | Terraform |
 | 292 | CKV_AZURE_21  | resource | azurerm_security_center_contact                 | Ensure that 'Send email notification for high severity alerts' is set to 'On'                                                                                                                            | Terraform |
 | 293 | CKV_AZURE_22  | resource | azurerm_security_center_contact                 | Ensure that 'Send email notification for high severity alerts' is set to 'On'                                                                                                                            | Terraform |
-| 294 | CKV_AZURE_23  | resource | azurerm_sql_server                              | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                                                                    | Terraform |
-| 295 | CKV_AZURE_23  | resource | azurerm_mssql_server_extended_auditing_policy   | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                                                                    | Terraform |
-| 296 | CKV_AZURE_23  | resource | azurerm_mssql_server                            | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                                                                    | Terraform |
+| 294 | CKV_AZURE_23  | resource | azurerm_mssql_server                            | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                                                                    | Terraform |
+| 295 | CKV_AZURE_23  | resource | azurerm_sql_server                              | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                                                                    | Terraform |
+| 296 | CKV_AZURE_23  | resource | azurerm_mssql_server_extended_auditing_policy   | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                                                                    | Terraform |
 | 297 | CKV_AZURE_24  | resource | azurerm_sql_server                              | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers                                                                                                                               | Terraform |
 | 298 | CKV_AZURE_24  | resource | azurerm_mssql_server                            | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers                                                                                                                               | Terraform |
 | 299 | CKV_AZURE_25  | resource | azurerm_mssql_server_security_alert_policy      | Ensure that 'Threat Detection types' is set to 'All'                                                                                                                                                     | Terraform |
@@ -425,17 +425,17 @@ nav_order: 1
 | 414 | CKV2_AZURE_1  | resource | azurerm_storage_account                         | Ensure storage for critical data are encrypted with Customer Managed Key                                                                                                                                 | Terraform |
 | 415 | CKV2_AZURE_2  | resource | azurerm_sql_server                              | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account                                                                                                        | Terraform |
 | 416 | CKV2_AZURE_2  | resource | azurerm_mssql_server_security_alert_policy      | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account                                                                                                        | Terraform |
-| 417 | CKV2_AZURE_3  | resource | azurerm_sql_server                              | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server                                                                                                                               | Terraform |
-| 418 | CKV2_AZURE_3  | resource | azurerm_mssql_server_vulnerability_assessment   | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server                                                                                                                               | Terraform |
-| 419 | CKV2_AZURE_3  | resource | azurerm_mssql_server                            | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server                                                                                                                               | Terraform |
+| 417 | CKV2_AZURE_3  | resource | azurerm_mssql_server                            | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server                                                                                                                               | Terraform |
+| 418 | CKV2_AZURE_3  | resource | azurerm_sql_server                              | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server                                                                                                                               | Terraform |
+| 419 | CKV2_AZURE_3  | resource | azurerm_mssql_server_vulnerability_assessment   | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server                                                                                                                               | Terraform |
 | 420 | CKV2_AZURE_3  | resource | azurerm_mssql_server_security_alert_policy      | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server                                                                                                                               | Terraform |
-| 421 | CKV2_AZURE_4  | resource | azurerm_sql_server                              | Ensure Azure SQL server ADS VA Send scan reports to is configured                                                                                                                                        | Terraform |
-| 422 | CKV2_AZURE_4  | resource | azurerm_mssql_server_vulnerability_assessment   | Ensure Azure SQL server ADS VA Send scan reports to is configured                                                                                                                                        | Terraform |
-| 423 | CKV2_AZURE_4  | resource | azurerm_mssql_server                            | Ensure Azure SQL server ADS VA Send scan reports to is configured                                                                                                                                        | Terraform |
+| 421 | CKV2_AZURE_4  | resource | azurerm_mssql_server                            | Ensure Azure SQL server ADS VA Send scan reports to is configured                                                                                                                                        | Terraform |
+| 422 | CKV2_AZURE_4  | resource | azurerm_sql_server                              | Ensure Azure SQL server ADS VA Send scan reports to is configured                                                                                                                                        | Terraform |
+| 423 | CKV2_AZURE_4  | resource | azurerm_mssql_server_vulnerability_assessment   | Ensure Azure SQL server ADS VA Send scan reports to is configured                                                                                                                                        | Terraform |
 | 424 | CKV2_AZURE_4  | resource | azurerm_mssql_server_security_alert_policy      | Ensure Azure SQL server ADS VA Send scan reports to is configured                                                                                                                                        | Terraform |
-| 425 | CKV2_AZURE_5  | resource | azurerm_sql_server                              | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server                                                                                         | Terraform |
-| 426 | CKV2_AZURE_5  | resource | azurerm_mssql_server_vulnerability_assessment   | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server                                                                                         | Terraform |
-| 427 | CKV2_AZURE_5  | resource | azurerm_mssql_server                            | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server                                                                                         | Terraform |
+| 425 | CKV2_AZURE_5  | resource | azurerm_mssql_server                            | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server                                                                                         | Terraform |
+| 426 | CKV2_AZURE_5  | resource | azurerm_sql_server                              | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server                                                                                         | Terraform |
+| 427 | CKV2_AZURE_5  | resource | azurerm_mssql_server_vulnerability_assessment   | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server                                                                                         | Terraform |
 | 428 | CKV2_AZURE_5  | resource | azurerm_mssql_server_security_alert_policy      | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server                                                                                         | Terraform |
 | 429 | CKV2_AZURE_6  | resource | azurerm_sql_server                              | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled                                                                                                                       | Terraform |
 | 430 | CKV2_AZURE_6  | resource | azurerm_sql_firewall_rule                       | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled                                                                                                                       | Terraform |
@@ -449,22 +449,22 @@ nav_order: 1
 | 438 | CKV2_AZURE_12 | resource | azurerm_virtual_machine                         | Ensure that virtual machines are backed up using Azure Backup                                                                                                                                            | Terraform |
 | 439 | CKV2_AZURE_13 | resource | azurerm_sql_server                              | Ensure that sql servers enables data security policy                                                                                                                                                     | Terraform |
 | 440 | CKV2_AZURE_13 | resource | azurerm_mssql_server_security_alert_policy      | Ensure that sql servers enables data security policy                                                                                                                                                     | Terraform |
-| 441 | CKV2_AZURE_14 | resource | azurerm_virtual_machine                         | Ensure that Unattached disks are encrypted                                                                                                                                                               | Terraform |
-| 442 | CKV2_AZURE_14 | resource | azurerm_managed_disk                            | Ensure that Unattached disks are encrypted                                                                                                                                                               | Terraform |
+| 441 | CKV2_AZURE_14 | resource | azurerm_managed_disk                            | Ensure that Unattached disks are encrypted                                                                                                                                                               | Terraform |
+| 442 | CKV2_AZURE_14 | resource | azurerm_virtual_machine                         | Ensure that Unattached disks are encrypted                                                                                                                                                               | Terraform |
 | 443 | CKV2_AZURE_15 | resource | azurerm_data_factory                            | Ensure that Azure data factories are encrypted with a customer-managed key                                                                                                                               | Terraform |
-| 444 | CKV2_AZURE_16 | resource | azurerm_mysql_server                            | Ensure that MySQL server enables customer-managed key for encryption                                                                                                                                     | Terraform |
-| 445 | CKV2_AZURE_16 | resource | azurerm_mysql_server_key                        | Ensure that MySQL server enables customer-managed key for encryption                                                                                                                                     | Terraform |
+| 444 | CKV2_AZURE_16 | resource | azurerm_mysql_server_key                        | Ensure that MySQL server enables customer-managed key for encryption                                                                                                                                     | Terraform |
+| 445 | CKV2_AZURE_16 | resource | azurerm_mysql_server                            | Ensure that MySQL server enables customer-managed key for encryption                                                                                                                                     | Terraform |
 | 446 | CKV2_AZURE_17 | resource | azurerm_postgresql_server                       | Ensure that PostgreSQL server enables customer-managed key for encryption                                                                                                                                | Terraform |
 | 447 | CKV2_AZURE_17 | resource | azurerm_postgresql_server_key                   | Ensure that PostgreSQL server enables customer-managed key for encryption                                                                                                                                | Terraform |
-| 448 | CKV2_AZURE_18 | resource | azurerm_storage_account_customer_managed_key    | Ensure that Storage Accounts use customer-managed key for encryption                                                                                                                                     | Terraform |
-| 449 | CKV2_AZURE_18 | resource | azurerm_storage_account                         | Ensure that Storage Accounts use customer-managed key for encryption                                                                                                                                     | Terraform |
+| 448 | CKV2_AZURE_18 | resource | azurerm_storage_account                         | Ensure that Storage Accounts use customer-managed key for encryption                                                                                                                                     | Terraform |
+| 449 | CKV2_AZURE_18 | resource | azurerm_storage_account_customer_managed_key    | Ensure that Storage Accounts use customer-managed key for encryption                                                                                                                                     | Terraform |
 | 450 | CKV2_AZURE_19 | resource | azurerm_synapse_workspace                       | Ensure that Azure Synapse workspaces have no IP firewall rules attached                                                                                                                                  | Terraform |
-| 451 | CKV2_AZURE_20 | resource | azurerm_storage_table                           | Ensure Storage logging is enabled for Table service for read requests                                                                                                                                    | Terraform |
+| 451 | CKV2_AZURE_20 | resource | azurerm_storage_account                         | Ensure Storage logging is enabled for Table service for read requests                                                                                                                                    | Terraform |
 | 452 | CKV2_AZURE_20 | resource | azurerm_log_analytics_storage_insights          | Ensure Storage logging is enabled for Table service for read requests                                                                                                                                    | Terraform |
-| 453 | CKV2_AZURE_20 | resource | azurerm_storage_account                         | Ensure Storage logging is enabled for Table service for read requests                                                                                                                                    | Terraform |
-| 454 | CKV2_AZURE_21 | resource | azurerm_storage_container                       | Ensure Storage logging is enabled for Blob service for read requests                                                                                                                                     | Terraform |
+| 453 | CKV2_AZURE_20 | resource | azurerm_storage_table                           | Ensure Storage logging is enabled for Table service for read requests                                                                                                                                    | Terraform |
+| 454 | CKV2_AZURE_21 | resource | azurerm_storage_account                         | Ensure Storage logging is enabled for Blob service for read requests                                                                                                                                     | Terraform |
 | 455 | CKV2_AZURE_21 | resource | azurerm_log_analytics_storage_insights          | Ensure Storage logging is enabled for Blob service for read requests                                                                                                                                     | Terraform |
-| 456 | CKV2_AZURE_21 | resource | azurerm_storage_account                         | Ensure Storage logging is enabled for Blob service for read requests                                                                                                                                     | Terraform |
+| 456 | CKV2_AZURE_21 | resource | azurerm_storage_container                       | Ensure Storage logging is enabled for Blob service for read requests                                                                                                                                     | Terraform |
 | 457 | CKV_BCW_1     | provider | bridgecrew                                      | Ensure no hard coded API token exist in the provider                                                                                                                                                     | Terraform |
 | 458 | CKV_GCP_1     | resource | google_container_cluster                        | Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters                                                                                                                               | Terraform |
 | 459 | CKV_GCP_2     | resource | google_compute_firewall                         | Ensure Google compute firewall ingress does not allow unrestricted ssh access                                                                                                                            | Terraform |
@@ -551,15 +551,15 @@ nav_order: 1
 | 540 | CKV2_GCP_1    | resource | google_project_default_service_accounts         | Ensure GKE clusters are not running using the Compute Engine default service account                                                                                                                     | Terraform |
 | 541 | CKV2_GCP_2    | resource | google_compute_network                          | Ensure legacy networks do not exist for a project                                                                                                                                                        | Terraform |
 | 542 | CKV2_GCP_3    | resource | google_service_account_key                      | Ensure that there are only GCP-managed service account keys for each service account                                                                                                                     | Terraform |
-| 543 | CKV2_GCP_4    | resource | google_logging_organization_sink                | Ensure that retention policies on log buckets are configured using Bucket Lock                                                                                                                           | Terraform |
-| 544 | CKV2_GCP_4    | resource | google_logging_folder_sink                      | Ensure that retention policies on log buckets are configured using Bucket Lock                                                                                                                           | Terraform |
-| 545 | CKV2_GCP_4    | resource | google_logging_project_sink                     | Ensure that retention policies on log buckets are configured using Bucket Lock                                                                                                                           | Terraform |
-| 546 | CKV2_GCP_4    | resource | google_storage_bucket                           | Ensure that retention policies on log buckets are configured using Bucket Lock                                                                                                                           | Terraform |
-| 547 | CKV2_GCP_5    | resource | google_project_iam_audit_config                 | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project                                                                                                  | Terraform |
-| 548 | CKV2_GCP_5    | resource | google_project                                  | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project                                                                                                  | Terraform |
-| 549 | CKV2_GCP_6    | resource | google_kms_crypto_key_iam_member                | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible                                                                                                                              | Terraform |
+| 543 | CKV2_GCP_4    | resource | google_storage_bucket                           | Ensure that retention policies on log buckets are configured using Bucket Lock                                                                                                                           | Terraform |
+| 544 | CKV2_GCP_4    | resource | google_logging_organization_sink                | Ensure that retention policies on log buckets are configured using Bucket Lock                                                                                                                           | Terraform |
+| 545 | CKV2_GCP_4    | resource | google_logging_folder_sink                      | Ensure that retention policies on log buckets are configured using Bucket Lock                                                                                                                           | Terraform |
+| 546 | CKV2_GCP_4    | resource | google_logging_project_sink                     | Ensure that retention policies on log buckets are configured using Bucket Lock                                                                                                                           | Terraform |
+| 547 | CKV2_GCP_5    | resource | google_project                                  | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project                                                                                                  | Terraform |
+| 548 | CKV2_GCP_5    | resource | google_project_iam_audit_config                 | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project                                                                                                  | Terraform |
+| 549 | CKV2_GCP_6    | resource | google_kms_crypto_key                           | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible                                                                                                                              | Terraform |
 | 550 | CKV2_GCP_6    | resource | google_kms_crypto_key_iam_binding               | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible                                                                                                                              | Terraform |
-| 551 | CKV2_GCP_6    | resource | google_kms_crypto_key                           | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible                                                                                                                              | Terraform |
+| 551 | CKV2_GCP_6    | resource | google_kms_crypto_key_iam_member                | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible                                                                                                                              | Terraform |
 | 552 | CKV2_GCP_7    | resource | google_sql_database_instance                    | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges                                                                                                    | Terraform |
 | 553 | CKV2_GCP_7    | resource | google_sql_user                                 | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges                                                                                                    | Terraform |
 | 554 | CKV_GIT_1     | resource | github_repository                               | Ensure Repository is Private                                                                                                                                                                             | Terraform |
diff --git a/kubernetes/requirements.txt b/kubernetes/requirements.txt
index 2f46cc6d8..52d1f590a 100644
--- a/kubernetes/requirements.txt
+++ b/kubernetes/requirements.txt
@@ -1,1 +1,1 @@
-checkov==2.0.617
+checkov==2.0.616


Test patch:
diff --git a/tests/terraform/checks/provider/openstack/test_credentials.py b/tests/terraform/checks/provider/openstack/test_credentials.py
new file mode 100644
index 000000000..4681aca43
--- /dev/null
+++ b/tests/terraform/checks/provider/openstack/test_credentials.py
@@ -0,0 +1,31 @@
+import unittest
+
+from checkov.terraform.checks.provider.openstack.credentials import check
+from checkov.common.models.enums import CheckResult
+
+
+class TestCredentials(unittest.TestCase):
+
+    def test_success(self):
+        provider_conf = {'region': ['RegionOne'], 'auth_url': ["http://myauthurl:5000/v2.0"]}
+
+        scan_result = check.scan_provider_conf(conf=provider_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+        provider_conf = {}
+
+        scan_result = check.scan_provider_conf(conf=provider_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_failure(self):
+        provider_conf = {'region': ['RegionOne'], 'auth_url': ["http://myauthurl:5000/v2.0"], 'password': ['Ahngak0fuokeexee5Quiu0oohayeiXie']}
+        scan_result = check.scan_provider_conf(conf=provider_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+        provider_conf = {'region': ['RegionOne'], 'auth_url': ["http://myauthurl:5000/v2.0"], 'token': ['ifahghau4nun7eirahJ5baa8cichex7l']}
+        scan_result = check.scan_provider_conf(conf=provider_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+        provider_conf = {'region': ['RegionOne'], 'auth_url': ["http://myauthurl:5000/v2.0"], 'application_credential_secret': ['mie8siw5ooTaed0AeQuepeiGhah9xaif']}
+        scan_result = check.scan_provider_conf(conf=provider_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+        if __name__ == '__main__':
+            unittest.main()
diff --git a/tests/terraform/checks/resource/openstack/test_SecurityGroupUnrestrictedIngress22.py b/tests/terraform/checks/resource/openstack/test_SecurityGroupUnrestrictedIngress22.py
new file mode 100644
index 000000000..026c117cb
--- /dev/null
+++ b/tests/terraform/checks/resource/openstack/test_SecurityGroupUnrestrictedIngress22.py
@@ -0,0 +1,308 @@
+import unittest
+
+import hcl2
+
+from checkov.common.models.enums import CheckResult
+from checkov.terraform.checks.resource.openstack.SecurityGroupUnrestrictedIngress22 import check
+
+
+class TestSecurityGroupUnrestrictedIngress22(unittest.TestCase):
+
+    def test_failure_compute_secgroup_ipv4(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_compute_secgroup_v2" "secgroup_1" {
+          name        = "my_secgroup"
+          description = "my security group"
+
+          rule {
+            from_port   = 80
+            to_port     = 80
+            ip_protocol = "tcp"
+            cidr        = "0.0.0.0/0"
+          }
+
+          rule {
+            from_port   = 22
+            to_port     = 22
+            ip_protocol = "tcp"
+            cidr        = "192.168.0.0/16"
+          }
+
+          rule {
+            from_port   = 22
+            to_port     = 22
+            ip_protocol = "tcp"
+            cidr        = "0.0.0.0/0"
+          }
+        }
+        """)
+        resource_conf = hcl_res['resource'][0]['openstack_compute_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_failure_compute_secgroup_port_range(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_compute_secgroup_v2" "secgroup_1" {
+          name        = "my_secgroup"
+          description = "my security group"
+        
+          rule {
+            from_port   = 0
+            to_port     = 65535
+            ip_protocol = "tcp"
+            cidr        = "0.0.0.0/0"
+          }
+        }
+        """)
+        resource_conf = hcl_res['resource'][0]['openstack_compute_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_failure_compute_secgroup_ipv6(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_compute_secgroup_v2" "secgroup_1" {
+          name        = "my_secgroup"
+          description = "my security group"
+        
+          rule {
+            from_port   = 22
+            to_port     = 22
+            ip_protocol = "tcp"
+            cidr        = "192.168.0.0/16"
+          }
+          rule {
+            from_port   = 22
+            to_port     = 22
+            ip_protocol = "tcp"
+            cidr        = "::/0"
+          }
+        }
+        """)
+        resource_conf = hcl_res['resource'][0]['openstack_compute_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_pass_compute_secgroup_different_port(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_compute_secgroup_v2" "secgroup_1" {
+          name        = "my_secgroup"
+          description = "my security group"
+
+          rule {
+            from_port   = 222
+            to_port     = 222
+            ip_protocol = "tcp"
+            cidr        = "192.168.0.0/16"
+          }
+
+          rule {
+            from_port   = 222
+            to_port     = 222
+            ip_protocol = "tcp"
+            cidr        = "0.0.0.0/0"
+          }
+        }
+        """)
+        resource_conf = hcl_res['resource'][0]['openstack_compute_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_pass_compute_secgroup_no_cidr(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_compute_secgroup_v2" "secgroup_1" {
+          name        = "my_secgroup"
+          description = "my security group"
+        
+          rule {
+            from_port     = 22
+            to_port       = 22
+            ip_protocol   = "tcp"
+            from_group_id = "5338c192-5118-11ec-bf63-0242ac130002"
+          }
+        }
+        """)
+        resource_conf = hcl_res['resource'][0]['openstack_compute_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_pass_compute_secgroup_null_cidr(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_compute_secgroup_v2" "secgroup_1" {
+          name        = "my_secgroup"
+          description = "my security group"
+        
+          rule {
+            from_port   = 22
+            to_port     = 22
+            ip_protocol = "tcp"
+            cidr        = null
+          }
+        }
+            """)
+        resource_conf = hcl_res['resource'][0]['openstack_compute_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_pass_compute_secgroup_cidr(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_compute_secgroup_v2" "secgroup_1" {
+          name        = "my_secgroup"
+          description = "my security group"
+        
+          rule {
+            from_port   = 22
+            to_port     = 22
+            ip_protocol = "tcp"
+            cidr        = "192.168.0.0/16"
+          }
+        }
+        """)
+        resource_conf = hcl_res['resource'][0]['openstack_compute_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_pass_compute_secgroup_icmp(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_compute_secgroup_v2" "secgroup_1" {
+          name        = "my_secgroup"
+          description = "my security group"
+        
+          rule {
+            from_port   = 22
+            to_port     = 22
+            ip_protocol = "icmp"
+            cidr        = "0.0.0.0/0"
+          }
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['openstack_compute_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+    def test_failure_networking_secgroup(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_networking_secgroup_v2" "secgroup_1" {
+          name        = "secgroup_1"
+          description = "My neutron security group"
+        }
+        
+        resource "openstack_networking_secgroup_rule_v2" "ingress" {
+          direction         = "ingress"
+          ethertype         = "IPv4"
+          protocol          = "tcp"
+          port_range_min    = 22
+          port_range_max    = 22
+          remote_ip_prefix  = "0.0.0.0/0"
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['openstack_networking_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+        resource_conf = hcl_res['resource'][1]['openstack_networking_secgroup_rule_v2']['ingress']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_failure_networking_secgroup_port_range(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_networking_secgroup_rule_v2" "ingress" {
+          direction         = "ingress"
+          ethertype         = "IPv4"
+          protocol          = "tcp"
+          port_range_min    = 1
+          port_range_max    = 65535
+          remote_ip_prefix  = "0.0.0.0/0"
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['openstack_networking_secgroup_rule_v2']['ingress']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_pass_networking_secgroup(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_networking_secgroup_rule_v2" "ingress" {
+          direction         = "ingress"
+          ethertype         = "IPv4"
+          protocol          = "tcp"
+          port_range_min    = 22
+          port_range_max    = 22
+          remote_ip_prefix  = "192.168.0.0/16"
+          security_group_id = "${openstack_networking_secgroup_v2.secgroup_1.id}"
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['openstack_networking_secgroup_rule_v2']['ingress']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_pass_networking_secgroup_icmp(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_networking_secgroup_rule_v2" "ingress" {
+          direction         = "ingress"
+          ethertype         = "IPv4"
+          protocol          = "icmp"
+          port_range_min    = 22
+          port_range_max    = 22
+          remote_ip_prefix  = "0.0.0.0/0"
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['openstack_networking_secgroup_rule_v2']['ingress']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_unknown_networking_secgroup_egress(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_networking_secgroup_rule_v2" "egress" {
+          direction         = "egress"
+          ethertype         = "IPv4"
+          protocol          = "tcp"
+          port_range_min    = 22
+          port_range_max    = 22
+          remote_ip_prefix  = "0.0.0.0/0"
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['openstack_networking_secgroup_rule_v2']['egress']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.UNKNOWN, scan_result)
+
+    def test_pass_networking_secgroup_source_sg(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_networking_secgroup_rule_v2" "ingress" {
+          direction         = "ingress"
+          ethertype         = "IPv4"
+          protocol          = "tcp"
+          port_range_min    = 22
+          port_range_max    = 22
+          security_group_id = "${openstack_networking_secgroup_v2.secgroup_1.id}"
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['openstack_networking_secgroup_rule_v2']['ingress']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_pass_networking_secgroup_different_port(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_networking_secgroup_rule_v2" "ingress" {
+          direction         = "ingress"
+          ethertype         = "IPv4"
+          protocol          = "tcp"
+          port_range_min    = 222
+          port_range_max    = 222
+          remote_ip_prefix  = "0.0.0.0/0"
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['openstack_networking_secgroup_rule_v2']['ingress']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/terraform/checks/resource/openstack/test_SecurityGroupUnrestrictedIngress3389.py b/tests/terraform/checks/resource/openstack/test_SecurityGroupUnrestrictedIngress3389.py
new file mode 100644
index 000000000..fe0699154
--- /dev/null
+++ b/tests/terraform/checks/resource/openstack/test_SecurityGroupUnrestrictedIngress3389.py
@@ -0,0 +1,308 @@
+import unittest
+
+import hcl2
+
+from checkov.common.models.enums import CheckResult
+from checkov.terraform.checks.resource.openstack.SecurityGroupUnrestrictedIngress3389 import check
+
+
+class TestSecurityGroupUnrestrictedIngress3389(unittest.TestCase):
+
+    def test_failure_compute_secgroup_ipv4(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_compute_secgroup_v2" "secgroup_1" {
+          name        = "my_secgroup"
+          description = "my security group"
+
+          rule {
+            from_port   = 80
+            to_port     = 80
+            ip_protocol = "tcp"
+            cidr        = "0.0.0.0/0"
+          }
+
+          rule {
+            from_port   = 3389
+            to_port     = 3389
+            ip_protocol = "tcp"
+            cidr        = "192.168.0.0/16"
+          }
+
+          rule {
+            from_port   = 3389
+            to_port     = 3389
+            ip_protocol = "tcp"
+            cidr        = "0.0.0.0/0"
+          }
+        }
+        """)
+        resource_conf = hcl_res['resource'][0]['openstack_compute_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_failure_compute_secgroup_port_range(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_compute_secgroup_v2" "secgroup_1" {
+          name        = "my_secgroup"
+          description = "my security group"
+        
+          rule {
+            from_port   = 0
+            to_port     = 65535
+            ip_protocol = "tcp"
+            cidr        = "0.0.0.0/0"
+          }
+        }
+        """)
+        resource_conf = hcl_res['resource'][0]['openstack_compute_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_failure_compute_secgroup_ipv6(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_compute_secgroup_v2" "secgroup_1" {
+          name        = "my_secgroup"
+          description = "my security group"
+        
+          rule {
+            from_port   = 3389
+            to_port     = 3389
+            ip_protocol = "tcp"
+            cidr        = "192.168.0.0/16"
+          }
+          rule {
+            from_port   = 3389
+            to_port     = 3389
+            ip_protocol = "tcp"
+            cidr        = "::/0"
+          }
+        }
+        """)
+        resource_conf = hcl_res['resource'][0]['openstack_compute_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_pass_compute_secgroup_different_port(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_compute_secgroup_v2" "secgroup_1" {
+          name        = "my_secgroup"
+          description = "my security group"
+
+          rule {
+            from_port   = 33890
+            to_port     = 33890
+            ip_protocol = "tcp"
+            cidr        = "192.168.0.0/16"
+          }
+
+          rule {
+            from_port   = 33890
+            to_port     = 33890
+            ip_protocol = "tcp"
+            cidr        = "0.0.0.0/0"
+          }
+        }
+        """)
+        resource_conf = hcl_res['resource'][0]['openstack_compute_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_pass_compute_secgroup_no_cidr(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_compute_secgroup_v2" "secgroup_1" {
+          name        = "my_secgroup"
+          description = "my security group"
+        
+          rule {
+            from_port     = 3389
+            to_port       = 3389
+            ip_protocol   = "tcp"
+            from_group_id = "5338c192-5118-11ec-bf63-0242ac130002"
+          }
+        }
+        """)
+        resource_conf = hcl_res['resource'][0]['openstack_compute_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_pass_compute_secgroup_null_cidr(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_compute_secgroup_v2" "secgroup_1" {
+          name        = "my_secgroup"
+          description = "my security group"
+        
+          rule {
+            from_port   = 3389
+            to_port     = 3389
+            ip_protocol = "tcp"
+            cidr        = null
+          }
+        }
+            """)
+        resource_conf = hcl_res['resource'][0]['openstack_compute_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_pass_compute_secgroup_cidr(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_compute_secgroup_v2" "secgroup_1" {
+          name        = "my_secgroup"
+          description = "my security group"
+        
+          rule {
+            from_port   = 3389
+            to_port     = 3389
+            ip_protocol = "tcp"
+            cidr        = "192.168.0.0/16"
+          }
+        }
+        """)
+        resource_conf = hcl_res['resource'][0]['openstack_compute_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_pass_compute_secgroup_icmp(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_compute_secgroup_v2" "secgroup_1" {
+          name        = "my_secgroup"
+          description = "my security group"
+        
+          rule {
+            from_port   = 3389
+            to_port     = 3389
+            ip_protocol = "icmp"
+            cidr        = "0.0.0.0/0"
+          }
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['openstack_compute_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+    def test_failure_networking_secgroup(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_networking_secgroup_v2" "secgroup_1" {
+          name        = "secgroup_1"
+          description = "My neutron security group"
+        }
+        
+        resource "openstack_networking_secgroup_rule_v2" "ingress" {
+          direction         = "ingress"
+          ethertype         = "IPv4"
+          protocol          = "tcp"
+          port_range_min    = 3389
+          port_range_max    = 3389
+          remote_ip_prefix  = "0.0.0.0/0"
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['openstack_networking_secgroup_v2']['secgroup_1']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+        resource_conf = hcl_res['resource'][1]['openstack_networking_secgroup_rule_v2']['ingress']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_failure_networking_secgroup_port_range(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_networking_secgroup_rule_v2" "ingress" {
+          direction         = "ingress"
+          ethertype         = "IPv4"
+          protocol          = "tcp"
+          port_range_min    = 1
+          port_range_max    = 65535
+          remote_ip_prefix  = "0.0.0.0/0"
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['openstack_networking_secgroup_rule_v2']['ingress']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_pass_networking_secgroup(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_networking_secgroup_rule_v2" "ingress" {
+          direction         = "ingress"
+          ethertype         = "IPv4"
+          protocol          = "tcp"
+          port_range_min    = 3389
+          port_range_max    = 3389
+          remote_ip_prefix  = "192.168.0.0/16"
+          security_group_id = "${openstack_networking_secgroup_v2.secgroup_1.id}"
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['openstack_networking_secgroup_rule_v2']['ingress']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_pass_networking_secgroup_icmp(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_networking_secgroup_rule_v2" "ingress" {
+          direction         = "ingress"
+          ethertype         = "IPv4"
+          protocol          = "icmp"
+          port_range_min    = 3389
+          port_range_max    = 3389
+          remote_ip_prefix  = "0.0.0.0/0"
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['openstack_networking_secgroup_rule_v2']['ingress']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_unknown_networking_secgroup_egress(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_networking_secgroup_rule_v2" "egress" {
+          direction         = "egress"
+          ethertype         = "IPv4"
+          protocol          = "tcp"
+          port_range_min    = 3389
+          port_range_max    = 3389
+          remote_ip_prefix  = "0.0.0.0/0"
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['openstack_networking_secgroup_rule_v2']['egress']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.UNKNOWN, scan_result)
+
+    def test_pass_networking_secgroup_source_sg(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_networking_secgroup_rule_v2" "ingress" {
+          direction         = "ingress"
+          ethertype         = "IPv4"
+          protocol          = "tcp"
+          port_range_min    = 3389
+          port_range_max    = 3389
+          security_group_id = "${openstack_networking_secgroup_v2.secgroup_1.id}"
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['openstack_networking_secgroup_rule_v2']['ingress']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_pass_networking_secgroup_different_port(self):
+        hcl_res = hcl2.loads("""
+        resource "openstack_networking_secgroup_rule_v2" "ingress" {
+          direction         = "ingress"
+          ethertype         = "IPv4"
+          protocol          = "tcp"
+          port_range_min    = 33890
+          port_range_max    = 33890
+          remote_ip_prefix  = "0.0.0.0/0"
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['openstack_networking_secgroup_rule_v2']['ingress']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()