CKV2_AWS_5 does not check for ecs_service or aws_dms_replication_instance

Describe the bug

We’re getting the following:

Check: CKV2_AWS_5: "Ensure that Security Groups are attached to EC2 instances or elastic network interfaces (ENIs)"
	FAILED for resource: aws_security_group.ecs_ingress_loadbalancer
	File: /api.tf:12-35
	Guide: https://docs.bridgecrew.io/docs/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

		12 | resource "aws_security_group" "ecs_ingress_loadbalancer" {
		13 |   name        = module.ecs_ingress_load_balancer.id
		14 |   description = "Allow HTTP inbound traffic from Load Balancer"
		15 |   vpc_id      = module.vpc.vpc_id
		16 | 
		17 |   ingress {
		18 |     # TLS (change to whatever ports you need)
		19 |     from_port = 80
		20 |     to_port   = 80
		21 |     protocol  = "TCP"
		22 |     security_groups = [
		23 |       module.alb.security_group_id,
		24 |     ]
		25 |   }
		26 | 
		27 |   egress {
		28 |     from_port = 0
		29 |     to_port   = 0
		30 |     protocol  = "-1"
		31 |     cidr_blocks = [
		32 |       "0.0.0.0/0",
		33 |     ]
		34 |   }
		35 | }

This security group is assigned to ecs_service. Same error occurs when we create a SG and associate it with aws_dms_replication_instance.

To Reproduce

• Create a security group
• Assign it to an ecs_service or dms_replication_instance

Expected behavior The CKV2_AWS_5 check not failing, because the SG is assigned to an ECS Service / DMS Replication Instance.

Desktop (please complete the following information):

• OS: Linux
• Checkov Version: 2.0.116

[ppawlowski]

CKV2_AWS_5 is also raised when the Security Group is attached in the aws_launch_configuration resource.

[richardj-bsquare]

If applied to aws_launch_configuration, then it also needs applying to aws_launch_template

I’m getting this reported for this example…

resource "aws_security_group" "cluster-service" {
  name        = var.bu
  description = "Allow ingress on EC2 private instances"
  vpc_id      = local.vpc_id

  ingress {
    protocol    = "-1"
    from_port   = 0
    to_port     = 0
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    protocol    = "-1"
    from_port   = 0
    to_port     = 0
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_launch_template" "example-launch-template" {
  name_prefix   = "launch-"
  image_id      = data.aws_ami.amazon_linux_ecs.id
  instance_type = var.instance_type

  vpc_security_group_ids = [aws_security_group.cluster-service.id]
  
  block_device_mappings {
    device_name = "/dev/xvda"

    ebs {
      delete_on_termination = true
      encrypted             = true
      kms_key_id            = data.aws_kms_key.ebs-default-key.arn
      volume_size           = 64
      volume_type           = "gp3"
    }
  }

  iam_instance_profile {
    arn = aws_iam_instance_profile.cluster-service.arn
  }
}