diff --git a/checkov/terraform/graph_builder/foreach/module_handler.py b/checkov/terraform/graph_builder/foreach/module_handler.py index b84d8bc349..eabaadc8a6 100644 --- a/checkov/terraform/graph_builder/foreach/module_handler.py +++ b/checkov/terraform/graph_builder/foreach/module_handler.py @@ -299,17 +299,18 @@ def _update_resolved_entry_for_tf_definition(child: TerraformBlock, original_for if isinstance(config, dict): resolved_module_name = config.get(RESOLVED_MODULE_ENTRY_NAME) if resolved_module_name is not None and len(resolved_module_name) > 0: - original_definition_key = config[RESOLVED_MODULE_ENTRY_NAME][0] - if isinstance(original_definition_key, str): - original_definition_key = TFDefinitionKey.from_json(json.loads(original_definition_key)) - resolved_tf_source_module = TFDefinitionKey.from_json(json.loads(resolved_module_name[0])) if isinstance(resolved_module_name[0], str) else resolved_module_name[0] - tf_source_modules = ForeachModuleHandler._get_module_with_only_relevant_foreach_idx( - original_foreach_or_count_key, - original_module_key, - resolved_tf_source_module.tf_source_modules, - ) - config[RESOLVED_MODULE_ENTRY_NAME][0] = TFDefinitionKey(file_path=original_definition_key.file_path, - tf_source_modules=tf_source_modules) + # iterate over each item in the resolved list and override it with updated data + for idx, original_definition_key in enumerate(resolved_module_name): + if isinstance(original_definition_key, str): + original_definition_key = TFDefinitionKey.from_json(json.loads(original_definition_key)) + resolved_tf_source_module = TFDefinitionKey.from_json(json.loads(resolved_module_name[idx])) if isinstance(resolved_module_name[idx], str) else resolved_module_name[idx] + tf_source_modules = ForeachModuleHandler._get_module_with_only_relevant_foreach_idx( + original_foreach_or_count_key, + original_module_key, + resolved_tf_source_module.tf_source_modules, + ) + resolved_module_name[idx] = TFDefinitionKey(file_path=original_definition_key.file_path, + tf_source_modules=tf_source_modules) @staticmethod def _get_module_with_only_relevant_foreach_idx(original_foreach_or_count_key: int | str, diff --git a/tests/terraform/runner/resources/for_each/main.tf b/tests/terraform/runner/resources/for_each/main.tf index 5c0012bd27..0c8998a082 100644 --- a/tests/terraform/runner/resources/for_each/main.tf +++ b/tests/terraform/runner/resources/for_each/main.tf @@ -1,5 +1,8 @@ module "simple" { - source = "./simple" - count = 2 + source = "./simple" + bucket = "my_bucket" + key = "my_key" + count = 2 + # checkov:skip=CKV_AWS_88:Testing } \ No newline at end of file diff --git a/tests/terraform/runner/resources/for_each/simple/alerts.tf b/tests/terraform/runner/resources/for_each/simple/alerts.tf new file mode 100644 index 0000000000..76937fd1d5 --- /dev/null +++ b/tests/terraform/runner/resources/for_each/simple/alerts.tf @@ -0,0 +1,3 @@ +locals { + alerts = 0 +} \ No newline at end of file diff --git a/tests/terraform/runner/resources/for_each/simple/main.tf b/tests/terraform/runner/resources/for_each/simple/main.tf index 96e26cd7f7..abb93fb469 100644 --- a/tests/terraform/runner/resources/for_each/simple/main.tf +++ b/tests/terraform/runner/resources/for_each/simple/main.tf @@ -1,5 +1,9 @@ resource "aws_s3_bucket_object" "this_file" { - bucket = "your_bucket_name" - key = "readme.md" source = "readme.md" } + +resource "aws_instance" "public_server" { + ami = "ami-0abcdef1234567890" + instance_type = "t2.micro" + associate_public_ip_address = true +} \ No newline at end of file diff --git a/tests/terraform/runner/resources/for_each/simple/outputs.tf b/tests/terraform/runner/resources/for_each/simple/outputs.tf new file mode 100644 index 0000000000..6bd3bda081 --- /dev/null +++ b/tests/terraform/runner/resources/for_each/simple/outputs.tf @@ -0,0 +1,6 @@ +output "account_id" { + description = "Storage account resource ID." + value = azurerm_storage_account.id +} + + diff --git a/tests/terraform/runner/test_runner.py b/tests/terraform/runner/test_runner.py index aab501f28e..10fc0c5c3c 100644 --- a/tests/terraform/runner/test_runner.py +++ b/tests/terraform/runner/test_runner.py @@ -160,13 +160,14 @@ def test_for_each_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/for_each" runner = Runner(db_connector=self.db_connector()) - checks_allowlist = ['CKV_AWS_186'] + checks_allowlist = ['CKV_AWS_186', 'CKV_AWS_88'] report = runner.run(root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=["terraform"], checks=checks_allowlist)) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) assert len(report.failed_checks) == 2 + assert len(report.skipped_checks) == 2 assert len(report.passed_checks) == 0 failed_resources = [c.resource for c in report.failed_checks] assert 'module.simple[0].aws_s3_bucket_object.this_file' in failed_resources