diff --git a/checkov/common/output/report.py b/checkov/common/output/report.py index c5b82a299e..3ce4e83d34 100644 --- a/checkov/common/output/report.py +++ b/checkov/common/output/report.py @@ -562,9 +562,7 @@ def handle_skipped_checks( skip_records = [] for record in report.failed_checks: resource_raw_id = Report.get_plan_resource_raw_id(record.resource) - resource_skips = enriched_resources.get(resource_raw_id, {}).get( - "skipped_checks", [] - ) + resource_skips = enriched_resources.get(resource_raw_id, {}).get("skipped_checks", []) for skip in resource_skips: if record.check_id in skip["id"]: # Mark for removal and add it as a skipped record. It is not safe to remove @@ -594,10 +592,11 @@ def get_plan_resource_raw_id(resource_id: str) -> str: """ return the resource raw id without the modules and the indexes example: from resource_id='module.module_name.type.name[1]' return 'type.name' + example: from resource_id='type.name['some.long.address']' return 'type.name' """ + if '[' in resource_id: + resource_id = resource_id[:resource_id.index('[')] resource_raw_id = ".".join(resource_id.split(".")[-2:]) - if '[' in resource_raw_id: - resource_raw_id = resource_raw_id[:resource_raw_id.index('[')] return resource_raw_id @classmethod diff --git a/tests/common/runner_registry/plan_with_for_each_for_enrichment/original/main.tf b/tests/common/runner_registry/plan_with_for_each_for_enrichment/original/main.tf new file mode 100644 index 0000000000..0326bafdc4 --- /dev/null +++ b/tests/common/runner_registry/plan_with_for_each_for_enrichment/original/main.tf @@ -0,0 +1,12 @@ +locals { + hosted_zone_names = [ + "example.com", + "example2.eu", + ] +} + +resource "aws_route53_zone" "example" { + for_each = toset(local.hosted_zone_names) + # checkov:skip=CKV2_AWS_38 + name = each.value +} \ No newline at end of file diff --git a/tests/common/runner_registry/plan_with_for_each_for_enrichment/tf_plan.json b/tests/common/runner_registry/plan_with_for_each_for_enrichment/tf_plan.json new file mode 100644 index 0000000000..4aed738a61 --- /dev/null +++ b/tests/common/runner_registry/plan_with_for_each_for_enrichment/tf_plan.json @@ -0,0 +1,55 @@ +{ + "format_version": "1.2", + "terraform_version": "1.5.7", + "planned_values": { + "root_module": { + "resources": [ + { + "address": "aws_route53_zone.example['example.com']", + "mode": "managed", + "type": "aws_route53_zone", + "name": "example", + "index": "example.com", + "provider_name": "registry.terraform.io/hashicorp/aws", + "schema_version": 0, + "values": { + "comment": "Managed by Terraform", + "delegation_set_id": null, + "force_destroy": false, + "name": "example.com", + "tags": null, + "vpc": [] + }, + "sensitive_values": { + "name_servers": [], + "tags_all": {}, + "vpc": [] + } + }, + { + "address": "aws_route53_zone.example['example2.eu']", + "mode": "managed", + "type": "aws_route53_zone", + "name": "example", + "index": "example2.eu", + "provider_name": "registry.terraform.io/hashicorp/aws", + "schema_version": 0, + "values": { + "comment": "Managed by Terraform", + "delegation_set_id": null, + "force_destroy": false, + "name": "example2.eu", + "tags": null, + "vpc": [] + }, + "sensitive_values": { + "name_servers": [], + "tags_all": { + }, + "vpc": [] + } + } + ] + } + } +} diff --git a/tests/common/runner_registry/test_runner_registry_plan_enrichment.py b/tests/common/runner_registry/test_runner_registry_plan_enrichment.py index 849031655b..5044a745cd 100644 --- a/tests/common/runner_registry/test_runner_registry_plan_enrichment.py +++ b/tests/common/runner_registry/test_runner_registry_plan_enrichment.py @@ -121,6 +121,24 @@ def test_enrichment_of_plan_report_with_modules(self): self.assertEqual(skipped_check_ids, expected_skipped_check_ids) self.assertEqual(enriched_data, expected_enriched_data) + def test_enrichment_of_plan_report_with_for_each(self): + allowed_checks = ["CKV2_AWS_38"] + runner_registry = RunnerRegistry( + banner, RunnerFilter(checks=allowed_checks, framework=["terraform_plan"]), tf_plan_runner() + ) + + repo_root = Path(__file__).parent / "plan_with_for_each_for_enrichment" + valid_plan_path = repo_root / "tf_plan.json" + + report = runner_registry.run(repo_root_for_plan_enrichment=[repo_root], files=[str(valid_plan_path)])[0] + + self.assertEqual(len(report.failed_checks), 0) + + self.assertEqual(len(report.passed_checks), 0) + + self.assertEqual(len(report.skipped_checks), 2) + + def test_skip_check(self): allowed_checks = ["CKV_AWS_20", "CKV_AWS_28"] runner_registry = RunnerRegistry(