bridgecrewio · rotemavni · Oct 12, 2025 · Oct 11, 2025 · Oct 11, 2025
diff --git a/checkov/common/output/report.py b/checkov/common/output/report.py
@@ -562,9 +562,7 @@ def handle_skipped_checks(
         skip_records = []
         for record in report.failed_checks:
             resource_raw_id = Report.get_plan_resource_raw_id(record.resource)
-            resource_skips = enriched_resources.get(resource_raw_id, {}).get(
-                "skipped_checks", []
-            )
+            resource_skips = enriched_resources.get(resource_raw_id, {}).get("skipped_checks", [])
             for skip in resource_skips:
                 if record.check_id in skip["id"]:
                     # Mark for removal and add it as a skipped record. It is not safe to remove
@@ -594,10 +592,11 @@ def get_plan_resource_raw_id(resource_id: str) -> str:
         """
         return the resource raw id without the modules and the indexes
         example: from resource_id='module.module_name.type.name[1]' return 'type.name'
+        example: from resource_id='type.name['some.long.address']' return 'type.name'
         """
+        if '[' in resource_id:
+            resource_id = resource_id[:resource_id.index('[')]
         resource_raw_id = ".".join(resource_id.split(".")[-2:])
-        if '[' in resource_raw_id:
-            resource_raw_id = resource_raw_id[:resource_raw_id.index('[')]
         return resource_raw_id
 
     @classmethod

diff --git a/tests/common/runner_registry/plan_with_for_each_for_enrichment/original/main.tf b/tests/common/runner_registry/plan_with_for_each_for_enrichment/original/main.tf
@@ -0,0 +1,12 @@
+locals {
+  hosted_zone_names = [
+    "example.com",
+    "example2.eu",
+  ]
+}
+
+resource "aws_route53_zone" "example" {
+  for_each = toset(local.hosted_zone_names)
+  # checkov:skip=CKV2_AWS_38
+  name = each.value
+}
diff --git a/tests/common/runner_registry/plan_with_for_each_for_enrichment/tf_plan.json b/tests/common/runner_registry/plan_with_for_each_for_enrichment/tf_plan.json
@@ -0,0 +1,55 @@
+{
+  "format_version": "1.2",
+  "terraform_version": "1.5.7",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "aws_route53_zone.example['example.com']",
+          "mode": "managed",
+          "type": "aws_route53_zone",
+          "name": "example",
+          "index": "example.com",
+          "provider_name": "registry.terraform.io/hashicorp/aws",
+          "schema_version": 0,
+          "values": {
+            "comment": "Managed by Terraform",
+            "delegation_set_id": null,
+            "force_destroy": false,
+            "name": "example.com",
+            "tags": null,
+            "vpc": []
+          },
+          "sensitive_values": {
+            "name_servers": [],
+            "tags_all": {},
+            "vpc": []
+          }
+        },
+        {
+          "address": "aws_route53_zone.example['example2.eu']",
+          "mode": "managed",
+          "type": "aws_route53_zone",
+          "name": "example",
+          "index": "example2.eu",
+          "provider_name": "registry.terraform.io/hashicorp/aws",
+          "schema_version": 0,
+          "values": {
+            "comment": "Managed by Terraform",
+            "delegation_set_id": null,
+            "force_destroy": false,
+            "name": "example2.eu",
+            "tags": null,
+            "vpc": []
+          },
+          "sensitive_values": {
+            "name_servers": [],
+            "tags_all": {
+            },
+            "vpc": []
+          }
+        }
+      ]
+    }
+  }
+}
diff --git a/tests/common/runner_registry/test_runner_registry_plan_enrichment.py b/tests/common/runner_registry/test_runner_registry_plan_enrichment.py
@@ -121,6 +121,24 @@ def test_enrichment_of_plan_report_with_modules(self):
         self.assertEqual(skipped_check_ids, expected_skipped_check_ids)
         self.assertEqual(enriched_data, expected_enriched_data)
 
+    def test_enrichment_of_plan_report_with_for_each(self):
+        allowed_checks = ["CKV2_AWS_38"]
+        runner_registry = RunnerRegistry(
+            banner, RunnerFilter(checks=allowed_checks, framework=["terraform_plan"]), tf_plan_runner()
+        )
+
+        repo_root = Path(__file__).parent / "plan_with_for_each_for_enrichment"
+        valid_plan_path = repo_root / "tf_plan.json"
+
+        report = runner_registry.run(repo_root_for_plan_enrichment=[repo_root], files=[str(valid_plan_path)])[0]
+
+        self.assertEqual(len(report.failed_checks), 0)
+
+        self.assertEqual(len(report.passed_checks), 0)
+
+        self.assertEqual(len(report.skipped_checks), 2)
+
+
     def test_skip_check(self):
         allowed_checks = ["CKV_AWS_20", "CKV_AWS_28"]
         runner_registry = RunnerRegistry(