Repository: bridgecrewio/checkov

Issue:
CKV_TF_2 false positive on Terraform Registry modules with pinned version
**Describe the issue**
Despite for terraform registry modules use a pinned version(tag) the `CKV_TF_2 ` check fails:

![image](https://github.com/bridgecrewio/checkov/assets/11664677/d70e1920-332d-4551-8f72-c2cd349c7b0e)
 
**Examples**

```terraform
module "iam_github_oidc_role" {
  source  = "terraform-aws-modules/iam/aws//modules/iam-github-oidc-role"
  version = "5.39.1"

  name                 = var.role_name
  description          = "Role to assume from GitHub to allow assuming ${var.assumable_role_name} in serviced aws accounts"
  max_session_duration = var.max_session_duration

  subjects = [
    var.github_subject,
  ]

  policies = {
    AssumeRole = aws_iam_policy.allow_assume_role.arn
  }
}
```

**Version (please complete the following information):**
 - Checkov Version: `3.2.98`

**Additional context**
Using Terraform Registry modules https://developer.hashicorp.com/terraform/registry/modules/use#using-modules.



Discussion:

Patch:
diff --git a/checkov/terraform/checks/module/base_module_check.py b/checkov/terraform/checks/module/base_module_check.py
index 62f0d0eceb..df2189d8e5 100644
--- a/checkov/terraform/checks/module/base_module_check.py
+++ b/checkov/terraform/checks/module/base_module_check.py
@@ -45,3 +45,7 @@ def scan_entity_conf(self, conf: Dict[str, List[Any]], entity_type: str) -> Chec
     @abstractmethod
     def scan_module_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:
         raise NotImplementedError()
+
+    @staticmethod
+    def is_git_source(source: str) -> bool:
+        return source.startswith('git@') or source.startswith('git::') or source.startswith('github.com') or source.startswith('bitbucket.org')
diff --git a/checkov/terraform/checks/module/generic/RevisionVersionTag.py b/checkov/terraform/checks/module/generic/RevisionVersionTag.py
index 14626ecf02..34a7b85072 100644
--- a/checkov/terraform/checks/module/generic/RevisionVersionTag.py
+++ b/checkov/terraform/checks/module/generic/RevisionVersionTag.py
@@ -27,8 +27,13 @@ def scan_module_conf(self, conf: dict[str, list[Any]]) -> CheckResult:
         source = conf.get("source")
         if source and isinstance(source, list):
             source_url = source[0]
-            if ("?ref" in source_url or "&ref" in source_url) and re.search(VERSION_PATTERN, source_url):
-                return CheckResult.PASSED
+            if BaseModuleCheck.is_git_source(source_url):
+                if ("?ref" in source_url or "&ref" in source_url) and re.search(VERSION_PATTERN, source_url):
+                    return CheckResult.PASSED
+            else:
+                version = conf.get("version")
+                if source and isinstance(version, list):
+                    return CheckResult.PASSED
 
         return CheckResult.FAILED
 


Test patch:
diff --git a/tests/terraform/checks/module/generic/example_RevisionVersionTag/main.tf b/tests/terraform/checks/module/generic/example_RevisionVersionTag/main.tf
index f28d74aa52..74862c9a26 100644
--- a/tests/terraform/checks/module/generic/example_RevisionVersionTag/main.tf
+++ b/tests/terraform/checks/module/generic/example_RevisionVersionTag/main.tf
@@ -49,14 +49,15 @@ module "shallow_clone" {
   source = "git::https://github.com/terraform-aws-modules/terraform-aws-vpc.git?depth=1&ref=v1.2.0"
 }
 
+module "module_with_version" {
+  source  = "terraform-aws-modules/iam/aws//modules/iam-github-oidc-role"
+  version = "5.39.1"
+}
+
 # fail
 
-module "tf_registry" {
+module "tf_registry_no_version" {
   source  = "terraform-aws-modules/cloudwatch/aws//modules/log-group"
-  version = "4.3.0"
-
-  name              = "normal"
-  retention_in_days = 120
 }
 
 module "looks_like_a_branch" {
@@ -78,6 +79,22 @@ module "looks_like_a_branch" {
   }
 }
 
+module "github_module" {
+  source = "github.com/hashicorp/example"
+}
+
+module "bitbucket_module" {
+  source = "bitbucket.org/hashicorp/terraform-consul-aws"
+}
+
+module "github_ssh_module" {
+  source = "git@github.com:hashicorp/example.git"
+}
+
+module "generic_git_module" {
+  source = "git::https://example.com/vpc.git"
+}
+
 # unknown
 
 module "relative" {
diff --git a/tests/terraform/checks/module/generic/test_RevisionVersionTag.py b/tests/terraform/checks/module/generic/test_RevisionVersionTag.py
index 505fa57904..ec9031f955 100644
--- a/tests/terraform/checks/module/generic/test_RevisionVersionTag.py
+++ b/tests/terraform/checks/module/generic/test_RevisionVersionTag.py
@@ -21,11 +21,17 @@ def test(self):
             "hash",
             "sub_dir_hash",
             "tag",
-            "shallow_clone"
+            "shallow_clone",
+            "module_with_version"
         }
+
         failing_resources = {
             "looks_like_a_branch",
-            "tf_registry",
+            "tf_registry_no_version",
+            "generic_git_module",
+            "bitbucket_module",
+            "github_ssh_module",
+            "github_module"
         }
 
         passed_check_resources = {c.resource for c in report.passed_checks}