Repository: bridgecrewio/checkov

Issue:
CKV2_AWS_44 is showing false positive
**Describe the issue**
CKV2_AWS_44 (Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic) is showing false-positive but there may be more than just that issue.
i summarized and compiled the tf code, json plan file, and checkov result in [this repo](https://github.com/rickythain/test-terraform-checkov/tree/main/test-VPCPeeringRouteTableOverlyPermissive) for reference.

**Examples**
terraform code:
```
resource "aws_route" "route1" {
  route_table_id            = aws_route_table.rtb1.id
  destination_cidr_block    = "10.1.0.0/16" 
  vpc_peering_connection_id = "pcx-578451154151544"
}

resource "aws_route" "route2" {
  route_table_id            = aws_route_table.rtb2.id
  destination_cidr_block    = "10.0.0.0/16"
  vpc_peering_connection_id = "pcx-578451154151544"
}
```

checkov returned fail for aws_route.route2, when the resource does not have overly permissive route.
```
Check: CKV2_AWS_44: "Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic"
	PASSED for resource: aws_route.route1
	File: /plan.json:13-27
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-route-table-with-vpc-peering-does-not-contain-routes-overly-permissive-to-all-traffic
Check: CKV2_AWS_44: "Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic"
	FAILED for resource: aws_route.route2
	File: /plan.json:37-51
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-route-table-with-vpc-peering-does-not-contain-routes-overly-permissive-to-all-traffic
```

**Version (please complete the following information):**
 - Checkov Version: 3.2.74

**Additional context**
I tried creating a custom policy basing the [current policy](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/VPCPeeringRouteTableOverlyPermissive.yaml); replacing the `not_contains` to `not_equals`. it is working for aws_route resources but not aws_route_table inline routes. 
when multiple inline routes are created in a aws_route_table, both `not_contains` and `not_equals` return false reports. 



Discussion:
@rickythain Hi, thanks for reporting this, I believe the Policy is triggering when the destination_cidr_block IP Address contains "0.0.0.0", even if it is "10.0.0.0". The policy passes when the IP Address does not contain "0.0.0.0" such as in the case of "10.1.0.0/16". There's potentially an issue in the Policy logic. We'll investigate on this internally.



Patch:
diff --git a/checkov/terraform/checks/graph_checks/aws/VPCPeeringRouteTableOverlyPermissive.yaml b/checkov/terraform/checks/graph_checks/aws/VPCPeeringRouteTableOverlyPermissive.yaml
index 325bfcb597..edd6f0a6c6 100644
--- a/checkov/terraform/checks/graph_checks/aws/VPCPeeringRouteTableOverlyPermissive.yaml
+++ b/checkov/terraform/checks/graph_checks/aws/VPCPeeringRouteTableOverlyPermissive.yaml
@@ -22,18 +22,6 @@ definition:
           attribute: "route.*.cidr_block"
           operator: "not_contains"
           value: "0.0.0.0/0"
-        - cond_type: "attribute"
-          resource_types:
-          - "aws_route_table"
-          attribute: "route.*.cidr_block"
-          operator: "not_contains"
-          value: "0.0.0.0"
-        - cond_type: "attribute"
-          resource_types:
-            - "aws_route_table"
-          attribute: "route.*.ipv6_cidr_block"
-          operator: "not_contains"
-          value: "::0"
         - cond_type: "attribute"
           resource_types:
             - "aws_route_table"
@@ -58,18 +46,6 @@ definition:
           attribute: "destination_cidr_block"
           operator: "not_contains"
           value: "0.0.0.0/0"
-        - cond_type: "attribute"
-          resource_types:
-          - "aws_route"
-          attribute: "destination_cidr_block"
-          operator: "not_contains"
-          value: "0.0.0.0"
-        - cond_type: "attribute"
-          resource_types:
-            - "aws_route"
-          attribute: "destination_ipv6_cidr_block"
-          operator: "not_contains"
-          value: "::0"
         - cond_type: "attribute"
           resource_types:
             - "aws_route"


Test patch:
diff --git a/tests/sast/test_filter_files_manager.py b/tests/sast/test_filter_files_manager.py
index ca7b236884..9de5882b2a 100644
--- a/tests/sast/test_filter_files_manager.py
+++ b/tests/sast/test_filter_files_manager.py
@@ -14,4 +14,4 @@ def test_sast_js_filtered_files_by_ts():
         if path.endswith('example2/build/file.js') or path.endswith('example1/build') or path.endswith('example3/main.js'):
             paths[path] = path
 
-    assert len(paths.keys()) == 3
+    assert len(paths.keys()) == 3
\ No newline at end of file
diff --git a/tests/terraform/graph/checks/resources/VPCPeeringRouteTableOverlyPermissive/expected.yaml b/tests/terraform/graph/checks/resources/VPCPeeringRouteTableOverlyPermissive/expected.yaml
index e494cd405d..f8b90d0e35 100644
--- a/tests/terraform/graph/checks/resources/VPCPeeringRouteTableOverlyPermissive/expected.yaml
+++ b/tests/terraform/graph/checks/resources/VPCPeeringRouteTableOverlyPermissive/expected.yaml
@@ -2,15 +2,13 @@ pass:
   - "aws_route.aws_route_pass_1"
   - "aws_route.aws_route_pass_2"
   - "aws_route.aws_route_pass_3"
+  - "aws_route.aws_route_pass_4"
+  - "aws_route.aws_route_pass_5"
   - "aws_route_table.aws_route_table_pass_1"
   - "aws_route_table.aws_route_table_pass_2"
   - "aws_route_table.aws_route_table_pass_3"
 fail:
   - "aws_route.aws_route_fail_1"
   - "aws_route.aws_route_fail_2"
-  - "aws_route.aws_route_fail_3"
-  - "aws_route.aws_route_fail_4"
   - "aws_route_table.aws_route_table_fail_1"
   - "aws_route_table.aws_route_table_fail_2"
-  - "aws_route_table.aws_route_table_fail_3"
-  - "aws_route_table.aws_route_table_fail_4"
diff --git a/tests/terraform/graph/checks/resources/VPCPeeringRouteTableOverlyPermissive/main.tf b/tests/terraform/graph/checks/resources/VPCPeeringRouteTableOverlyPermissive/main.tf
index 8ae9b41843..a4e4582653 100644
--- a/tests/terraform/graph/checks/resources/VPCPeeringRouteTableOverlyPermissive/main.tf
+++ b/tests/terraform/graph/checks/resources/VPCPeeringRouteTableOverlyPermissive/main.tf
@@ -17,24 +17,12 @@ resource "aws_route" "aws_route_pass_3" {
 }
 
 resource "aws_route" "aws_route_fail_1" {
-  route_table_id            = "rtb-4fbb3ac4"
-  destination_cidr_block    = "0.0.0.0"
-  vpc_peering_connection_id = "pcx-45ff3dc1"
-}
-
-resource "aws_route" "aws_route_fail_2" {
   route_table_id            = "rtb-4fbb3ac4"
   destination_cidr_block    = "0.0.0.0/0"
   vpc_peering_connection_id = "pcx-45ff3dc1"
 }
 
-resource "aws_route" "aws_route_fail_3" {
-  route_table_id            = "rtb-4fbb3ac4"
-  destination_ipv6_cidr_block = "::0"
-  vpc_peering_connection_id = "pcx-45ff3dc1"
-}
-
-resource "aws_route" "aws_route_fail_4" {
+resource "aws_route" "aws_route_fail_2" {
   route_table_id            = "rtb-4fbb3ac4"
   destination_ipv6_cidr_block = "::/0"
   vpc_peering_connection_id = "pcx-45ff3dc1"
@@ -81,25 +69,19 @@ resource "aws_route_table" "aws_route_table_fail_2" {
   vpc_id = aws_vpc.example.id
 
   route {
-    cidr_block = "0.0.0.0"
+    ipv6_cidr_block = "::/0"
     vpc_peering_connection_id = "pcx-45ff3dc1"
   }
 }
 
-resource "aws_route_table" "aws_route_table_fail_3" {
-  vpc_id = aws_vpc.example.id
-
-  route {
-    ipv6_cidr_block = "::0"
-    vpc_peering_connection_id = "pcx-45ff3dc1"
-  }
+resource "aws_route" "aws_route_pass_4" {
+  route_table_id            = aws_route_table.rtb1.id
+  destination_cidr_block    = "10.1.0.0/16"
+  vpc_peering_connection_id = "pcx-578451154151544"
 }
 
-resource "aws_route_table" "aws_route_table_fail_4" {
-  vpc_id = aws_vpc.example.id
-
-  route {
-    ipv6_cidr_block = "::/0"
-    vpc_peering_connection_id = "pcx-45ff3dc1"
-  }
+resource "aws_route" "aws_route_pass_5" {
+  route_table_id            = aws_route_table.rtb2.id
+  destination_cidr_block    = "10.0.0.0/16"
+  vpc_peering_connection_id = "pcx-578451154151544"
 }
\ No newline at end of file