Repository: bridgecrewio/checkov

Issue:
CKV_AZURE_189 should take into account virtual_network_subnet_ids
**Describe the issue**
CKV_AZURE_189 should take into account `virtual_network_subnet_ids` too, in addition to `ip_rules`.
Leaving `public_network_access_enabled` and `network_acl.ip_rules` empty makes the check fail even if `network_acl.virtual_network_subnet_ids` is configured properly.

**Examples**

```
resource "azurerm_key_vault" "keyvault" {
  name                        = var.keyvault_name == null ? substr(local.environment_name, 0, 23) : var.keyvault_name
  location                    = azurerm_resource_group.resourcegroup.location
  resource_group_name         = azurerm_resource_group.resourcegroup.name
  enabled_for_disk_encryption = true
  tenant_id                   = data.azurerm_subscription.current.tenant_id
  soft_delete_retention_days  = var.keyvault_soft_delete_retention_days
  purge_protection_enabled    = true

  sku_name = var.keyvault_sku

  tags = var.base_tags
  network_acls {
    bypass         = "AzureServices"
    default_action = "Deny"
    virtual_network_subnet_ids = ["SOME VALID SUBNET ID"]
  }
}
```

**Version (please complete the following information):**
 - 3.2.44
**Additional context**
Add any other context about the problem here.



Discussion:

Patch:
diff --git a/checkov/terraform/checks/resource/azure/KeyVaultDisablesPublicNetworkAccess.py b/checkov/terraform/checks/resource/azure/KeyVaultDisablesPublicNetworkAccess.py
index 73590c14ac..35798e5123 100644
--- a/checkov/terraform/checks/resource/azure/KeyVaultDisablesPublicNetworkAccess.py
+++ b/checkov/terraform/checks/resource/azure/KeyVaultDisablesPublicNetworkAccess.py
@@ -38,6 +38,13 @@ def scan_resource_conf(self, conf) -> CheckResult:
                         ip_rules = ip_rules[0] if ip_rules and isinstance(ip_rules, list) else ip_rules
                         if ip_rules:
                             return CheckResult.PASSED
+                        virtual_network_subnet_ids = network_acl.get("virtual_network_subnet_ids")
+                        # Get first element in virtual_network_subnet_ids (as parser wrap it with list).
+                        virtual_network_subnet_ids = virtual_network_subnet_ids[0] \
+                            if virtual_network_subnet_ids and isinstance(virtual_network_subnet_ids, list) \
+                            else virtual_network_subnet_ids
+                        if virtual_network_subnet_ids:
+                            return CheckResult.PASSED
 
         return CheckResult.FAILED
 


Test patch:
diff --git a/tests/terraform/checks/resource/azure/example_KeyVaultDisablesPublicNetworkAccess/main.tf b/tests/terraform/checks/resource/azure/example_KeyVaultDisablesPublicNetworkAccess/main.tf
index 32231d38b6..07733b1fb7 100644
--- a/tests/terraform/checks/resource/azure/example_KeyVaultDisablesPublicNetworkAccess/main.tf
+++ b/tests/terraform/checks/resource/azure/example_KeyVaultDisablesPublicNetworkAccess/main.tf
@@ -123,6 +123,22 @@ resource "azurerm_key_vault" "pass4" {
   }
 }
 
+resource "azurerm_key_vault" "pass5" {
+  name                                   = "examplepass5"
+  location                               = azurerm_resource_group.example.location
+  resource_group_name                    = azurerm_resource_group.example.name
+  enabled_for_disk_encryption            = true
+  tenant_id                              = data.azurerm_client_config.current.tenant_id
+  soft_delete_retention_days             = 90
+  purge_protection_enabled               = enabled
+  sku_name                               = "standard"
+  network_acls {
+    default_action = "Allow"
+    bypass         = "AzureServices"
+    virtual_network_subnet_ids = ["127.0.0.1/24"]
+  }
+}
+
 resource "azurerm_key_vault" "fail1" {
   name                                   = "examplefail1"
   location                               = azurerm_resource_group.example.location
@@ -259,7 +275,7 @@ resource "azurerm_key_vault" "fail5" {
       default_action             = "Allow"
       bypass                     = "AzureServices"
       ip_rules                   = []
-      virtual_network_subnet_ids = var.subnet_ids
+      virtual_network_subnet_ids = []
     }
   }
 }
diff --git a/tests/terraform/checks/resource/azure/test_KeyVaultDisablesPublicNetworkAccess.py b/tests/terraform/checks/resource/azure/test_KeyVaultDisablesPublicNetworkAccess.py
index 003714318e..b35eb03a0d 100644
--- a/tests/terraform/checks/resource/azure/test_KeyVaultDisablesPublicNetworkAccess.py
+++ b/tests/terraform/checks/resource/azure/test_KeyVaultDisablesPublicNetworkAccess.py
@@ -21,7 +21,8 @@ def test(self):
             'azurerm_key_vault.pass1',
             'azurerm_key_vault.pass2',
             'azurerm_key_vault.pass3',
-            'azurerm_key_vault.pass4'
+            'azurerm_key_vault.pass4',
+            'azurerm_key_vault.pass5'
         }
         failing_resources = {
             'azurerm_key_vault.fail1',