Repository: bridgecrewio/checkov

Issue:
False positive on CKV_TF_2 using shallow clone
**Describe the issue**

 Introduced in #6213, CKV_TF_2 generates a false positive when using [shallow clone](https://developer.hashicorp.com/terraform/language/modules/sources#shallow-clone).

**Examples**
```
module "bogus" {
  source = "git::https://example.com/bogus.git?depth=1&ref=v1.2.0"
}

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
	FAILED for resource: bogus
	File: /bogus.tf:28-59
```

**Version (please complete the following information):**
 - Checkov Version [3.2.92](https://hub.docker.com/layers/bridgecrew/checkov/3.2.92/images/sha256-84dc5f96cbe69cefd2c9e0596eeecc15829d832e4f72b489b196c0066a68d615?context=explore)


Discussion:
Hey @mouellet - sorry about that. Thanks for raising it. We'll merge a fix shortly.
Apologies for the delay - I am having an issue with an unrelated integration test that I want to make sure gets fixed.



Patch:
diff --git a/checkov/terraform/checks/module/generic/RevisionVersionTag.py b/checkov/terraform/checks/module/generic/RevisionVersionTag.py
index 0335d50c59..14626ecf02 100644
--- a/checkov/terraform/checks/module/generic/RevisionVersionTag.py
+++ b/checkov/terraform/checks/module/generic/RevisionVersionTag.py
@@ -7,7 +7,7 @@
 from checkov.terraform.checks.module.base_module_check import BaseModuleCheck
 from .RevisionHash import check as RevisionHashCheck
 
-VERSION_PATTERN = re.compile(r"\?(ref=).*(\d\.\d).*")
+VERSION_PATTERN = re.compile(r"[?&](ref=).*(\d\.\d).*")
 
 
 class RevisionVersionTag(BaseModuleCheck):
@@ -27,7 +27,7 @@ def scan_module_conf(self, conf: dict[str, list[Any]]) -> CheckResult:
         source = conf.get("source")
         if source and isinstance(source, list):
             source_url = source[0]
-            if "?ref" in source_url and re.search(VERSION_PATTERN, source_url):
+            if ("?ref" in source_url or "&ref" in source_url) and re.search(VERSION_PATTERN, source_url):
                 return CheckResult.PASSED
 
         return CheckResult.FAILED


Test patch:
diff --git a/tests/terraform/checks/module/generic/example_RevisionVersionTag/main.tf b/tests/terraform/checks/module/generic/example_RevisionVersionTag/main.tf
index 37fdab7a90..f28d74aa52 100644
--- a/tests/terraform/checks/module/generic/example_RevisionVersionTag/main.tf
+++ b/tests/terraform/checks/module/generic/example_RevisionVersionTag/main.tf
@@ -45,6 +45,10 @@ module "tag" {
   }
 }
 
+module "shallow_clone" {
+  source = "git::https://github.com/terraform-aws-modules/terraform-aws-vpc.git?depth=1&ref=v1.2.0"
+}
+
 # fail
 
 module "tf_registry" {
diff --git a/tests/terraform/checks/module/generic/test_RevisionVersionTag.py b/tests/terraform/checks/module/generic/test_RevisionVersionTag.py
index 0591ee3cab..505fa57904 100644
--- a/tests/terraform/checks/module/generic/test_RevisionVersionTag.py
+++ b/tests/terraform/checks/module/generic/test_RevisionVersionTag.py
@@ -21,6 +21,7 @@ def test(self):
             "hash",
             "sub_dir_hash",
             "tag",
+            "shallow_clone"
         }
         failing_resources = {
             "looks_like_a_branch",