Repository: Checkmarx/kics (language: python)

Issue:
"WRN Failed to detect line" when scanning an Ansible role
There seems to be an issue with the `iam_access_analyzer_not_enabled` query in v1.7.4 when scanning an Ansible role.

### Expected Behavior
The scan finishes without error.

### Actual Behavior
KICS reports errors like `WRN Failed to detect line, query response Resources fileName=/workspace/test-role-1/tasks/main.yml queryName=iam_access_analyzer_not_enabled scanID=console`.

This happens in v1.7.4 but not in v1.7.3.

### Steps to Reproduce the Problem

1.  Clone the repo [here](https://github.com/anappi-wex/wex-kics-bug-recreation) or unzip [Archive.zip](https://github.com/Checkmarx/kics/files/12177178/Archive.zip)
2.  From the project's root, run `ansible-playbook playbook.yml`

I included the debug logs in that repo as well in the file `playbook.log`.

This recreates the problem discussed [here](https://github.com/Checkmarx/kics/discussions/6533).

This seems to be a problem with the variables in `vars/main.yml`.
This was the minimal set of vars and values that I could narrow it down to:
```yaml
---
my_var: provider:a
service: foo
```

As weird as it sounds, if you delete a character from "provider" or "service", it works again.
Same if you delete ":a".

### Specifications

-   Version: 1.7.4
-   Platform: N/A
-   Subsystem: N/A




Discussion / hints:
Hello @anappi-wex ,

First of all, thank you for bringing this issue to our attention. 

After analyzing the situation, the query in question is not working as expected, it assumes that the ''Resources'' property is present in all yaml/json files, which it obviously is not. I will fix it and link your issue to the corresponding PR. 

Marco Pereira

Fix patch:
diff --git a/assets/queries/cloudFormation/aws/iam_access_analyzer_not_enabled/query.rego b/assets/queries/cloudFormation/aws/iam_access_analyzer_not_enabled/query.rego
index 18e106e026b..ed295d5fd47 100644
--- a/assets/queries/cloudFormation/aws/iam_access_analyzer_not_enabled/query.rego
+++ b/assets/queries/cloudFormation/aws/iam_access_analyzer_not_enabled/query.rego
@@ -6,7 +6,10 @@ import data.generic.common as common_lib
 extensions := {".json", ".yaml"}
 
 CxPolicy[result] {
-	count({i | resources := input.document[i].Resources; resources[_].Type == "AWS::AccessAnalyzer::Analyzer"}) == 0
+
+	resources := input.document[i].Resources;
+	count(resources) > 0
+	count({i | resources[_].Type == "AWS::AccessAnalyzer::Analyzer"}) == 0
 
 	result := {
 		"documentId": input.document[i].id,


Test patch:
diff --git a/assets/queries/cloudFormation/aws/iam_access_analyzer_not_enabled/test/negative2.json b/assets/queries/cloudFormation/aws/iam_access_analyzer_not_enabled/test/negative2.json
new file mode 100644
index 00000000000..8ca799f2dab
--- /dev/null
+++ b/assets/queries/cloudFormation/aws/iam_access_analyzer_not_enabled/test/negative2.json
@@ -0,0 +1,43 @@
+{
+    "AWSTemplateFormatVersion": "2010-09-09",
+    "Resources": {
+      "Analyzer": {
+        "Type": "AWS::AccessAnalyzer::Analyzer",
+        "Properties": {
+          "AnalyzerName": "MyAccountAnalyzer",
+          "Type": "ACCOUNT",
+          "Tags": [
+            {
+              "Key": "Kind",
+              "Value": "Dev"
+            }
+          ],
+          "ArchiveRules": [
+            {
+              "RuleName": "ArchiveTrustedAccountAccess",
+              "Filter": [
+                {
+                  "Property": "principal.AWS",
+                  "Eq": [
+                    "123456789012"
+                  ]
+                }
+              ]
+            },
+            {
+              "RuleName": "ArchivePublicS3BucketsAccess",
+              "Filter": [
+                {
+                  "Property": "resource",
+                  "Contains": [
+                    "arn:aws:s3:::docs-bucket",
+                    "arn:aws:s3:::clients-bucket"
+                  ]
+                }
+              ]
+            }
+          ]
+        }
+      }
+    }
+  }
\ No newline at end of file
diff --git a/assets/queries/cloudFormation/aws/iam_access_analyzer_not_enabled/test/positive2.json b/assets/queries/cloudFormation/aws/iam_access_analyzer_not_enabled/test/positive2.json
new file mode 100644
index 00000000000..ab84c0e7708
--- /dev/null
+++ b/assets/queries/cloudFormation/aws/iam_access_analyzer_not_enabled/test/positive2.json
@@ -0,0 +1,16 @@
+{
+    "AWSTemplateFormatVersion": "2010-09-09",
+    "Description": "A sample template 2",
+    "Resources": {
+      "myuseeer": {
+        "Type": "AWS::IAM::Group",
+        "Properties": {
+          "Path": "/",
+          "LoginProfile": {
+            "Password": "myP@ssW0rd"
+          }
+        }
+      }
+    }
+  }
+  
\ No newline at end of file
diff --git a/assets/queries/cloudFormation/aws/iam_access_analyzer_not_enabled/test/positive_expected_result.json b/assets/queries/cloudFormation/aws/iam_access_analyzer_not_enabled/test/positive_expected_result.json
index 37e668d597d..c0896937034 100644
--- a/assets/queries/cloudFormation/aws/iam_access_analyzer_not_enabled/test/positive_expected_result.json
+++ b/assets/queries/cloudFormation/aws/iam_access_analyzer_not_enabled/test/positive_expected_result.json
@@ -4,5 +4,11 @@
     "severity": "LOW",
     "line": 3,
     "fileName": "positive1.yaml"
+  },
+  {
+    "queryName": "IAM Access Analyzer Not Enabled",
+    "severity": "LOW",
+    "line": 4,
+    "fileName": "positive2.json"
   }
 ]