Repository: Checkmarx/kics (language: python)

Issue:
bug(terraform): policy without principal false positive
# Description

- Platform: Terraform
- Provider: AWS

The `All policies, except IAM identity-based policies, should have the 'Principal' element defined` (`bbe3dd3d-fea9-4b68-a785-cfabe2bbbc54`) is firing when it shouldn't be.

### Expected Behavior

No error is returned

### Actual Behavior

```
Policy Without Principal, Severity: MEDIUM, Results: 1
Description: All policies, except IAM identity-based policies, should have the 'Principal' element defined
Platform: Terraform
Learn more about this vulnerability: https://docs.kics.io/latest/queries/terraform-queries/aws/bbe3dd3d-fea9-4b68-a785-cfabe2bbbc54

        [1]: ../../path/role.tf:32

                031:     name   = "default"
                032:     policy = data.aws_iam_policy_document.example.json
                033:   }
```

minimal code:
```
data "aws_iam_policy_document" "example" {
  statement {
    actions = [
      "cloudwatch:PutMetricData",
    ]

    resources = ["*"]
  }
}

data "aws_iam_policy_document" "lambda_assume" {
  statement {
    actions = [
      "sts:AssumeRole",
    ]
    principals {
      type = "Service"
      identifiers = [
        "lambda.amazonaws.com"
      ]
    }
  }
}

resource "aws_iam_role" "example" {
  name               = "example-role"
  assume_role_policy = data.aws_iam_policy_document.lambda_assume.json

  inline_policy {
    name   = "default"
    policy = data.aws_iam_policy_document.example.json
  }
}

```

As you can see, the policy is being used as an inline policy in an IAM role, which according to the query description should make the rule not fire. In fact the role actually does have a principal defined, but this rule shouldn't fire regardless.

### Steps to Reproduce the Problem

`docker run --rm -t -v .:/path checkmarx/kics:latest scan -p /path -o "/path/"`

### Specifications

-   Version: v2.0.1
-   Platform: Terraform/docker



Discussion / hints:

Fix patch:
diff --git a/assets/queries/terraform/aws/policy_without_principal/query.rego b/assets/queries/terraform/aws/policy_without_principal/query.rego
index 37510b5344a..07b58da3cf7 100644
--- a/assets/queries/terraform/aws/policy_without_principal/query.rego
+++ b/assets/queries/terraform/aws/policy_without_principal/query.rego
@@ -27,7 +27,7 @@ CxPolicy[result] {
 }
 
 is_iam_identity_based_policy(resource) {
-	iam_identity_based_policy := {"aws_iam_group_policy", "aws_iam_policy", "aws_iam_role_policy", "aws_iam_user_policy"}
+	iam_identity_based_policy := {"aws_iam_group_policy", "aws_iam_policy", "aws_iam_role_policy", "aws_iam_user_policy", "aws_iam_role"}
 	resource == iam_identity_based_policy[_]
 }
 


Test patch:
diff --git a/assets/queries/terraform/aws/policy_without_principal/test/negative4.tf b/assets/queries/terraform/aws/policy_without_principal/test/negative4.tf
new file mode 100644
index 00000000000..e6e3a179a71
--- /dev/null
+++ b/assets/queries/terraform/aws/policy_without_principal/test/negative4.tf
@@ -0,0 +1,33 @@
+data "aws_iam_policy_document" "example" {
+  statement {
+    actions = [
+      "cloudwatch:PutMetricData",
+    ]
+
+    resources = ["*"]
+  }
+}
+
+data "aws_iam_policy_document" "lambda_assume" {
+  statement {
+    actions = [
+      "sts:AssumeRole",
+    ]
+    principals {
+      type = "Service"
+      identifiers = [
+        "lambda.amazonaws.com"
+      ]
+    }
+  }
+}
+
+resource "aws_iam_role" "example" {
+  name               = "example-role"
+  assume_role_policy = data.aws_iam_policy_document.lambda_assume.json
+
+  inline_policy {
+    name   = "default"
+    policy = data.aws_iam_policy_document.example.json
+  }
+}
\ No newline at end of file