Repository: bridgecrewio/checkov
Issue category: Bug Report

Issue:
checkov (3.2.334) serverless check crashes with `TypeError: unhashable type: 'DictNode'`
**Describe the issue**
We use the checkov serverless checks in our github actions ci/cd and as of yesterday (Monday Dec, 9 2024) it crashes trying to run when we use the latest release https://github.com/bridgecrewio/checkov/releases/tag/3.2.334

We pinned to the previous version which was working for us: https://github.com/bridgecrewio/checkov/releases/tag/3.2.332 through the github action:
`bridgecrewio/checkov-action@v12` -> `bridgecrewio/checkov-action@v12.2932.0`

We use serverless v4.

**Examples**
Please share an example code sample (in the IaC of your choice) + the expected outcomes.

**Exception Trace**
```
2024-12-10 16:09:42,658 [MainThread  ] [DEBUG]  Using cert_reqs None
2024-12-10 16:09:42,658 [MainThread  ] [DEBUG]  Successfully set up HTTP manager
2024-12-10 16:09:42,658 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): serverless
2024-12-10 16:09:42,658 [MainThread  ] [DEBUG]  BC_SOURCE = cli, version = 3.2.334
2024-12-10 16:09:42,658 [MainThread  ] [DEBUG]  serverless_runner declares no system dependency checks required.
2024-12-10 16:09:42,658 [MainThread  ] [DEBUG]  No API key found. Scanning locally only.
2024-12-10 16:09:42,912 [MainThread  ] [DEBUG]  Got checkov mappings and guidelines from Bridgecrew platform
2024-12-10 16:09:42,912 [MainThread  ] [DEBUG]  Loading external checks from /Users/mandeep/rewind/dewey/.venv/lib/python3.12/site-packages/checkov/serverless/checks/graph_checks
2024-12-10 16:09:42,916 [MainThread  ] [DEBUG]  Running without API key, so only open source runners will be enabled
2024-12-10 16:09:42,916 [MainThread  ] [DEBUG]  Received the following policy-level suppressions, that will be skipped from running: []
2024-12-10 16:09:42,917 [MainThread  ] [DEBUG]  Filtered list of policies: []
2024-12-10 16:09:42,917 [MainThread  ] [DEBUG]  Filtered excluded list of policies: []
2024-12-10 16:09:42,917 [MainThread  ] [DEBUG]  Checking if serverless is valid for license
2024-12-10 16:09:42,917 [MainThread  ] [DEBUG]  Open source mode - the runner is enabled
2024-12-10 16:09:42,924 [MainThread  ] [DEBUG]  Running function /Users/mandeep/rewind/dewey/.venv/lib/python3.12/site-packages/checkov/serverless/utils._parallel_parse with parallelization type 'thread'
2024-12-10 16:09:42,948 [ThreadPoolEx] [DEBUG]  Processing of ./serverless.yml variables took 4 loop iterations
2024-12-10 16:09:42,948 [MainThread  ] [INFO ]  Creating Serverless graph
2024-12-10 16:09:42,958 [MainThread  ] [ERROR]  Exception traceback:
Traceback (most recent call last):
  File "/Users/mandeep/rewind/dewey/.venv/lib/python3.12/site-packages/checkov/main.py", line 522, in run
    self.scan_reports = runner_registry.run(
                        ^^^^^^^^^^^^^^^^^^^^
  File "/Users/mandeep/rewind/dewey/.venv/lib/python3.12/site-packages/checkov/common/runners/runner_registry.py", line 126, in run
    self.runners[0].run(root_folder, external_checks_dir=external_checks_dir, files=files,
  File "/Users/mandeep/rewind/dewey/.venv/lib/python3.12/site-packages/checkov/serverless/runner.py", line 119, in run
    local_graph = self.graph_manager.build_graph_from_definitions(definitions=self.definitions)
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/mandeep/rewind/dewey/.venv/lib/python3.12/site-packages/checkov/serverless/graph_manager.py", line 38, in build_graph_from_definitions
    local_graph.build_graph(render_variables=render_variables)
  File "/Users/mandeep/rewind/dewey/.venv/lib/python3.12/site-packages/checkov/serverless/graph_builder/local_graph.py", line 21, in build_graph
    self._create_vertices()
  File "/Users/mandeep/rewind/dewey/.venv/lib/python3.12/site-packages/checkov/serverless/graph_builder/local_graph.py", line 33, in _create_vertices
    self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.RESOURCES)
  File "/Users/mandeep/rewind/dewey/.venv/lib/python3.12/site-packages/checkov/serverless/graph_builder/local_graph.py", line 62, in _create_vertex
    if attribute in LINE_FIELD_NAMES:
       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: unhashable type: 'DictNode'
```


```sh
pip3 install --force-reinstall -v "checkov==3.2.334"
checkov --version
3.2.334
LOG_LEVEL=DEBUG checkov
```
Full trace attached:
[checkov-broken.txt](https://github.com/user-attachments/files/18086093/checkov-broken.txt)



```sh
pip3 install --force-reinstall -v "checkov==3.2.332"
checkov --version
3.2.332
LOG_LEVEL=DEBUG checkov
```
Full trace attached:
[checkov-working.txt](https://github.com/user-attachments/files/18086091/checkov-working.txt)

**Desktop (please complete the following information):**
 - OS: `macos 15.1.1 (24B91)`
 - Checkov Version: `3.2.334`

**Additional context**
Add any other context about the problem here (e.g. code snippets).

.checkov.yml contents:
```yaml
branch: main
compact: true
directory:
  - .
download-external-modules: false
evaluate-variables: true
external-modules-download-path: .external_modules
framework:
  - serverless
quiet: true
```



Hints:
Hey @mkhinda29,
I see that the parsing of the Resources section of your serverless.yaml is failing. 
If you could please provide data that will allow me to reproduce this issue it would be very helpful. 
Even just the Resources section should suffice.
Thank you!
> Hey @mkhinda29, I see that the parsing of the Resources section of your serverless.yaml is failing. If you could please provide data that will allow me to reproduce this issue it would be very helpful. Even just the Resources section should suffice. Thank you!

Hey @omriyoffe-panw I've attached 4 files:

- A high level view of the serverless file: 
![Screenshot 2024-12-11 at 1 31 30 PM](https://github.com/user-attachments/assets/d5b1e869-a367-40ec-9f26-85c568c8c666)

- The resources section: 
[serverless-resources.yml.txt](https://github.com/user-attachments/files/18100739/serverless-resources.yml.txt)

- The 2 externally referenced files within the resources section: 
[dashboard.yml.txt](https://github.com/user-attachments/files/18100734/dashboard.yml.txt)
[cloudWatchWidgets.js.txt](https://github.com/user-attachments/files/18100730/cloudWatchWidgets.js.txt)

I tried to obfuscate anything internal to us, but I hope this helps you reproduce the error
Let me know if there is any other data I can provide.

Patch:
diff --git a/checkov/serverless/graph_builder/local_graph.py b/checkov/serverless/graph_builder/local_graph.py
index 6601f4bca5a..2cd90746b03 100644
--- a/checkov/serverless/graph_builder/local_graph.py
+++ b/checkov/serverless/graph_builder/local_graph.py
@@ -59,7 +59,7 @@ def _create_vertex(self, file_path: str, definition: dict[str, Any] | None,
 
         else:
             for attribute in resources:
-                if attribute in LINE_FIELD_NAMES:
+                if isinstance(attribute, str) and attribute in LINE_FIELD_NAMES:
                     continue
 
                 if isinstance(resources, list):


Test patch:
diff --git a/tests/arm/checks/resource/example_TestMySQLPublicAccessDisabled/fail2.json b/tests/arm/checks/resource/example_TestMySQLPublicAccessDisabled/fail2.json
index fa88ce13028..73780d243ef 100644
--- a/tests/arm/checks/resource/example_TestMySQLPublicAccessDisabled/fail2.json
+++ b/tests/arm/checks/resource/example_TestMySQLPublicAccessDisabled/fail2.json
@@ -15,7 +15,7 @@
       "location": "eastus",
       "properties": {
         "administratorLogin": "adminuser",
-        "administratorLoginPassword": "YourSecurePassword123!",
+        "administratorLoginPassword": "1234",
         "availabilityZone": "1",
         "backup": {
           "backupIntervalHours": 24,
diff --git a/tests/arm/checks/resource/example_TestMySQLPublicAccessDisabled/pass2.json b/tests/arm/checks/resource/example_TestMySQLPublicAccessDisabled/pass2.json
index d3446b6b07d..a506b7eb7f3 100644
--- a/tests/arm/checks/resource/example_TestMySQLPublicAccessDisabled/pass2.json
+++ b/tests/arm/checks/resource/example_TestMySQLPublicAccessDisabled/pass2.json
@@ -15,7 +15,7 @@
       "location": "eastus",
       "properties": {
         "administratorLogin": "adminuser",
-        "administratorLoginPassword": "YourSecurePassword123!",
+        "administratorLoginPassword": "1234",
         "availabilityZone": "1",
         "backup": {
           "backupIntervalHours": 24,