Repository: bridgecrewio/checkov (Python)

Issue:
False negative for ` CKV_AZURE_177: "Ensure Windows VM enables automatic updates"`
**Describe the issue**
False negative for `CKV_AZURE_177: "Ensure Windows VM enables automatic updates"`

The default value for `enable_automatic_updates` is `true`, so for scripts without this key, this check is false negative.

Terraform documentation: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/windows_virtual_machine#enable_automatic_updates

**Version (please complete the following information):**
 - Checkov Version: 2.3.142

**Additional context**
Related: https://github.com/bridgecrewio/checkov/issues/4825


Discussion:

Patch:
diff --git a/checkov/terraform/checks/resource/azure/WinVMAutomaticUpdates.py b/checkov/terraform/checks/resource/azure/WinVMAutomaticUpdates.py
index db62555e01..33871f2a82 100644
--- a/checkov/terraform/checks/resource/azure/WinVMAutomaticUpdates.py
+++ b/checkov/terraform/checks/resource/azure/WinVMAutomaticUpdates.py
@@ -1,4 +1,4 @@
-from checkov.common.models.enums import CheckCategories
+from checkov.common.models.enums import CheckCategories, CheckResult
 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
 
 
@@ -11,7 +11,8 @@ def __init__(self) -> None:
         id = "CKV_AZURE_177"
         supported_resources = ("azurerm_windows_virtual_machine", "azurerm_windows_virtual_machine_scale_set")
         categories = (CheckCategories.GENERAL_SECURITY,)
-        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,
+                         missing_block_result=CheckResult.PASSED)
 
     def get_inspected_key(self) -> str:
         return "enable_automatic_updates"


Test patch:
diff --git a/tests/terraform/checks/resource/azure/example_WinVMAutomaticUpdates/main.tf b/tests/terraform/checks/resource/azure/example_WinVMAutomaticUpdates/main.tf
index bd409d1589..0ff5fda5b9 100644
--- a/tests/terraform/checks/resource/azure/example_WinVMAutomaticUpdates/main.tf
+++ b/tests/terraform/checks/resource/azure/example_WinVMAutomaticUpdates/main.tf
@@ -22,7 +22,8 @@ resource "azurerm_windows_virtual_machine" "pass" {
     version   = "latest"
   }
 }
-resource "azurerm_windows_virtual_machine" "fail" {
+
+resource "azurerm_windows_virtual_machine" "missing" {
   name                = "example-machine"
   resource_group_name = azurerm_resource_group.example.name
   location            = azurerm_resource_group.example.location
@@ -46,7 +47,7 @@ resource "azurerm_windows_virtual_machine" "fail" {
   }
 }
 
-resource "azurerm_windows_virtual_machine" "fail2" {
+resource "azurerm_windows_virtual_machine" "fail" {
   name                = "example-machine"
   resource_group_name = azurerm_resource_group.example.name
   location            = azurerm_resource_group.example.location
@@ -104,6 +105,7 @@ resource "azurerm_windows_virtual_machine_scale_set" "pass" {
     }
   }
 }
+
 resource "azurerm_windows_virtual_machine_scale_set" "fail" {
   name                = "example-vmss"
   resource_group_name = azurerm_resource_group.example.name
@@ -138,7 +140,7 @@ resource "azurerm_windows_virtual_machine_scale_set" "fail" {
   }
 }
 
-resource "azurerm_windows_virtual_machine_scale_set" "fail2" {
+resource "azurerm_windows_virtual_machine_scale_set" "missing" {
   name                = "example-vmss"
   resource_group_name = azurerm_resource_group.example.name
   location            = azurerm_resource_group.example.location
diff --git a/tests/terraform/checks/resource/azure/test_WinVMAutomaticUpdates.py b/tests/terraform/checks/resource/azure/test_WinVMAutomaticUpdates.py
index e29ad64f47..942f7d7ff5 100644
--- a/tests/terraform/checks/resource/azure/test_WinVMAutomaticUpdates.py
+++ b/tests/terraform/checks/resource/azure/test_WinVMAutomaticUpdates.py
@@ -20,12 +20,12 @@ def test(self):
         passing_resources = {
             "azurerm_windows_virtual_machine.pass",
             "azurerm_windows_virtual_machine_scale_set.pass",
+            "azurerm_windows_virtual_machine.missing",
+            "azurerm_windows_virtual_machine_scale_set.missing"
         }
         failing_resources = {
             "azurerm_windows_virtual_machine.fail",
-            "azurerm_windows_virtual_machine.fail2",
             "azurerm_windows_virtual_machine_scale_set.fail",
-            "azurerm_windows_virtual_machine_scale_set.fail2"
         }
 
         passed_check_resources = {c.resource for c in report.passed_checks}