Repository: bridgecrewio/checkov (Python)

Issue:
CKV_AWS_118 Fails With MonitoringInterval Integer Value
**Describe the issue**
CKV_AWS_118 fails if the `MonitoringInterval` value is not wrapped in double quotes despite the fact that the source code says it should allow ints and strings.

**Examples**
```
RDSinstance:
    Type: AWS::RDS::DBInstance
    Properties:
      DBClusterIdentifier: !Ref DBCluster
      DBInstanceClass: !Ref DbType
      DBInstanceIdentifier: !Sub ${AppName}-${EnvironmentName}
      DBParameterGroupName: !Ref DbParameterGroup
      DBSubnetGroupName: !Ref DBSubnetGroup
      Engine: aurora-mysql
      MonitoringInterval: 60
      MonitoringRoleArn: !GetAtt RdsMonitoringRole.Arn
      PubliclyAccessible: 'false'
```

**Version (please complete the following information):**
 - Checkov Version 2.2.255 (CLI)

**Additional context**
The test failure happens with the CLI and also using a GItHub Action `bridgecrewio/checkov-action@master`

![Screenshot 2023-01-13 at 8 52 02 AM](https://user-images.githubusercontent.com/1328683/212362109-7c0d3751-08e4-4428-9120-37edf3e85f88.png)




Discussion:
hey @enzowritescode thanks for reaching out.
Looks like a bug on our end, I was able to reproduce and will create a PR to fix it.



Patch:
diff --git a/checkov/cloudformation/checks/resource/base_resource_value_check.py b/checkov/cloudformation/checks/resource/base_resource_value_check.py
index ac02a302c0..a9ab77082b 100644
--- a/checkov/cloudformation/checks/resource/base_resource_value_check.py
+++ b/checkov/cloudformation/checks/resource/base_resource_value_check.py
@@ -60,7 +60,8 @@ def scan_resource_conf(self, conf: Dict[StrNode, DictNode]) -> CheckResult:
                 # CFN files are parsed differently from terraform, which causes the path search above to behave differently.
                 # The tesult is path parts with integer indexes, instead of strings like '[0]'. This logic replaces
                 # those, allowing inspected_keys in checks to use the same syntax.
-                for i in range(0, len(match)):
+                # The last value shouldn't be changed, because it could be indeed a valid number
+                for i in range(0, len(match) - 1):
                     if type(match[i]) == int:
                         match[i] = f"[{match[i]}]"
 


Test patch:
diff --git a/tests/cloudformation/checks/resource/aws/example_RDSEnhancedMonitorEnabled/PASS.yaml b/tests/cloudformation/checks/resource/aws/example_RDSEnhancedMonitorEnabled/PASS.yaml
index 6f2bd2e003..af3fe519b0 100644
--- a/tests/cloudformation/checks/resource/aws/example_RDSEnhancedMonitorEnabled/PASS.yaml
+++ b/tests/cloudformation/checks/resource/aws/example_RDSEnhancedMonitorEnabled/PASS.yaml
@@ -10,3 +10,13 @@ Resources:
       MasterUserPassword: 'password'
       MonitoringInterval: '60'
       MonitoringRoleArn: 'arn:aws:iam::123456789012:role/rds-monitoring-role'
+  EnabledNumber:
+    Type: 'AWS::RDS::DBInstance'
+    Properties:
+      DBName: 'mydb'
+      DBInstanceClass: 'db.t3.micro'
+      Engine: 'mysql'
+      MasterUsername: 'master'
+      MasterUserPassword: 'password'
+      MonitoringInterval: 30
+      MonitoringRoleArn: 'arn:aws:iam::123456789012:role/rds-monitoring-role'
diff --git a/tests/cloudformation/checks/resource/aws/test_RDSEnhancedMonitorEnabled.py b/tests/cloudformation/checks/resource/aws/test_RDSEnhancedMonitorEnabled.py
index 58c2cda9be..3ea0d13c32 100644
--- a/tests/cloudformation/checks/resource/aws/test_RDSEnhancedMonitorEnabled.py
+++ b/tests/cloudformation/checks/resource/aws/test_RDSEnhancedMonitorEnabled.py
@@ -19,6 +19,7 @@ def test_summary(self):
 
         passing_resources = {
             "AWS::RDS::DBInstance.Enabled",
+            "AWS::RDS::DBInstance.EnabledNumber",
         }
         failing_resources = {
             "AWS::RDS::DBInstance.Default",