# Buggy code
def scan_resource_conf(self, conf):
    """
        Looks for password configuration at google_compute_firewall:
        https://www.terraform.io/docs/providers/google/r/compute_firewall.html
    :param conf: azure_instance configuration
    :return: <CheckResult>
    """
    if PORT in conf["allow"][0]["ports"][0]:
        if "source_ranges" in conf.keys():
            source_ranges = conf["source_ranges"][0]
            if "0.0.0.0/0" in source_ranges:
                return CheckResult.FAILED
    return CheckResult.PASSED


# Traceback (KeyError)
temikus λ checkov
...
version: 1.0.131
...

λ mkdir test &amp;&amp; cd test
λ wget https://gist.githubusercontent.com/Temikus/6be1f3e408d84f609a739718a42e3cf5/raw/971c5834234d32b3ddf4614defd6a641249d935c/checkov_fail.tf

λ checkov -d .
ERROR:checkov.terraform.checks.resource.gcp.GoogleComputeFirewallUnrestrictedIngress3389:Failed to run check Ensure Google compute firewall ingress does not allow unrestricted rdp access for configuration {'description': ['allow Google health checks and network load balancers access'], 'name': ['my-firewall'], 'network': ['default'], 'allow': [{'protocol': ['icmp']}, {'protocol': ['tcp'], 'ports': [['8080', '443']]}], 'source_ranges': [['130.211.0.0/22', '35.191.0.0/16']], 'target_tags': [['my-tag']]}
Traceback (most recent call last):
File "/Users/temikus/.homebrew/bin/checkov", line 5, in <module>
run()
File "/Users/temikus/.homebrew/lib/python3.7/site-packages/checkov/main.py", line 37, in run
report = Runner().run(root_folder, external_checks_dir=args.external_checks_dir, files=file)
File "/Users/temikus/.homebrew/lib/python3.7/site-packages/checkov/terraform/runner.py", line 29, in run
self.check_tf_definition(report, root_folder, tf_definitions)
File "/Users/temikus/.homebrew/lib/python3.7/site-packages/checkov/terraform/runner.py", line 52, in check_tf_definition
block_type)
File "/Users/temikus/.homebrew/lib/python3.7/site-packages/checkov/terraform/runner.py", line 66, in run_block
results = registry.scan(entity, scanned_file, skipped_checks)
File "/Users/temikus/.homebrew/lib/python3.7/site-packages/checkov/terraform/checks/utilities/base_registry.py", line 39, in scan
entity_name=entity_name, entity_type=entity, skip_info=skip_info)
File "/Users/temikus/.homebrew/lib/python3.7/site-packages/checkov/terraform/checks/utilities/base_check.py", line 44, in run
raise e
File "/Users/temikus/.homebrew/lib/python3.7/site-packages/checkov/terraform/checks/utilities/base_check.py", line 33, in run
check_result['result'] = self.scan_entity_conf(entity_configuration)
File "/Users/temikus/.homebrew/lib/python3.7/site-packages/checkov/terraform/checks/resource/base_check.py", line 20, in scan_entity_conf
return self.scan_resource_conf(conf)
File "/Users/temikus/.homebrew/lib/python3.7/site-packages/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3389.py", line 22, in scan_resource_conf
if PORT in conf['allow'][0]['ports'][0]:
KeyError: 'ports'

# Fixed code
def scan_resource_conf(self, conf):
    """
        Looks for password configuration at google_compute_firewall:
        https://www.terraform.io/docs/providers/google/r/compute_firewall.html
    :param conf: azure_instance configuration
    :return: <CheckResult>
    """
    allow_blocks = conf["allow"]
    for block in allow_blocks:
        if "ports" in block.keys():
            if PORT in block["ports"][0]:
                if "source_ranges" in conf.keys():
                    source_ranges = conf["source_ranges"][0]
                    if "0.0.0.0/0" in source_ranges:
                        return CheckResult.FAILED
    return CheckResult.PASSED