Repository: bridgecrewio/checkov
Pull request: fix CKV_AZURE_116 to reflect changes in v2.97.0 of Terraform Azure provider
fixes #3006 

Unfortunately, I couldn't find the place to update the docs at https://docs.bridgecrew.io/docs/ensure-that-aks-uses-azure-policies-add-on. If someone can point me to the corresponding place, I will also update the docs.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Problem statement:
CKV_AZURE_116 fails with Terraform Azure provider >= v.2.97.0
**Describe the issue**
This issue is regarding CKV_AZURE_116.
Since v2.97.0 of the Azure Terraform provider, the Azure policies add-on is enabled by setting

```terraform
azure_policy_enabled = true
```

as a top-level property in a `azurerm_kubernetes_cluster` resource definition, instead of the following

```terraform
addon_profile {
  azure_policy {
    enabled = true
  }
}
```
The check should be updated to reflect the change.

**Examples**
```terraform
resource "azurerm_kubernetes_cluster" "example" {
  azure_policy_enabled = true
}
```
should pass the check for CKV_AZURE_116.

**Version:**
2.0.1160

**Additional context**
None

I will submit a PR to fix this.

Hints from issue discussion:

Commit message: fix CKV_AZURE_116 to reflect changes in v2.97.0 of Terraform Azure provider

Patch to review:
diff --git a/checkov/terraform/checks/resource/azure/AKSUsesAzurePoliciesAddon.py b/checkov/terraform/checks/resource/azure/AKSUsesAzurePoliciesAddon.py
index 5132754c7c..22a4b520b1 100644
--- a/checkov/terraform/checks/resource/azure/AKSUsesAzurePoliciesAddon.py
+++ b/checkov/terraform/checks/resource/azure/AKSUsesAzurePoliciesAddon.py
@@ -1,8 +1,10 @@
-from checkov.common.models.enums import CheckCategories
-from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
+from typing import Dict, List, Any
 
+from checkov.common.models.enums import CheckCategories, CheckResult
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
 
-class AKSUsesAzurePoliciesAddon(BaseResourceValueCheck):
+
+class AKSUsesAzurePoliciesAddon(BaseResourceCheck):
     def __init__(self):
         name = "Ensure that AKS uses Azure Policies Add-on"
         id = "CKV_AZURE_116"
@@ -10,8 +12,20 @@ def __init__(self):
         categories = [CheckCategories.NETWORKING]
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def get_inspected_key(self):
-        return "addon_profile/[0]/azure_policy/[0]/enabled"
+    def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:
+        # since Azure provider v2.97.0
+        azure_policy_enabled = conf.get("azure_policy_enabled", [None])[0]
+        if azure_policy_enabled:
+            self.evaluated_keys = ["azure_policy_enabled"]
+            return CheckResult.PASSED
+        # up to and including Azure provider v2.96.0
+        addon_profile = conf.get("addon_profile", [None])[0]
+        if addon_profile and isinstance(addon_profile, dict):
+            azure_policy = addon_profile.get("azure_policy", [None])[0]
+            if azure_policy and isinstance(azure_policy, dict) and azure_policy.get("enabled", [None])[0]:
+                self.evaluated_keys = ["addon_profile/[0]/azure_policy/[0]/enabled"]
+                return CheckResult.PASSED
+        return CheckResult.FAILED
 
 
 check = AKSUsesAzurePoliciesAddon()
diff --git a/tests/terraform/checks/resource/azure/test_AKSUsesAzurePoliciesAddon.py b/tests/terraform/checks/resource/azure/test_AKSUsesAzurePoliciesAddon.py
index 33a84bc4f4..399b6ec328 100644
--- a/tests/terraform/checks/resource/azure/test_AKSUsesAzurePoliciesAddon.py
+++ b/tests/terraform/checks/resource/azure/test_AKSUsesAzurePoliciesAddon.py
@@ -48,17 +48,17 @@ def test_failure2(self):
                       enabled = false
                     }
                   }
-                  
+
                   default_node_pool {
                     name       = "default"
                     node_count = 1
                     vm_size    = "Standard_D2_v2"
                   }
-                
+
                   identity {
                     type = "SystemAssigned"
                   }
-                
+
                   tags = {
                     Environment = "Production"
                   }
@@ -68,6 +68,7 @@ def test_failure2(self):
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
+
     def test_failure3(self):
         hcl_res = hcl2.loads("""
                 resource "azurerm_kubernetes_cluster" "example" {
@@ -79,17 +80,47 @@ def test_failure3(self):
                   azure_policy {
                     enabled = true
                   }
-                  
+
                   default_node_pool {
                     name       = "default"
                     node_count = 1
                     vm_size    = "Standard_D2_v2"
                   }
-                
+
                   identity {
                     type = "SystemAssigned"
                   }
-                
+
+                  tags = {
+                    Environment = "Production"
+                  }
+                }
+        """)
+        resource_conf = hcl_res['resource'][0]['azurerm_kubernetes_cluster']['example']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+
+    def test_failure4(self):
+        hcl_res = hcl2.loads("""
+                resource "azurerm_kubernetes_cluster" "example" {
+                  name                = "example-aks1"
+                  location            = azurerm_resource_group.example.location
+                  resource_group_name = azurerm_resource_group.example.name
+                  dns_prefix          = "exampleaks1"
+
+                  azure_policy_enabled = false
+
+                  default_node_pool {
+                    name       = "default"
+                    node_count = 1
+                    vm_size    = "Standard_D2_v2"
+                  }
+
+                  identity {
+                    type = "SystemAssigned"
+                  }
+
                   tags = {
                     Environment = "Production"
                   }
@@ -107,12 +138,43 @@ def test_success(self):
                   location            = azurerm_resource_group.example.location
                   resource_group_name = azurerm_resource_group.example.name
                   dns_prefix          = "exampleaks1"
+                  
                   addon_profile {
                     azure_policy {
                       enabled = true
                     }
                   }
 
+                  default_node_pool {
+                    name       = "default"
+                    node_count = 1
+                    vm_size    = "Standard_D2_v2"
+                  }
+
+                  identity {
+                    type = "SystemAssigned"
+                  }
+
+                  tags = {
+                    Environment = "Production"
+                  }
+                }
+        """)
+        resource_conf = hcl_res['resource'][0]['azurerm_kubernetes_cluster']['example']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+    def test_success2(self):
+        hcl_res = hcl2.loads("""
+                resource "azurerm_kubernetes_cluster" "example" {
+                  name                = "example-aks1"
+                  location            = azurerm_resource_group.example.location
+                  resource_group_name = azurerm_resource_group.example.name
+                  dns_prefix          = "exampleaks1"
+                  
+                  azure_policy_enabled = true
+
                   default_node_pool {
                     name       = "default"
                     node_count = 1


Code review comments:
diff_hunk: @@ -1,17 +1,31 @@
-from checkov.common.models.enums import CheckCategories
-from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
+from typing import Dict, List, Any
 
+from checkov.common.models.enums import CheckCategories, CheckResult
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
 
-class AKSUsesAzurePoliciesAddon(BaseResourceValueCheck):
+
+class AKSUsesAzurePoliciesAddon(BaseResourceCheck):
     def __init__(self):
         name = "Ensure that AKS uses Azure Policies Add-on"
         id = "CKV_AZURE_116"
         supported_resources = ['azurerm_kubernetes_cluster']
         categories = [CheckCategories.NETWORKING]
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def get_inspected_key(self):
-        return "addon_profile/[0]/azure_policy/[0]/enabled"
+    def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:
+        # since Azure provider v2.97.0
+        azure_policy_enabled = conf.get("azure_policy_enabled", [None])[0]
+        if azure_policy_enabled:
+            self.evaluated_keys = ["azure_policy_enabled"]
+            return CheckResult.PASSED
+        # up to and including Azure provider v2.96.0
+        addon_profile = conf.get("addon_profile", [None])[0]
+        if addon_profile and isinstance(addon_profile, dict):
+            azure_policy = addon_profile.get("azure_policy", [None])[0]
+            if azure_policy and isinstance(azure_policy, dict) and azure_policy.get("enabled", [None])[0]:
+                self.evaluated_keys = ["addon_profile/[0]/azure_policy/[0]/enabled"]
path: checkov/terraform/checks/resource/azure/AKSUsesAzurePoliciesAddon.py
text: @user1:
```suggestion
        self.evaluated_keys = ["addon_profile/[0]/azure_policy/[0]/enabled"]
        addon_profile = conf.get("addon_profile", [None])[0]
        if addon_profile and isinstance(addon_profile, dict):
            azure_policy = addon_profile.get("azure_policy", [None])[0]
            if azure_policy and isinstance(azure_policy, dict) and azure_policy.get("enabled", [None])[0]:
```
just move the `evaluated_keys` to the beginning of the condition check 🙂 

@author:
Done, thanks for the suggestion =)