Repository: bridgecrewio/checkov
Pull request: fix(terraform): CKV_AWS_342 - managed rules have predefined actions
**By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.**

[//]: # "
    # PR Title
    Be aware that we use the title to create changelog automatically and therefore only allow specific prefixes
    - break:    to indicate a breaking change, this supersedes any of the types
    - feat:     to indicate new features or checks
    - fix:      to indicate a bugfix or handling of edge cases of existing checks
    - docs:     to indicate an update to our documentation
    - chore:    to indicate adjustments to workflow files or dependency updates
    - platform: to indicate a change needed for the platform
    Additionally a scope is needs to be added to the prefix, which indicates the targeted framework, in doubt choose 'general'.
    #    
    Allowed prefixs:
    ansible|argo|arm|azure|bicep|bitbucket|circleci|cloudformation|dockerfile|github|gha|gitlab|helm|kubernetes|kustomize|openapi|sca|secrets|serverless|terraform|general|graph|terraform_plan|terraform_json
    #
    ex.
    feat(terraform): add CKV_AWS_123 to ensure that VPC Endpoint Service is configured for Manual Acceptance
"

## Description

*Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.*

Fixes # (issue)

## New/Edited policies (Delete if not relevant)

### Description
*Include a description of what makes it a violation and any relevant external links.*

### Fix
*How does someone fix the issue in code and/or in runtime?*

## Checklist:

- [ ] My code follows the style guidelines of this project
- [ ] I have performed a self-review of my own code
- [ ] I have commented my code, particularly in hard-to-understand areas
- [ ] I have made corresponding changes to the documentation
- [ ] I have added tests that prove my feature, policy, or fix is effective and works
- [ ] New and existing tests pass locally with my changes
- [ ] Any dependent changes have been merged and published in downstream modules


Problem statement:
CKV_AWS_342 Ensure WAF rule has any actions should not consider a managed rule group
**Describe the issue**

CKV_AWS_342 currently will flag a WAFv2 WebACL that uses only managed rule groups. Managed rule groups have AWS-defined behavior regarding the actions that are taken (and some, like bot control, are not possible to express with the rule syntax), so you don't specify an action unless you want to override it, and the only override options are to `count` without blocking or to do nothing at all. This means it is not possible to actually satisfy this Checkov check while ensuring you are blocking traffic as intended.

This check should apply in situations where you're not specifying a managed rule group.

**Examples**

This currently fails but should pass:

```hcl
resource "aws_wafv2_web_acl" "this" {
  name          = var.name
  description   = "Managed by Terraform, do not edit in the console"
  scope         = "REGIONAL"
  token_domains = [var.dns.fqdn, aws_lb.this.dns_name]

  default_action {
    allow {}
  }

  rule {
    name     = "aws-managed-rules-common"
    priority = 1

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }
  }
}
```

**Version (please complete the following information):**

2.3.317

**Additional information:**

It may also be that managed rules themselves are usable in a `statement` and thus should also be ignored for the purposes of checking that rules have actions, but I'm not sure what that looks like.

Hints from issue discussion:

Commit message: managed rules have predefined actions

Patch to review:
diff --git a/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py b/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py
index ef68f2a133..8f34714604 100644
--- a/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py
+++ b/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py
@@ -15,7 +15,7 @@ def scan_resource_conf(self, conf):
         rules = None
         if conf.get("rule") and isinstance(conf["rule"], list):
             rules = conf["rule"]
-        # dont blame me i didn't name one rule and the other rules and the other activated_rule
+        # don't blame me I didn't name one rule and the other rules and the other activated_rule
         elif conf.get("rules") and isinstance(conf["rules"], list):
             rules = conf["rules"]
         elif conf.get("activated_rule") and isinstance(conf["activated_rule"], list):
@@ -23,9 +23,18 @@ def scan_resource_conf(self, conf):
 
         if isinstance(rules, list):
             for rule in rules:
+                passing = False
                 if "action" in rule and rule['action'] != [{}]:
-                    continue
+                    passing = True
                 if "override_action" in rule and rule['override_action'] != [{}]:
+                    passing = True
+
+                if rule.get('statement') and isinstance(rule['statement'], list):
+                    statements = rule['statement']
+                    for statement in statements:
+                        if statement.get('managed_rule_group_statement'):
+                            passing = True
+                if passing:
                     continue
                 return CheckResult.FAILED
             return CheckResult.PASSED
diff --git a/tests/terraform/checks/resource/aws/example_WAFRuleHasAnyActions/main.tf b/tests/terraform/checks/resource/aws/example_WAFRuleHasAnyActions/main.tf
index 272663932d..df4458fb01 100644
--- a/tests/terraform/checks/resource/aws/example_WAFRuleHasAnyActions/main.tf
+++ b/tests/terraform/checks/resource/aws/example_WAFRuleHasAnyActions/main.tf
@@ -1,3 +1,36 @@
+resource "aws_wafv2_web_acl" "pass_managed" {
+  name          = var.name
+  description   = "Managed by Terraform, do not edit in the console"
+  scope         = "REGIONAL"
+  token_domains = [var.dns.fqdn, aws_lb.this.dns_name]
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "aws-managed-rules-common"
+    priority = 1
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+  visibility_config {
+          cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+  }
+}
+
 resource "aws_wafregional_web_acl" "pass" {
   name        = "example"
   metric_name = "example"
diff --git a/tests/terraform/checks/resource/aws/test_WAFRuleHasAnyActions.py b/tests/terraform/checks/resource/aws/test_WAFRuleHasAnyActions.py
index 896cd89034..55b955750b 100644
--- a/tests/terraform/checks/resource/aws/test_WAFRuleHasAnyActions.py
+++ b/tests/terraform/checks/resource/aws/test_WAFRuleHasAnyActions.py
@@ -25,7 +25,8 @@ def test(self):
             'aws_wafregional_web_acl.pass3',
             'aws_wafv2_rule_group.pass',
             'aws_wafregional_rule_group.pass',
-            'aws_waf_rule_group.pass'
+            'aws_waf_rule_group.pass',
+            'aws_wafv2_web_acl.pass_managed'
         }
 
         failing_resources = {


Code review comments:
diff_hunk: @@ -1,3 +1,36 @@
+resource "aws_wafv2_web_acl" "pass_managed" {
+  name          = var.name
+  description   = "Managed by Terraform, do not edit in the console"
+  scope         = "REGIONAL"
+  token_domains = [var.dns.fqdn, aws_lb.this.dns_name]
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "aws-managed-rules-common"
+    priority = 1
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+  visibility_config {
+          cloudwatch_metrics_enabled = false
path: tests/terraform/checks/resource/aws/example_WAFRuleHasAnyActions/main.tf
text: @user1:
```suggestion
      cloudwatch_metrics_enabled = false
```