Repository: bridgecrewio/checkov

Issue:
Missing `protocol` key for `aws_lb_listener`
**Describe the bug**
protocol is not a valid key for `aws_lb_listener`

**To Reproduce**
snippet
```hcl
resource "aws_lb_listener" "http_redirector" {
  load_balancer_arn = aws_lb.redirector.arn
  port              = "80"
  protocol          = "HTTP" #tfsec:ignore:AWS004
  default_action {
    type = "redirect"
    redirect {
      host        = "example.com"
      status_code = "HTTP_302"
    }
  }
}
```
Traceback
```
Traceback (most recent call last):
  File "/home/user/.config/pyenv/versions/checkov/bin/checkov", line 5, in <module>
    run()
  File "/home/user/.config/pyenv/versions/3.7.9/envs/checkov/lib/python3.7/site-packages/checkov/main.py", line 65, in run
    files=file, guidelines=guidelines)
  File "/home/user/.config/pyenv/versions/3.7.9/envs/checkov/lib/python3.7/site-packages/checkov/common/runners/runner_registry.py", line 31, in run
    runner_filter=self.runner_filter, collect_skip_comments=collect_skip_comments)
  File "/home/user/.config/pyenv/versions/3.7.9/envs/checkov/lib/python3.7/site-packages/checkov/terraform/runner.py", line 61, in run
    self.check_tf_definition(report, root_folder, runner_filter, collect_skip_comments)
  File "/home/user/.config/pyenv/versions/3.7.9/envs/checkov/lib/python3.7/site-packages/checkov/terraform/runner.py", line 90, in check_tf_definition
    scanned_file, runner_filter)
  File "/home/user/.config/pyenv/versions/3.7.9/envs/checkov/lib/python3.7/site-packages/checkov/terraform/runner.py", line 98, in run_all_blocks
    scanned_file, block_type, runner_filter)
  File "/home/user/.config/pyenv/versions/3.7.9/envs/checkov/lib/python3.7/site-packages/checkov/terraform/runner.py", line 136, in run_block
    results = registry.scan(scanned_file, entity, skipped_checks, runner_filter)
  File "/home/user/.config/pyenv/versions/3.7.9/envs/checkov/lib/python3.7/site-packages/checkov/common/checks/base_check_registry.py", line 103, in scan
    result = self.run_check(check, entity_configuration, entity_name, entity_type, scanned_file, skip_info)
  File "/home/user/.config/pyenv/versions/3.7.9/envs/checkov/lib/python3.7/site-packages/checkov/common/checks/base_check_registry.py", line 110, in run_check
    entity_name=entity_name, entity_type=entity_type, skip_info=skip_info)
  File "/home/user/.config/pyenv/versions/3.7.9/envs/checkov/lib/python3.7/site-packages/checkov/common/checks/base_check.py", line 58, in run
    raise e
  File "/home/user/.config/pyenv/versions/3.7.9/envs/checkov/lib/python3.7/site-packages/checkov/common/checks/base_check.py", line 39, in run
    check_result['result'] = self.scan_entity_conf(entity_configuration, entity_type)
  File "/home/user/.config/pyenv/versions/3.7.9/envs/checkov/lib/python3.7/site-packages/checkov/terraform/checks/resource/base_resource_check.py", line 16, in scan_entity_conf
    return self.scan_resource_conf(conf, entity_type)
  File "/home/user/.config/pyenv/versions/3.7.9/envs/checkov/lib/python3.7/site-packages/checkov/terraform/checks/resource/base_resource_check.py", line 28, in wrapper
    return wrapped(self, conf)
  File "/home/user/.config/pyenv/versions/3.7.9/envs/checkov/lib/python3.7/site-packages/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py", line 29, in scan_resource_conf
    if default_action['redirect'][0]['protocol'] == ['HTTPS']:
KeyError: 'protocol'
```

**Expected behavior**
Test should pass

**Desktop (please complete the following information):**
 - Python: 3.7.9
 - Checkov Version 1.0.636


Discussion:

Resolving patch:
diff --git a/checkov/kubernetes/checks/Seccomp.py b/checkov/kubernetes/checks/Seccomp.py
--- a/checkov/kubernetes/checks/Seccomp.py
+++ b/checkov/kubernetes/checks/Seccomp.py
@@ -1,3 +1,4 @@
+import dpath
 
 from checkov.common.models.enums import CheckCategories, CheckResult
 from checkov.kubernetes.base_spec_check import BaseK8Check
@@ -12,6 +13,7 @@ def __init__(self):
         # Location: Pod.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod
         # Location: CronJob.spec.jobTemplate.spec.template.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod
         # Location: *.spec.template.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod
+        # Location: *.spec.securityContext.seccompProfile.type
         supported_kind = ['Pod', 'Deployment', 'DaemonSet', 'StatefulSet', 'ReplicaSet', 'ReplicationController', 'Job', 'CronJob']
         categories = [CheckCategories.KUBERNETES]
         super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind)
@@ -26,6 +28,10 @@ def scan_spec_conf(self, conf):
         metadata = {}
 
         if conf['kind'] == 'Pod':
+            security_profile = dpath.search(conf, 'spec/securityContext/seccompProfile/type')
+            if security_profile:
+                security_profile = dpath.get(conf, 'spec/securityContext/seccompProfile/type')
+                return CheckResult.PASSED if security_profile == 'RuntimeDefault' else CheckResult.FAILED
             if "metadata" in conf:
                 metadata = conf["metadata"]
         elif conf['kind'] == 'CronJob':
@@ -45,8 +51,9 @@ def scan_spec_conf(self, conf):
             if "annotations" in metadata and isinstance(metadata['annotations'], dict):
                 if "seccomp.security.alpha.kubernetes.io/pod" in metadata["annotations"]:
                     if ("docker/default" in metadata["annotations"]["seccomp.security.alpha.kubernetes.io/pod"] or
-                    "runtime/default" in metadata["annotations"]["seccomp.security.alpha.kubernetes.io/pod"]):
+                            "runtime/default" in metadata["annotations"]["seccomp.security.alpha.kubernetes.io/pod"]):
                         return CheckResult.PASSED
         return CheckResult.FAILED
 
+
 check = Seccomp()
diff --git a/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py b/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py
--- a/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py
+++ b/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py
@@ -1,6 +1,7 @@
 from checkov.common.models.enums import CheckResult, CheckCategories
 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
 
+
 class ALBListenerHTTPS(BaseResourceCheck):
 
     def __init__(self):
@@ -26,8 +27,12 @@ def scan_resource_conf(self, conf):
                     default_action = conf['default_action'][0]
                     action_type = default_action['type']
                     if action_type == ['redirect']:
-                        if default_action.get('redirect') and default_action['redirect'][0]['protocol'] == ['HTTPS']:
-                            return CheckResult.PASSED
+                        if default_action.get('redirect'):
+                            protocol = default_action['redirect'][0].get('protocol')
+                            if protocol == ['HTTPS']:
+                                return CheckResult.PASSED
+                            elif protocol is None:
+                                return CheckResult.UNKNOWN
         return CheckResult.FAILED
 
 


Test patch:
diff --git a/tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED3.yaml b/tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED3.yaml
new file mode 100644
--- /dev/null
+++ b/tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED3.yaml
@@ -0,0 +1,27 @@
+# Source: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+apiVersion: v1
+kind: Pod
+metadata:
+  name: seccomp-passed
+spec:
+  securityContext:
+    runAsUser: 1000
+    runAsGroup: 3000
+    fsGroup: 2000
+    seccompProfile:
+      type: RuntimeDefault
+  volumes:
+  - name: sec-ctx-vol
+    emptyDir: {}
+  containers:
+  - name: sec-ctx-demo
+    image: busybox
+    command: [ "sh", "-c", "sleep 1h" ]
+    volumeMounts:
+    - name: sec-ctx-vol
+      mountPath: /data/demo
+    securityContext:
+      allowPrivilegeEscalation: false
+
+# kubectl exec -it seccomp-failed -- grep Seccomp /proc/1/status
+### This will return 'Seccomp:	 0' indicating docker running with no Seccomp 
diff --git a/tests/kubernetes/checks/test_Seccomp.py b/tests/kubernetes/checks/test_Seccomp.py
--- a/tests/kubernetes/checks/test_Seccomp.py
+++ b/tests/kubernetes/checks/test_Seccomp.py
@@ -16,7 +16,7 @@ def test_summary(self):
         report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id]))
         summary = report.get_summary()
 
-        self.assertEqual(summary['passed'], 2)
+        self.assertEqual(summary['passed'], 3)
         self.assertEqual(summary['failed'], 1)
         self.assertEqual(summary['skipped'], 0)
         self.assertEqual(summary['parsing_errors'], 0)
diff --git a/tests/terraform/checks/resource/aws/test_ALBListenerHTTPS.py b/tests/terraform/checks/resource/aws/test_ALBListenerHTTPS.py
--- a/tests/terraform/checks/resource/aws/test_ALBListenerHTTPS.py
+++ b/tests/terraform/checks/resource/aws/test_ALBListenerHTTPS.py
@@ -1,5 +1,7 @@
 import unittest
 
+import hcl2
+
 from checkov.terraform.checks.resource.aws.ALBListenerHTTPS import check
 from checkov.common.models.enums import CheckResult
 
@@ -43,6 +45,25 @@ def test_failure(self):
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
+    def test_success_no_protocol(self):
+        hcl_res = hcl2.loads("""
+resource "aws_lb_listener" "http_redirector" {
+  load_balancer_arn = aws_lb.redirector.arn
+  port              = "80"
+  protocol          = "HTTP"
+  default_action {
+    type = "redirect"
+    redirect {
+      host        = "example.com"
+      status_code = "HTTP_302"
+    }
+  }
+}
+        """)
+        resource_conf = hcl_res['resource'][0]['aws_lb_listener']['http_redirector']
+        result = check.scan_resource_conf(resource_conf)
+        self.assertEqual(CheckResult.UNKNOWN, result)
+
 
 if __name__ == '__main__':
     unittest.main()