Repository: bridgecrewio/checkov

Issue:
Error: AttributeError: 'BicepElement' object has no attribute 'get'
**Describe the issue**
Checkov check for bicep templates crashes.
Same behaviour on Ubuntu and with latest Docker image.

**Examples**
main.bicep code example:
```
@description('get the PROJECT (vpp, drms, system etc) config parameters from json config file')
var JSONParametersProject = json(loadTextContent('./config/config_dev.json'))['${project}'] 

var project_name = JSONParametersProject.general.name
var tags_owner = JSONParametersProject.tags.Owner
var tags_costcenter = JSONParametersProject.tags.CostCenter
var subscription_id = JSONParametersProject.general.subscriptionID
// Module for Storage Account
module storageAcct 'modules/storage.bicep' = {
  name: '${project_name}-storageModule'
  scope: az.resourceGroup(resourceGroup.name)
  
  params: {
    storageLocation: location
    storageName: 'sthilo${project_name}${environment}01'
    tags: tags.outputs.Tags
    kind: JSONParametersStorage.kind
    sku: {
      name: JSONParametersStorage.sku.name
    }

    storage_account_properties: storage_account_properties
    
    blob_service_properties: blob_service_properties
  }
}
```

modules/storage.bicep:
```
targetScope = 'resourceGroup'

param storageLocation string
param storageName string
param tags object = {}

param kind string
param sku object
param storage_account_properties object

param blob_service_properties object

resource storageAcct 'Microsoft.Storage/storageAccounts@2022-05-01' = {
  name: storageName
  location: storageLocation
  sku: sku
  kind: kind
  properties: storage_account_properties
  tags: tags
}

resource symbolicname 'Microsoft.Storage/storageAccounts/blobServices@2022-05-01' = {
  name: 'default'
  parent: storageAcct
  properties: blob_service_properties
}

```
**Exception Trace**
```
2022-11-22 13:21:57,854 [MainThread  ] [DEBUG]  Leveraging the bundled IAM Definition.
2022-11-22 13:21:57,854 [MainThread  ] [DEBUG]  Leveraging the IAM definition at /home/aogorodnikov/.local/lib/python3.8/site-packages/policy_sentry/shared/data/iam-definition.json
2022-11-22 13:21:58,068 [MainThread  ] [DEBUG]  Adding the IntegrationFeatureRegistry <checkov.common.bridgecrew.integration_features.features.policy_metadata_integration.PolicyMetadataIntegration object at 0x7f0b51fa8f40> with order 0
2022-11-22 13:21:58,068 [MainThread  ] [DEBUG]  self.features after the sort:
2022-11-22 13:21:58,068 [MainThread  ] [DEBUG]  [<checkov.common.bridgecrew.integration_features.features.policy_metadata_integration.PolicyMetadataIntegration object at 0x7f0b51fa8f40>]
2022-11-22 13:21:58,068 [MainThread  ] [DEBUG]  Adding the IntegrationFeatureRegistry <checkov.common.bridgecrew.integration_features.features.suppressions_integration.SuppressionsIntegration object at 0x7f0b51fa8e50> with order 2
2022-11-22 13:21:58,068 [MainThread  ] [DEBUG]  self.features after the sort:
2022-11-22 13:21:58,068 [MainThread  ] [DEBUG]  [<checkov.common.bridgecrew.integration_features.features.policy_metadata_integration.PolicyMetadataIntegration object at 0x7f0b51fa8f40>, <checkov.common.bridgecrew.integration_features.features.suppressions_integration.SuppressionsIntegration object at 0x7f0b51fa8e50>]
2022-11-22 13:21:58,069 [MainThread  ] [DEBUG]  Adding the IntegrationFeatureRegistry <checkov.common.bridgecrew.integration_features.features.repo_config_integration.RepoConfigIntegration object at 0x7f0b4f8755b0> with order 0
2022-11-22 13:21:58,069 [MainThread  ] [DEBUG]  self.features after the sort:
2022-11-22 13:21:58,069 [MainThread  ] [DEBUG]  [<checkov.common.bridgecrew.integration_features.features.policy_metadata_integration.PolicyMetadataIntegration object at 0x7f0b51fa8f40>, <checkov.common.bridgecrew.integration_features.features.repo_config_integration.RepoConfigIntegration object at 0x7f0b4f8755b0>, <checkov.common.bridgecrew.integration_features.features.suppressions_integration.SuppressionsIntegration object at 0x7f0b51fa8e50>]
2022-11-22 13:21:58,070 [MainThread  ] [DEBUG]  Adding the IntegrationFeatureRegistry <checkov.common.bridgecrew.integration_features.features.fixes_integration.FixesIntegration object at 0x7f0b4f8759a0> with order 10
2022-11-22 13:21:58,070 [MainThread  ] [DEBUG]  self.features after the sort:
2022-11-22 13:21:58,070 [MainThread  ] [DEBUG]  [<checkov.common.bridgecrew.integration_features.features.policy_metadata_integration.PolicyMetadataIntegration object at 0x7f0b51fa8f40>, <checkov.common.bridgecrew.integration_features.features.repo_config_integration.RepoConfigIntegration object at 0x7f0b4f8755b0>, <checkov.common.bridgecrew.integration_features.features.suppressions_integration.SuppressionsIntegration object at 0x7f0b51fa8e50>, <checkov.common.bridgecrew.integration_features.features.fixes_integration.FixesIntegration object at 0x7f0b4f8759a0>]
2022-11-22 13:21:58,071 [MainThread  ] [DEBUG]  Adding the IntegrationFeatureRegistry <checkov.common.bridgecrew.integration_features.features.custom_policies_integration.CustomPoliciesIntegration object at 0x7f0b4f875be0> with order 1
2022-11-22 13:21:58,071 [MainThread  ] [DEBUG]  self.features after the sort:
2022-11-22 13:21:58,071 [MainThread  ] [DEBUG]  [<checkov.common.bridgecrew.integration_features.features.policy_metadata_integration.PolicyMetadataIntegration object at 0x7f0b51fa8f40>, <checkov.common.bridgecrew.integration_features.features.repo_config_integration.RepoConfigIntegration object at 0x7f0b4f8755b0>, <checkov.common.bridgecrew.integration_features.features.custom_policies_integration.CustomPoliciesIntegration object at 0x7f0b4f875be0>, <checkov.common.bridgecrew.integration_features.features.suppressions_integration.SuppressionsIntegration object at 0x7f0b51fa8e50>, <checkov.common.bridgecrew.integration_features.features.fixes_integration.FixesIntegration object at 0x7f0b4f8759a0>]
2022-11-22 13:21:58,081 [MainThread  ] [DEBUG]  Loading external checks from /home/aogorodnikov/.local/lib/python3.8/site-packages/checkov/bicep/checks/graph_checks    
2022-11-22 13:21:58,170 [MainThread  ] [DEBUG]  Popen(['git', 'version'], cwd=/mnt/c/Users/AlexanderOgorodnikov/work/repo/IT.BaseAzureInfra/infra/bicep, universal_newlines=False, shell=None, istream=None)
2022-11-22 13:21:58,174 [MainThread  ] [DEBUG]  Popen(['git', 'version'], cwd=/mnt/c/Users/AlexanderOgorodnikov/work/repo/IT.BaseAzureInfra/infra/bicep, universal_newlines=False, shell=None, istream=None)
2022-11-22 13:21:58,309 [MainThread  ] [DEBUG]  No API key present; setting include_all_checkov_policies to True
2022-11-22 13:21:58,309 [MainThread  ] [DEBUG]  Run metadata: {
  "checkov_version": "2.2.83",
  "python_executable": "/usr/bin/python3",
  "python_version": "3.8.10 (default, Nov 26 2021, 20:14:08) \n[GCC 9.3.0]",
  "checkov_executable": "/home/user/.local/bin/checkov",
  "args": [
    "Command Line Args:   -d . --framework bicep",
    "Defaults:",
    "  --branch:          master",
    "  --download-external-modules:False",
    "  --external-modules-download-path:.external_modules",
    "  --evaluate-variables:True",
    "  --secrets-scan-file-type:[]",
    "  --block-list-secret-scan:[]",
    "  --summary-position:top",
    ""
  ]
}
2022-11-22 13:21:58,309 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): bicep
2022-11-22 13:21:58,309 [MainThread  ] [DEBUG]  bicep_runner declares no system dependency checks required.
2022-11-22 13:21:58,309 [MainThread  ] [DEBUG]  No API key found. Scanning locally only.
2022-11-22 13:21:58,492 [MainThread  ] [DEBUG]  Got checkov mappings and guidelines from Bridgecrew platform
2022-11-22 13:21:58,492 [MainThread  ] [DEBUG]  Loading external checks from /home/aogorodnikov/.local/lib/python3.8/site-packages/checkov/terraform/checks/graph_checks
2022-11-22 13:21:58,493 [MainThread  ] [DEBUG]  Searching through ['__pycache__', 'azure', 'aws', 'gcp'] and ['__init__.py']
2022-11-22 13:21:58,493 [MainThread  ] [DEBUG]  Searching through [] and ['__init__.cpython-38.pyc']
2022-11-22 13:21:58,493 [MainThread  ] [DEBUG]  Searching through [] and ['AzureMSSQLServerHasSecurityAlertPolicy.yaml', 'DataExplorerEncryptionUsesCustomKey.yaml', 'MSQLenablesCustomerManagedKey.yaml', 'VAconfiguredToSendReports.yaml', 'PGSQLenablesCustomerManagedKey.yaml', 'AzureNetworkInterfacePublicIPAddressId.yaml', 'AzureStorageAccountsUseCustomerManagedKeyForEncryption.yaml', 'VAconfiguredToSendReportsToAdmins.yaml', 'CognitiveServicesCustomerManagedKey.yaml', 'StorageCriticalDataEncryptedCMK.yaml', 'VAsetPeriodicScansOnSQL.yaml', 'AccessToPostgreSQLFromAzureServicesIsDisabled.yaml', 'SQLServerAuditingEnabled.yaml', 'AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs.yaml', 'VMHasBackUpMachine.yaml', 'SQLServerAuditingRetention90Days.yaml', 'ApplicationGatewayEnablesWAF.yaml', 'VirtualMachinesUtilizingManagedDisks.yaml', 'StorageContainerActivityLogsNotPublic.yaml', 'AzureUnattachedDisksAreEncrypted.yaml', 'AzureDataFactoriesEncryptedWithCustomerManagedKey.yaml', 'StorageLoggingIsEnabledForTableService.yaml', 'StorageLoggingIsEnabledForBlobService.yaml', 'VAisEnabledInStorageAccount.yaml', 'AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.yaml', 'AzureActiveDirectoryAdminIsConfigured.yaml']
2022-11-22 13:21:58,560 [MainThread  ] [DEBUG]  Searching through [] and ['VPCHasFlowLog.yaml', 'IAMUsersAreMembersAtLeastOneGroup.yaml', 'Route53ZoneEnableDNSSECSigning.yaml', 'CloudtrailHasCloudwatch.yaml', 'S3BucketReplicationConfiguration.yaml', 'Route53ZoneHasMatchingQueryLog.yaml', 'S3BucketVersioning.yaml', 'S3PublicACLWrite.yaml', 'S3KMSEncryptedByDefault.yaml', 'EncryptedEBSVolumeOnlyConnectedToEC2s.yaml', 'PostgresRDSHasQueryLoggingEnabled.yaml', 'EBSAddedBackup.yaml', 'WAF2HasLogs.yaml', 'S3BucketEncryption.yaml', 'SGAttachedToResource.yaml', 'IAMGroupHasAtLeastOneUser.yaml', 'IAMPolicyNotAllowFullIAMAccess.yaml', 'IAMUserHasNoConsoleAccess.yaml', 'AWSNATGatewaysshouldbeutilized.yaml', 'AWSSSMParameterShouldBeEncrypted.yaml', 'AutoScallingEnabledELB.yaml', 'CodecommitApprovalRulesAttached.yaml', 'S3PublicACLRead.yaml', 'EC2InstanceHasIAMRoleAttached.yaml', 'APIGWLoggingLevelsDefinedProperly.yaml', 'EIPAllocatedToVPCAttachedEC2.yaml', 'GuardDutyIsEnabled.yaml', 'Route53ARecordAttachedResource.yaml', 'AMRClustersNotOpenToInternet.yaml', 'HTTPNotSendingPasswords.yaml', 'AppSyncProtectedByWAF.yaml', 'ALBRedirectsHTTPToHTTPS.yaml', 'ALBProtectedByWAF.yaml', 'AppLoadBalancerTLS12.yaml', 'AutoScalingEnableOnDynamoDBTables.yaml', 'PostgresDBHasQueryLoggingEnabled.yaml', 'VPCHasRestrictedSG.yaml', 'S3BucketHasPublicAccessBlock.yaml', 'APIProtectedByWAF.yaml', 'S3BucketLogging.yaml', 'RDSClusterHasBackupPlan.yaml', 'SubnetHasACL.yaml', 'EFSAddedBackup.yaml', 'CloudFrontHasResponseHeadersPolicy.yaml']
2022-11-22 13:21:58,657 [MainThread  ] [DEBUG]  Searching through [] and ['GCPLogBucketsConfiguredUsingLock.yaml', 'GCPContainerRegistryReposAreNotPubliclyAccessible.yaml', 'GCPKMSCryptoKeysAreNotPubliclyAccessible.yaml', 'GCPAuditLogsConfiguredForAllServicesAndUsers.yaml', 'GCPComputeFirewallOverlyPermissiveToAllTraffic.yaml', 'GCPKMSKeyRingsAreNotPubliclyAccessible.yaml', 'ServiceAccountHasGCPmanagedKey.yaml', 'GCRContainerVulnerabilityScanningEnabled.yaml', 'CloudFunctionSecureHTTPTrigger.yaml', 'GKEClustersAreNotUsingDefaultServiceAccount.yaml', 'GCPProjectHasNoLegacyNetworks.yaml', 'DisableAccessToSqlDBInstanceForRootUsersWithoutPassword.yaml']
2022-11-22 13:21:58,682 [MainThread  ] [DEBUG]  Loading external checks from /home/aogorodnikov/.local/lib/python3.8/site-packages/checkov/cloudformation/checks/graph_checks
2022-11-22 13:21:58,683 [MainThread  ] [DEBUG]  Searching through ['__pycache__'] and ['__init__.py']
2022-11-22 13:21:58,683 [MainThread  ] [DEBUG]  Searching through [] and ['__init__.cpython-38.pyc']
2022-11-22 13:21:58,683 [MainThread  ] [DEBUG]  Loading external checks from /home/aogorodnikov/.local/lib/python3.8/site-packages/checkov/kubernetes/checks/graph_checks
2022-11-22 13:21:58,683 [MainThread  ] [DEBUG]  Searching through ['__pycache__'] and ['__init__.py']
2022-11-22 13:21:58,683 [MainThread  ] [DEBUG]  Searching through [] and ['__init__.cpython-38.pyc']
2022-11-22 13:21:58,684 [MainThread  ] [DEBUG]  Loading external checks from /home/aogorodnikov/.local/lib/python3.8/site-packages/checkov/bicep/checks/graph_checks    
2022-11-22 13:21:58,684 [MainThread  ] [DEBUG]  Loading external checks from /home/aogorodnikov/.local/lib/python3.8/site-packages/checkov/terraform_plan/checks/graph_checks
2022-11-22 13:21:58,688 [MainThread  ] [DEBUG]  Filtered list of policies: []
2022-11-22 13:21:59,268 [MainThread  ] [INFO ]  [bicep] start to parse 13 files
2022-11-22 13:21:59,528 [MainThread  ] [DEBUG]  [bicep] Couldn't parse main.bicep
Traceback (most recent call last):
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/lark/lexer.py", line 528, in lex
    yield lexer.next_token(lexer_state, parser_state)
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/lark/lexer.py", line 466, in next_token
    raise UnexpectedCharacters(lex_state.text, line_ctr.char_pos, line_ctr.line, line_ctr.column,
lark.exceptions.UnexpectedCharacters: No terminal matches ''' in the current parser context, at line 22 col 102

extContent('./config/config_dev.json'))['${project}'] : environment == 'qa' ? js
                                        ^
Expected one of:
        * STRING

Previous tokens: Token('LSQB', '[')


During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/checkov/bicep/parser.py", line 23, in parse
    template = self.bicep_parser.parse(text=content)
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/pycep/main.py", line 29, in parse
    tree = self._create_tree(text=text, file_path=file_path)
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/pycep/main.py", line 53, in _create_tree
    return self.lark_parser.parse(bicep_text)
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/lark/lark.py", line 625, in parse
    return self.parser.parse(text, start=start, on_error=on_error)
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/lark/parser_frontends.py", line 96, in parse
    return self.parser.parse(stream, chosen_start, **kw)
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/lark/parsers/lalr_parser.py", line 41, in parse
    return self.parser.parse(lexer, start)
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/lark/parsers/lalr_parser.py", line 171, in parse
    return self.parse_from_state(parser_state)
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/lark/parsers/lalr_parser.py", line 188, in parse_from_state
    raise e
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/lark/parsers/lalr_parser.py", line 178, in parse_from_state
    for token in state.lexer.lex(state):
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/lark/lexer.py", line 537, in lex
    raise UnexpectedToken(token, e.allowed, state=parser_state, token_history=[last_token], terminals_by_name=self.root_lexer.terminals_by_name)
lark.exceptions.UnexpectedToken: Unexpected token Token('QUOTED_INTERPOLATION', "'${project}'") at line 22, column 102.
Expected one of:
        * STRING
Previous tokens: [Token('LSQB', '[')]

2022-11-22 13:21:59,562 [MainThread  ] [INFO ]  [bicep] successfully parsed 12 files
2022-11-22 13:21:59,570 [MainThread  ] [INFO ]  Creating Bicep graph
2022-11-22 13:21:59,574 [MainThread  ] [INFO ]  [BicepLocalGraph] created 84 vertices
2022-11-22 13:21:59,575 [MainThread  ] [INFO ]  [BicepLocalGraph] created 50 edges
2022-11-22 13:21:59,575 [MainThread  ] [INFO ]  evaluating 36 edges
2022-11-22 13:21:59,576 [MainThread  ] [INFO ]  evaluating 6 edges
2022-11-22 13:21:59,576 [MainThread  ] [INFO ]  evaluating 2 edges
2022-11-22 13:21:59,577 [MainThread  ] [INFO ]  evaluating 6 edges
2022-11-22 13:21:59,577 [MainThread  ] [INFO ]  evaluating 2 edges
2022-11-22 13:21:59,577 [MainThread  ] [INFO ]  evaluating 6 edges
2022-11-22 13:21:59,577 [MainThread  ] [INFO ]  evaluating 2 edges
2022-11-22 13:21:59,578 [MainThread  ] [INFO ]  Reached too many edge duplications of 90% for 4 iterations. breaking.
2022-11-22 13:21:59,578 [MainThread  ] [INFO ]  done evaluating edges
2022-11-22 13:21:59,578 [MainThread  ] [INFO ]  done evaluate_non_rendered_values
2022-11-22 13:21:59,578 [MainThread  ] [INFO ]  Successfully created Bicep graph
2022-11-22 13:21:59,582 [MainThread  ] [DEBUG]  Should run check CKV_AZURE_131: True
2022-11-22 13:21:59,582 [MainThread  ] [DEBUG]  Running check: SecureString parameter should not have hardcoded default values on file modules/nsg.bicep
2022-11-22 13:21:59,582 [MainThread  ] [DEBUG]  File modules/nsg.bicep, param  "string.nsgName" check "SecureString parameter should not have hardcoded default values" Result: {'result': <CheckResult.UNKNOWN: 'UNKNOWN'>, 'evaluated_keys': []}
2022-11-22 13:21:59,582 [MainThread  ] [DEBUG]  Secret was not saved in CKV_AZURE_131, can't omit
2022-11-22 13:21:59,583 [MainThread  ] [DEBUG]  Should run check CKV_AZURE_131: True
2022-11-22 13:21:59,583 [MainThread  ] [DEBUG]  Running check: SecureString parameter should not have hardcoded default values on file modules/nsg.bicep
2022-11-22 13:21:59,583 [MainThread  ] [DEBUG]  File modules/nsg.bicep, param  "string.nsgLocation" check "SecureString parameter should not have hardcoded default values" Result: {'result': <CheckResult.UNKNOWN: 'UNKNOWN'>, 'evaluated_keys': []}
2022-11-22 13:21:59,583 [MainThread  ] [DEBUG]  Secret was not saved in CKV_AZURE_131, can't omit
2022-11-22 13:21:59,583 [MainThread  ] [DEBUG]  Should run check CKV_AZURE_9: True
2022-11-22 13:21:59,584 [MainThread  ] [DEBUG]  Running check: Ensure that RDP access is restricted from the internet on file modules/nsg.bicep
2022-11-22 13:21:59,584 [MainThread  ] [DEBUG]  File modules/nsg.bicep, resource  "Microsoft.Network/networkSecurityGroups.networkSecurityGroup" check "Ensure that RDP access is restricted from the internet" Result: {'result': <CheckResult.PASSED: 'PASSED'>, 'evaluated_keys': []}
2022-11-22 13:21:59,584 [MainThread  ] [DEBUG]  Should run check CKV_AZURE_10: True
2022-11-22 13:21:59,584 [MainThread  ] [DEBUG]  Running check: Ensure that SSH access is restricted from the internet on file modules/nsg.bicep
2022-11-22 13:21:59,584 [MainThread  ] [DEBUG]  File modules/nsg.bicep, resource  "Microsoft.Network/networkSecurityGroups.networkSecurityGroup" check "Ensure that SSH access is restricted from the internet" Result: {'result': <CheckResult.PASSED: 'PASSED'>, 'evaluated_keys': []}
2022-11-22 13:21:59,584 [MainThread  ] [DEBUG]  Secret was not saved in CKV_AZURE_9, can't omit
2022-11-22 13:21:59,584 [MainThread  ] [DEBUG]  Secret was not saved in CKV_AZURE_10, can't omit
2022-11-22 13:21:59,585 [MainThread  ] [DEBUG]  Should run check CKV_AZURE_131: True
2022-11-22 13:21:59,587 [MainThread  ] [DEBUG]  Running check: SecureString parameter should not have hardcoded default values on file modules/storage.bicep
2022-11-22 13:21:59,587 [MainThread  ] [DEBUG]  File modules/storage.bicep, param  "string.kind" check "SecureString parameter should not have hardcoded default values" Result: {'result': <CheckResult.UNKNOWN: 'UNKNOWN'>, 'evaluated_keys': []}
2022-11-22 13:21:59,587 [MainThread  ] [DEBUG]  Secret was not saved in CKV_AZURE_131, can't omit
2022-11-22 13:21:59,587 [MainThread  ] [DEBUG]  Should run check CKV_AZURE_35: True
2022-11-22 13:21:59,587 [MainThread  ] [DEBUG]  Running check: Ensure default network access rule for Storage Accounts is set to deny on file modules/storage.bicep     
2022-11-22 13:21:59,588 [MainThread  ] [DEBUG]  Could not find properties/networkAcls/defaultAction in dict2022-11-22 13:21:59,588 [MainThread  ] [DEBUG]  File modules/storage.bicep, resource  "Microsoft.Storage/storageAccounts.storageAcct" check "Ensure default network access rule for Storage Accounts is set to deny" Result: {'result': <CheckResult.FAILED: 'FAILED'>, 'evaluated_keys': ['properties/networkAcls/defaultAction']}
2022-11-22 13:21:59,588 [MainThread  ] [DEBUG]  Should run check CKV_AZURE_36: True
2022-11-22 13:21:59,588 [MainThread  ] [DEBUG]  Running check: Ensure 'Trusted Microsoft Services' is enabled for Storage Account access on file modules/storage.bicep  
2022-11-22 13:21:59,588 [MainThread  ] [ERROR]  Failed to run check: Ensure 'Trusted Microsoft Services' is enabled for Storage Account access for configuration: {'decorators': [], 'type': 'Microsoft.Storage/storageAccounts', 'api_version': '2022-05-01', 'existing': False, 'config': {'name': 'storageName', 'location': 'storageLocation', 'sku': 'sku', 'kind': 'kind', 'properties': 'storage_account_properties', 'tags': 'tags'}, '__start_line__': 13, '__end_line__': 20} at file: modules/storage.bicep  
Traceback (most recent call last):
  File "/home/aogorodnikov/.local/bin/checkov", line 9, in <module>
    sys.exit(run())
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/checkov/main.py", line 340, in run    scan_reports = runner_registry.run(root_folder=root_folder, external_checks_dir=external_checks_dir,
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/checkov/common/runners/runner_registry.py", line 80, in run
    self.runners[0].run(root_folder, external_checks_dir=external_checks_dir, files=files,
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/checkov/bicep/runner.py", line 121, in run    self.add_python_check_results(report=report, runner_filter=runner_filter, root_folder=root_folder)  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/checkov/bicep/runner.py", line 158, in add_python_check_results
    results = registry.scan(
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/checkov/common/checks/base_check_registry.py", line 127, in scan
    result = self.run_check(check, entity_configuration, entity_name, entity_type, scanned_file, skip_info)
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/checkov/common/checks/base_check_registry.py", line 141, in run_check
    result = check.run(
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/checkov/common/checks/base_check.py", line 71, in run
    check_result["result"] = self.scan_entity_conf(entity_configuration, entity_type)
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/checkov/bicep/checks/resource/base_resource_check.py", line 43, in scan_entity_conf
    return self.scan_resource_conf(conf["config"])
  File "/home/aogorodnikov/.local/lib/python3.8/site-packages/checkov/bicep/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py", line 21, in scan_resource_conf
    nacls = properties.get("networkAcls")
AttributeError: 'BicepElement' object has no attribute 'get'
```

**Desktop (please complete the following information):**
 - OS: Ubuntu 20.04.3 LTS/ Latest Checkov docker image
 - Checkov Version 2.2.83

**Additional context**
Add any other context about the problem here (e.g. code snippets).



Discussion:
hey @alexanderogorodnikov thanks for reaching out. The check expects actual values for `properties:` and not a reference to a parameter or something similar. I will add a fix to ignore such cases.

Resolving patch:
diff --git a/checkov/bicep/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py b/checkov/bicep/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py
--- a/checkov/bicep/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py
+++ b/checkov/bicep/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py
@@ -18,6 +18,9 @@ def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
         self.evaluated_keys = ["properties/networkAcls/defaultAction"]
         properties = conf.get("properties")
         if properties:
+            if not isinstance(properties, dict):
+                return CheckResult.UNKNOWN
+
             nacls = properties.get("networkAcls")
             if nacls:
                 default_action = nacls.get("defaultAction")
diff --git a/checkov/bicep/checks/resource/azure/StorageAccountsTransportEncryption.py b/checkov/bicep/checks/resource/azure/StorageAccountsTransportEncryption.py
--- a/checkov/bicep/checks/resource/azure/StorageAccountsTransportEncryption.py
+++ b/checkov/bicep/checks/resource/azure/StorageAccountsTransportEncryption.py
@@ -19,6 +19,9 @@ def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
         self.evaluated_keys = ["properties/supportsHttpsTrafficOnly"]
         properties = conf.get("properties")
         if properties:
+            if not isinstance(properties, dict):
+                return CheckResult.UNKNOWN
+
             https_only = properties.get("supportsHttpsTrafficOnly")
             if https_only is True:
                 return CheckResult.PASSED


Test patch:
diff --git a/tests/bicep/checks/resource/azure/example_StorageAccountAzureServicesAccessEnabled/main.bicep b/tests/bicep/checks/resource/azure/example_StorageAccountAzureServicesAccessEnabled/main.bicep
--- a/tests/bicep/checks/resource/azure/example_StorageAccountAzureServicesAccessEnabled/main.bicep
+++ b/tests/bicep/checks/resource/azure/example_StorageAccountAzureServicesAccessEnabled/main.bicep
@@ -72,3 +72,16 @@ resource denyAndBypassNone 'Microsoft.Storage/storageAccounts@2019-06-01' = {
     }
   }
 }
+
+// unknown
+
+resource unknown 'Microsoft.Storage/storageAccounts@2019-06-01' = {
+  name: diagStorageAccountName
+  location: location
+  sku: {
+    name: storageAccountType
+  }
+  kind: 'StorageV2'
+
+  properties: storageAccountProperties
+}
diff --git a/tests/bicep/checks/resource/azure/example_StorageAccountsTransportEncryption/main.bicep b/tests/bicep/checks/resource/azure/example_StorageAccountsTransportEncryption/main.bicep
--- a/tests/bicep/checks/resource/azure/example_StorageAccountsTransportEncryption/main.bicep
+++ b/tests/bicep/checks/resource/azure/example_StorageAccountsTransportEncryption/main.bicep
@@ -45,3 +45,17 @@ resource disabled 'Microsoft.Storage/storageAccounts@2019-06-01' = {
     supportsHttpsTrafficOnly: false
   }
 }
+
+// unknown
+
+resource unknown 'Microsoft.Storage/storageAccounts@2019-06-01' = {
+  name: diagStorageAccountName
+  location: location
+  sku: {
+    name: storageAccountType
+  }
+  kind: 'StorageV2'
+
+  properties: storageAccountProperties
+}
+
diff --git a/tests/bicep/checks/resource/azure/test_StorageAccountAzureServicesAccessEnabled.py b/tests/bicep/checks/resource/azure/test_StorageAccountAzureServicesAccessEnabled.py
--- a/tests/bicep/checks/resource/azure/test_StorageAccountAzureServicesAccessEnabled.py
+++ b/tests/bicep/checks/resource/azure/test_StorageAccountAzureServicesAccessEnabled.py
@@ -29,10 +29,11 @@ def test_examples():
     passed_check_resources = {c.resource for c in report.passed_checks}
     failed_check_resources = {c.resource for c in report.failed_checks}
 
-    assert summary["passed"] == 3
-    assert summary["failed"] == 2
+    assert summary["passed"] == len(passing_resources)
+    assert summary["failed"] == len(failing_resources)
     assert summary["skipped"] == 0
     assert summary["parsing_errors"] == 0
+    assert summary["resource_count"] == len(passing_resources) + len(failing_resources) + 1  # unknown
 
     assert passed_check_resources == passing_resources
     assert failed_check_resources == failing_resources
diff --git a/tests/bicep/checks/resource/azure/test_StorageAccountsTransportEncryption.py b/tests/bicep/checks/resource/azure/test_StorageAccountsTransportEncryption.py
--- a/tests/bicep/checks/resource/azure/test_StorageAccountsTransportEncryption.py
+++ b/tests/bicep/checks/resource/azure/test_StorageAccountsTransportEncryption.py
@@ -28,10 +28,11 @@ def test_examples():
     passed_check_resources = {c.resource for c in report.passed_checks}
     failed_check_resources = {c.resource for c in report.failed_checks}
 
-    assert summary["passed"] == 2
-    assert summary["failed"] == 2
+    assert summary["passed"] == len(passing_resources)
+    assert summary["failed"] == len(failing_resources)
     assert summary["skipped"] == 0
     assert summary["parsing_errors"] == 0
+    assert summary["resource_count"] == len(passing_resources) + len(failing_resources) + 1  # unknown
 
     assert passed_check_resources == passing_resources
     assert failed_check_resources == failing_resources