Repository: bridgecrewio/checkov

Issue:
Check Azure Front Door WAF enabled fails even when a WAF is correctly assigned
**Describe the issue**
[`CKV_AZURE_121`](https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/azure/AzureFrontDoorEnablesWAF.py) fails despite a Web Application Firewall policy being correctly applied. 

WAF policies are applied by specifying a value for `web_application_firewall_policy_link_id` inside a `frontend_endpoint` block within the `azurerm_frontdoor` resource itself.

The [documentation](https://docs.bridgecrew.io/docs/ensure-that-azure-front-door-enables-waf) seems to expect that the `web_application_firewall_policy_link_id` attribute is defined in the resource block itself, rather than in a sub-block (`frontend_endpoint`).

- [`azurerm_frontdoor` resource documentation reference](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/frontdoor#web_application_firewall_policy_link_id)

**Examples**
```terraform
resource "azurerm_frontdoor" "test" {
  name                                         = "test-front-door"
  resource_group_name                          = var.resource_group_name
  enforce_backend_pools_certificate_name_check = false
  tags                                         = var.tags

  frontend_endpoint {
    name                                    = "DefaultFrontend"
    host_name                               = "test-front-door.azurefd.net"
    web_application_firewall_policy_link_id = azurerm_frontdoor_firewall_policy.test.id
  }

  # ... 
```

**Version (please complete the following information):**
 - Checkov Version: 2.0.930

**Additional context**



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/azure/AzureFrontDoorEnablesWAF.py b/checkov/terraform/checks/resource/azure/AzureFrontDoorEnablesWAF.py
--- a/checkov/terraform/checks/resource/azure/AzureFrontDoorEnablesWAF.py
+++ b/checkov/terraform/checks/resource/azure/AzureFrontDoorEnablesWAF.py
@@ -12,7 +12,7 @@ def __init__(self):
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
     def get_inspected_key(self):
-        return "web_application_firewall_policy_link_id"
+        return "frontend_endpoint/[0]/web_application_firewall_policy_link_id"
 
     def get_expected_value(self):
         return ANY_VALUE


Test patch:
diff --git a/tests/terraform/checks/resource/azure/example_AzureFrontDoorEnablesWAF/main.tf b/tests/terraform/checks/resource/azure/example_AzureFrontDoorEnablesWAF/main.tf
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/azure/example_AzureFrontDoorEnablesWAF/main.tf
@@ -0,0 +1,84 @@
+resource "azurerm_frontdoor" "pass" {
+  name                = "example-FrontDoor"
+  resource_group_name = azurerm_resource_group.example.name
+
+  routing_rule {
+    name               = "exampleRoutingRule1"
+    accepted_protocols = ["Http", "Https"]
+    patterns_to_match  = ["/*"]
+    frontend_endpoints = ["exampleFrontendEndpoint1"]
+    forwarding_configuration {
+      forwarding_protocol = "MatchRequest"
+      backend_pool_name   = "exampleBackendBing"
+    }
+  }
+
+  backend_pool_load_balancing {
+    name = "exampleLoadBalancingSettings1"
+  }
+
+  backend_pool_health_probe {
+    name = "exampleHealthProbeSetting1"
+  }
+
+  backend_pool {
+    name = "exampleBackendBing"
+    backend {
+      host_header = "www.bing.com"
+      address     = "www.bing.com"
+      http_port   = 80
+      https_port  = 443
+    }
+
+    load_balancing_name = "exampleLoadBalancingSettings1"
+    health_probe_name   = "exampleHealthProbeSetting1"
+  }
+
+  frontend_endpoint {
+    name      = "exampleFrontendEndpoint1"
+    host_name = "example-FrontDoor.azurefd.net"
+    web_application_firewall_policy_link_id = azurerm_frontdoor_firewall_policy.test.id
+  }
+}
+
+resource "azurerm_frontdoor" "fail" {
+  name                = "example-FrontDoor"
+  resource_group_name = azurerm_resource_group.example.name
+
+  routing_rule {
+    name               = "exampleRoutingRule1"
+    accepted_protocols = ["Http", "Https"]
+    patterns_to_match  = ["/*"]
+    frontend_endpoints = ["exampleFrontendEndpoint1"]
+    forwarding_configuration {
+      forwarding_protocol = "MatchRequest"
+      backend_pool_name   = "exampleBackendBing"
+    }
+  }
+
+  backend_pool_load_balancing {
+    name = "exampleLoadBalancingSettings1"
+  }
+
+  backend_pool_health_probe {
+    name = "exampleHealthProbeSetting1"
+  }
+
+  backend_pool {
+    name = "exampleBackendBing"
+    backend {
+      host_header = "www.bing.com"
+      address     = "www.bing.com"
+      http_port   = 80
+      https_port  = 443
+    }
+
+    load_balancing_name = "exampleLoadBalancingSettings1"
+    health_probe_name   = "exampleHealthProbeSetting1"
+  }
+
+  frontend_endpoint {
+    name      = "exampleFrontendEndpoint1"
+    host_name = "example-FrontDoor.azurefd.net"
+  }
+}
\ No newline at end of file
diff --git a/tests/terraform/checks/resource/azure/test_AzureFrontDoorEnablesWAF.py b/tests/terraform/checks/resource/azure/test_AzureFrontDoorEnablesWAF.py
--- a/tests/terraform/checks/resource/azure/test_AzureFrontDoorEnablesWAF.py
+++ b/tests/terraform/checks/resource/azure/test_AzureFrontDoorEnablesWAF.py
@@ -1,116 +1,42 @@
+import os
 import unittest
 
-import hcl2
-
+from checkov.runner_filter import RunnerFilter
+from checkov.terraform.runner import Runner
 from checkov.terraform.checks.resource.azure.AzureFrontDoorEnablesWAF import check
-from checkov.common.models.enums import CheckResult
 
 
 class TestAzureFrontDoorEnablesWAF(unittest.TestCase):
 
-    def test_failure(self):
-        hcl_res = hcl2.loads("""
-            resource "azurerm_frontdoor" "example" {
-              name                                         = "example-FrontDoor"
-              location                                     = "EastUS2"
-              resource_group_name                          = azurerm_resource_group.example.name
-              enforce_backend_pools_certificate_name_check = false
-            
-              routing_rule {
-                name               = "exampleRoutingRule1"
-                accepted_protocols = ["Http", "Https"]
-                patterns_to_match  = ["/*"]
-                frontend_endpoints = ["exampleFrontendEndpoint1"]
-                forwarding_configuration {
-                  forwarding_protocol = "MatchRequest"
-                  backend_pool_name   = "exampleBackendBing"
-                }
-              }
-            
-              backend_pool_load_balancing {
-                name = "exampleLoadBalancingSettings1"
-              }
-            
-              backend_pool_health_probe {
-                name = "exampleHealthProbeSetting1"
-              }
-            
-              backend_pool {
-                name = "exampleBackendBing"
-                backend {
-                  host_header = "www.bing.com"
-                  address     = "www.bing.com"
-                  http_port   = 80
-                  https_port  = 443
-                }
-            
-                load_balancing_name = "exampleLoadBalancingSettings1"
-                health_probe_name   = "exampleHealthProbeSetting1"
-              }
-            
-              frontend_endpoint {
-                name                              = "exampleFrontendEndpoint1"
-                host_name                         = "example-FrontDoor.azurefd.net"
-                custom_https_provisioning_enabled = false
-              }
-            }
-                """)
-        resource_conf = hcl_res['resource'][0]['azurerm_frontdoor']['example']
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.FAILED, scan_result)
+    def test(self):
+        runner = Runner()
+        current_dir = os.path.dirname(os.path.realpath(__file__))
+
+        test_files_dir = os.path.join(current_dir, "example_AzureFrontDoorEnablesWAF")
+        report = runner.run(root_folder=test_files_dir,
+                            runner_filter=RunnerFilter(checks=[check.id]))
+        summary = report.get_summary()
+
+        passing_resources = {
+            'azurerm_frontdoor.pass',
+        }
+
+        failing_resources = {
+            'azurerm_frontdoor.fail',
+        }
+        skipped_resources = {}
+
+        passed_check_resources = set([c.resource for c in report.passed_checks])
+        failed_check_resources = set([c.resource for c in report.failed_checks])
 
-    def test_success(self):
-        hcl_res = hcl2.loads("""
-            resource "azurerm_frontdoor" "example" {
-              name                                         = "example-FrontDoor"
-              location                                     = "EastUS2"
-              resource_group_name                          = azurerm_resource_group.example.name
-              enforce_backend_pools_certificate_name_check = false
-              web_application_firewall_policy_link_id = "this_is_id"
+        self.assertEqual(summary['passed'], len(passing_resources))
+        self.assertEqual(summary['failed'], len(failing_resources))
+        self.assertEqual(summary['skipped'], len(skipped_resources))
+        self.assertEqual(summary['parsing_errors'], 0)
 
-              routing_rule {
-                name               = "exampleRoutingRule1"
-                accepted_protocols = ["Http", "Https"]
-                patterns_to_match  = ["/*"]
-                frontend_endpoints = ["exampleFrontendEndpoint1"]
-                forwarding_configuration {
-                  forwarding_protocol = "MatchRequest"
-                  backend_pool_name   = "exampleBackendBing"
-                }
-              }
-            
-              backend_pool_load_balancing {
-                name = "exampleLoadBalancingSettings1"
-              }
-            
-              backend_pool_health_probe {
-                name = "exampleHealthProbeSetting1"
-              }
-            
-              backend_pool {
-                name = "exampleBackendBing"
-                backend {
-                  host_header = "www.bing.com"
-                  address     = "www.bing.com"
-                  http_port   = 80
-                  https_port  = 443
-                }
-            
-                load_balancing_name = "exampleLoadBalancingSettings1"
-                health_probe_name   = "exampleHealthProbeSetting1"
-              }
-            
-              frontend_endpoint {
-                name                              = "exampleFrontendEndpoint1"
-                host_name                         = "example-FrontDoor.azurefd.net"
-                custom_https_provisioning_enabled = false
-              }
-            }
-                """)
-        resource_conf = hcl_res['resource'][0]['azurerm_frontdoor']['example']
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.PASSED, scan_result)
+        self.assertEqual(passing_resources, passed_check_resources)
+        self.assertEqual(failing_resources, failed_check_resources)
 
 
 if __name__ == '__main__':
-    unittest.main()
+    unittest.main()
\ No newline at end of file