Repository: bridgecrewio/checkov

Issue:
CKV_AWS_300 S3 MPU lifecycle alert
**Issue**
Alert ID - CKV_AWS_300 
Checkov sends false alert for MPU "aws_s3_bucket_lifecycle_configuration" despite having the correct rule configuration. In my scenario I'm having an empty filter in my terraform code. But as per logic in checkov code base, (checkov/checkov/terraform/checks/resource/aws/S3AbortIncompleteUploads.py) under scan_resource_conf method, the 'if' condition doesn't take the 'filter' condition into account. This in-turn throws a false alert.

**Examples**
```hcl
resource "aws_s3_bucket_lifecycle_configuration" "lifecycle_rule" {
  bucket = aws_s3_bucket.s3.id
  rule {
    abort_incomplete_multipart_upload {
      days_after_initiation = 3
    }
    id = "MPU 3days"
    filter {
    }
    status = "Enabled"
  }
}
```

**Version (please complete the following information):**
 - Checkov 2.3.155 (Latest)




Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/S3AbortIncompleteUploads.py b/checkov/terraform/checks/resource/aws/S3AbortIncompleteUploads.py
--- a/checkov/terraform/checks/resource/aws/S3AbortIncompleteUploads.py
+++ b/checkov/terraform/checks/resource/aws/S3AbortIncompleteUploads.py
@@ -23,12 +23,13 @@ def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:
         rules = conf.get("rule")
         if rules and isinstance(rules, list):
             for idx_rule, rule in enumerate(rules):
-                if (
-                    rule.get("abort_incomplete_multipart_upload")
-                    and rule.get("status") == ["Enabled"]
-                    and not rule.get("filter")
-                ):
+                if rule.get("abort_incomplete_multipart_upload") and rule.get("status") == ["Enabled"]:
                     self.evaluated_keys = [f"rule/[{idx_rule}]/abort_incomplete_multipart_upload"]
+                    filter = rule.get("filter")
+                    if filter and isinstance(filter, list) and filter[0]:
+                        # it is possible to set an empty filter, which applies then to all objects
+                        continue
+
                     return CheckResult.PASSED
 
         return CheckResult.FAILED


Test patch:
diff --git a/tests/terraform/checks/resource/aws/example_S3AbortIncompleteUploads/main.tf b/tests/terraform/checks/resource/aws/example_S3AbortIncompleteUploads/main.tf
--- a/tests/terraform/checks/resource/aws/example_S3AbortIncompleteUploads/main.tf
+++ b/tests/terraform/checks/resource/aws/example_S3AbortIncompleteUploads/main.tf
@@ -183,4 +183,17 @@ resource "aws_s3_bucket_lifecycle_configuration" "pass" {
 
     status = "Enabled"
   }
-}
\ No newline at end of file
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "pass3" {
+  bucket = aws_s3_bucket.bucket.id
+
+  rule {
+    abort_incomplete_multipart_upload {
+      days_after_initiation = 7
+    }
+    filter {}
+    id = "log"
+    status = "Enabled"
+  }
+}
diff --git a/tests/terraform/checks/resource/aws/test_S3AbortIncompleteUploads.py b/tests/terraform/checks/resource/aws/test_S3AbortIncompleteUploads.py
--- a/tests/terraform/checks/resource/aws/test_S3AbortIncompleteUploads.py
+++ b/tests/terraform/checks/resource/aws/test_S3AbortIncompleteUploads.py
@@ -21,6 +21,7 @@ def test(self):
         passing_resources = {
             "aws_s3_bucket_lifecycle_configuration.pass",
             "aws_s3_bucket_lifecycle_configuration.pass2",
+            "aws_s3_bucket_lifecycle_configuration.pass3",
         }
         failing_resources = {
             "aws_s3_bucket_lifecycle_configuration.fail",