Repository: bridgecrewio/checkov

Issue:
CKV_AWS_192 raises an error when run it with terraform_plan framework flag
**Describe the bug**
When I run checkov with terraform_plan framework I receive this error:
```
Traceback (most recent call last):
  File "/usr/bin/checkov", line 9, in <module>
    sys.exit(run())
  File "/usr/lib/python3.9/site-packages/checkov/main.py", line 208, in run
    scan_reports = runner_registry.run(root_folder=root_folder, external_checks_dir=external_checks_dir,
  File "/usr/lib/python3.9/site-packages/checkov/common/runners/runner_registry.py", line 59, in run
    reports = [self.runners[0].run(root_folder, external_checks_dir=external_checks_dir, files=files,
  File "/usr/lib/python3.9/site-packages/checkov/terraform/plan_runner.py", line 67, in run
    self.check_tf_definition(report, runner_filter)
  File "/usr/lib/python3.9/site-packages/checkov/terraform/plan_runner.py", line 93, in check_tf_definition
    self.run_block(definition[block_type], full_file_path, report, scanned_file,
  File "/usr/lib/python3.9/site-packages/checkov/terraform/plan_runner.py", line 109, in run_block
    results = registry.scan(scanned_file, entity, [], runner_filter)
  File "/usr/lib/python3.9/site-packages/checkov/common/checks/base_check_registry.py", line 121, in scan
    result = self.run_check(check, entity_configuration, entity_name, entity_type, scanned_file, skip_info)
  File "/usr/lib/python3.9/site-packages/checkov/common/checks/base_check_registry.py", line 135, in run_check
    result = check.run(
  File "/usr/lib/python3.9/site-packages/checkov/common/checks/base_check.py", line 75, in run
    raise e
  File "/usr/lib/python3.9/site-packages/checkov/common/checks/base_check.py", line 62, in run
    check_result["result"] = self.scan_entity_conf(entity_configuration, entity_type)
  File "/usr/lib/python3.9/site-packages/checkov/terraform/checks/resource/base_resource_check.py", line 27, in scan_entity_conf
    return self.scan_resource_conf(conf)
  File "/usr/lib/python3.9/site-packages/checkov/terraform/checks/resource/aws/WAFACLCVE202144228.py", line 27, in scan_resource_conf
    if managed_group[0].get("name") == ["AWSManagedRulesKnownBadInputsRuleSet"]:
  File "/usr/lib/python3.9/site-packages/checkov/common/parsers/node.py", line 183, in __getattr__
    raise TemplateAttributeError(f'{self.__name__}.{name} is invalid')
checkov.common.parsers.node.TemplateAttributeError: <function ListNode.__name__ at 0x7f295099e1f0>.get is invalid
```

**To Reproduce**
You can use this snippet in order to do that:
```
resource "aws_wafv2_web_acl" "main" {
  name  = "${local.common_vars.environment}-${local.common_vars.country}-main"
  scope = "REGIONAL"
  custom_response_body {
    key          = "main-response-body"
    content      = "BLOCKED BY AWS WAF"
    content_type = "TEXT_PLAIN"
  }
  default_action {
    # Allow traffic unless it is blocked by a rule
    allow {}
  }

  rule {
    name     = "aws-managed-known-bad-inputs"
    priority = 1
    override_action {
      none {}
    }
    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesKnownBadInputsRuleSet"
        vendor_name = "AWS"
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "aws-managed-known-bad-inputs"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "aws-managed-common-rule-set"
    priority = 2
    override_action {
      none {}
    }
    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
        excluded_rule {
          name = "SizeRestrictions_BODY"
        }
        excluded_rule {
          name = "CrossSiteScripting_COOKIE"
        }
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "aws-managed-common-rule-set"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "rate-limit-ip"
    priority = 3

    action {
      block {}
    }

    statement {
      rate_based_statement {
        limit              = 1000
        aggregate_key_type = "IP"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "rate-limit-ip"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "all"
    sampled_requests_enabled   = false
  }

  tags = {
    Name        = "${local.common_vars.environment}-${local.common_vars.country}-main"
    Description = "rules derived from AWSManagedRulesCommonRuleSet"
  }
}

```
1. terraform plan -out test_output
2. terrform show -json test_output | jq '.' > test_output.json
3. checkov --framework=terraform_plan -d .


**Expected behavior**
Failed or Passed not raising python error

**Desktop (please complete the following information):**
 - Linux 09d2041af498 5.11.0-40-generic 44~20.04.2-Ubuntu SMP Tue Oct 26 18:07:44 UTC 2021 x86_64 Linux
 - Checkov Version 2.0.654
 - Terraform Version 1.0.9



Discussion:
@KrasimirNikolovTide thanks for raising the issue, I'm right now working on a fix.

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/WAFACLCVE202144228.py b/checkov/terraform/checks/resource/aws/WAFACLCVE202144228.py
--- a/checkov/terraform/checks/resource/aws/WAFACLCVE202144228.py
+++ b/checkov/terraform/checks/resource/aws/WAFACLCVE202144228.py
@@ -24,14 +24,14 @@ def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult:
                 managed_group = statement[0].get("managed_rule_group_statement")
                 if managed_group:
                     self.evaluated_keys = [f"rule/[{idx_rule}]/statement/[0]/managed_rule_group_statement/[0]/name"]
-                    if managed_group[0].get("name") == ["AWSManagedRulesKnownBadInputsRuleSet"]:
+                    if managed_group[0] and managed_group[0].get("name") == ["AWSManagedRulesKnownBadInputsRuleSet"]:
                         self.evaluated_keys.append(
                             f"rule/[{idx_rule}]/statement/[0]/managed_rule_group_statement/[0]/excluded_rule"
                         )
                         excluded_rules = managed_group[0].get("excluded_rule") or []
                         # rule 'Log4JRCE' should not be set to count
                         for idx_excluded_rule, excluded_rule in enumerate(force_list(excluded_rules)):
-                            if excluded_rule.get("name") == ["Log4JRCE"]:
+                            if excluded_rule and excluded_rule.get("name") == ["Log4JRCE"]:
                                 self.evaluated_keys = [
                                     f"rule/[{idx_rule}]/statement/[0]/managed_rule_group_statement/[0]/name",
                                     f"rule/[{idx_rule}]/statement/[0]/managed_rule_group_statement/[0]/excluded_rule/[{idx_excluded_rule}]/name",
@@ -43,7 +43,9 @@ def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult:
                         )
                         override_action = rule.get("override_action")
                         # check for group override
-                        if override_action and next(iter(override_action[0].keys())) != "none":
+                        override_action_none = override_action[0].get("none")
+                        # Terraform plan includes both keys, but one is a dict and the not chosen one a list
+                        if not override_action_none or not isinstance(override_action_none[0], dict):
                             return CheckResult.FAILED
 
                         return CheckResult.PASSED


Test patch:
diff --git a/tests/terraform/checks/resource/aws/example_WAFACLCVE202144228/main.tf b/tests/terraform/checks/resource/aws/example_WAFACLCVE202144228/main.tf
--- a/tests/terraform/checks/resource/aws/example_WAFACLCVE202144228/main.tf
+++ b/tests/terraform/checks/resource/aws/example_WAFACLCVE202144228/main.tf
@@ -48,6 +48,88 @@ resource "aws_wafv2_web_acl" "pass" {
   }
 }
 
+resource "aws_wafv2_web_acl" "multi_rules" {
+  name        = "managed-rule-example"
+  description = "Example of a managed rule."
+  scope       = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "aws-managed-known-bad-inputs"
+    priority = 1
+    override_action {
+      none {}
+    }
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesKnownBadInputsRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "aws-managed-known-bad-inputs"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  rule {
+    name     = "aws-managed-common-rule-set"
+    priority = 2
+    override_action {
+      none {}
+    }
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+        excluded_rule {
+          name = "SizeRestrictions_BODY"
+        }
+        excluded_rule {
+          name = "CrossSiteScripting_COOKIE"
+        }
+      }
+    }
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "aws-managed-common-rule-set"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  rule {
+    name     = "rate-limit-ip"
+    priority = 3
+
+    action {
+      block {}
+    }
+
+    statement {
+      rate_based_statement {
+        limit              = 1000
+        aggregate_key_type = "IP"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "rate-limit-ip"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+
 # fail
 
 resource "aws_wafv2_web_acl" "no_rule" {
diff --git a/tests/terraform/checks/resource/aws/test_WAFACLCVE202144228.py b/tests/terraform/checks/resource/aws/test_WAFACLCVE202144228.py
--- a/tests/terraform/checks/resource/aws/test_WAFACLCVE202144228.py
+++ b/tests/terraform/checks/resource/aws/test_WAFACLCVE202144228.py
@@ -19,6 +19,7 @@ def test(self):
 
         passing_resources = {
             "aws_wafv2_web_acl.pass",
+            "aws_wafv2_web_acl.multi_rules",
         }
 
         failing_resources = {
@@ -31,7 +32,7 @@ def test(self):
         passed_check_resources = {c.resource for c in report.passed_checks}
         failed_check_resources = {c.resource for c in report.failed_checks}
 
-        self.assertEqual(summary["passed"], 1)
+        self.assertEqual(summary["passed"], 2)
         self.assertEqual(summary["failed"], 4)
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)