Repository: bridgecrewio/checkov

Issue:
Custom policy not checking Bicep file
**Describe the issue**
I'm currently testing Checkov for use with Bicep and ARM templates. Checks for the built in policies work fine for both ARM & Bicep so far. But I'm seeing some problems when I create a simple custom policy and scanning Bicep.

It's only PoC at present, so the examples are not complex, but when I run the check to include an external checks directory that contains my custom policy the ARM template (.json) is scanned against this policy, but my .bicep file is not. 

**Examples**
Custom policy

```yml
metadata:
    id: "CUSTOM_01"
    name: "Allow blob public access set to 'False'"
    category: "NETWORK"
definition:
    cond_type: attribute
    resource_types: "Microsoft.Storage/storageAccounts"
    attribute: "properties.allowBlobPublicAccess"
    operator: "equals"
    value: "false"
```

Command to run the check:
   `checkov -d . --external-checks-dir ./custom`


Results for ARM file (summary):
```
arm scan results:

Passed checks: 1, Failed checks: 3, Skipped checks: 0

Check: CKV_AZURE_3: "Ensure that 'supportsHttpsTrafficOnly' is set to 'true'"
        PASSED for resource: Microsoft.Storage/storageAccounts.2sayguiyg7
        File: /test.json:8-21

Check: CUSTOM_01: "Allow blob public access set to 'False'"
        FAILED for resource: Microsoft.Storage/storageAccounts.2sayguiyg7
        File: /test.json:6-19
```

Results for .bicep (summary):
```
bicep scan results:

Passed checks: 2, Failed checks: 1, Skipped checks: 0

Check: CKV_AZURE_36: "Ensure 'Trusted Microsoft Services' is enabled for Storage Account access"
        PASSED for resource: Microsoft.Storage/storageAccounts.storageaccount
        Severity: MEDIUM
        File: /test.bicep:5-17
        Guide: https://docs.bridgecrew.io/docs/enable-trusted-microsoft-services-for-storage-account-access
```
  
So the .bicep file is only checked against the built-in policy definitions, not against the custom policy.


Thanks in advance...



**Version (please complete the following information):**
 - Checkov version: 2.3.132

**Additional context**
Add any other context about the problem here.



Discussion:
hey @andrewCluey thanks for reaching out.

Sounds like a bug, but to better validate it can you also add the Bicep template, which you test against. A trimmed down version would be great 🙂 
> hey @andrewCluey thanks for reaching out.
> 
> Sounds like a bug, but to better validate it can you also add the Bicep template, which you test against. A trimmed down version would be great 🙂

Sure..

Here's the simple .bicep file I'm trying to scan with my custom policy.

```bicep
param name string = 'saiygiuyg123'
param location string = 'uksouth'


resource storageaccount 'Microsoft.Storage/storageAccounts@2021-02-01' = {
  name: name
  location: location
  kind: 'StorageV2'
  sku: {
    name: 'Premium_LRS'
  }
  properties: {
    accessTier: 'Hot'
    supportsHttpsTrafficOnly: true
    allowBlobPublicAccess: true
  }
}

```

As I've defined the `allowBlobPublicAccess` parameter to `true`, I'm expecting it to fail against my custom policy (as the .json file does). But the output suggests that it's not even performing the check (I've tried it with this param' set to `true` & `false`...
hey @andrewCluey 

I found the issue and will create a PR to fix it, but you can easily mitigate it on your side. The `resource_types` value needs to be a list, so you just need to change it to

```yaml
metadata:
    id: "CUSTOM_01"
    name: "Allow blob public access set to 'False'"
    category: "NETWORK"
definition:
    cond_type: attribute
    resource_types:
      - "Microsoft.Storage/storageAccounts"
    attribute: "properties.allowBlobPublicAccess"
    operator: "equals"
    value: "false"
```

Resolving patch:
diff --git a/checkov/common/checks_infra/checks_parser.py b/checkov/common/checks_infra/checks_parser.py
--- a/checkov/common/checks_infra/checks_parser.py
+++ b/checkov/common/checks_infra/checks_parser.py
@@ -228,6 +228,9 @@ def _parse_raw_check(self, raw_check: Dict[str, Any], resources_types: Optional[
                     or (isinstance(resource_type, list) and resource_type[0].lower() == "all")
             ):
                 check.resource_types = resources_types or []
+            elif isinstance(resource_type, str):
+                #  for the case the "resource_types" value is a string, which can result in a silent exception
+                check.resource_types = [resource_type]
             else:
                 check.resource_types = resource_type
 


Test patch:
diff --git a/tests/terraform/graph/checks/custom_policies/CustomPolicy2.yaml b/tests/terraform/graph/checks/custom_policies/CustomPolicy2.yaml
new file mode 100644
--- /dev/null
+++ b/tests/terraform/graph/checks/custom_policies/CustomPolicy2.yaml
@@ -0,0 +1,10 @@
+metadata:
+  name: "Tests resource_types value to be a string"
+  id: "CUSTOM_2"
+  category: "GENERAL_SECURITY"
+definition:
+  cond_type: "attribute"
+  resource_types: "aws_sqs_queue"
+  attribute: "delay_seconds"
+  operator: "equals"
+  value: 900
diff --git a/tests/terraform/graph/checks/resources/CustomPolicy2/expected.yaml b/tests/terraform/graph/checks/resources/CustomPolicy2/expected.yaml
new file mode 100644
--- /dev/null
+++ b/tests/terraform/graph/checks/resources/CustomPolicy2/expected.yaml
@@ -0,0 +1,4 @@
+pass:
+  - "aws_sqs_queue.pass"
+fail:
+  - "aws_sqs_queue.fail"
diff --git a/tests/terraform/graph/checks/resources/CustomPolicy2/main.tf b/tests/terraform/graph/checks/resources/CustomPolicy2/main.tf
new file mode 100644
--- /dev/null
+++ b/tests/terraform/graph/checks/resources/CustomPolicy2/main.tf
@@ -0,0 +1,12 @@
+# if there is a non-resource block, then the pre-fixed version failed with a silent exception
+variable "test" {}
+
+resource "aws_sqs_queue" "pass" {
+    name          = "pass"
+    delay_seconds = 900
+}
+
+resource "aws_sqs_queue" "fail" {
+    name          = "pass"
+    delay_seconds = 0
+}
diff --git a/tests/terraform/graph/checks/test_custom_yaml_policies.py b/tests/terraform/graph/checks/test_custom_yaml_policies.py
--- a/tests/terraform/graph/checks/test_custom_yaml_policies.py
+++ b/tests/terraform/graph/checks/test_custom_yaml_policies.py
@@ -20,6 +20,10 @@ def setUp(self) -> None:
     def test_CustomPolicy1(self):
         self.go("CustomPolicy1")
 
+    def test_CustomPolicy2(self):
+        # tests resource_types value to be a string
+        self.go("CustomPolicy2")
+
     def test_CustomAwsEMRSecurityConfiguration(self):
         self.go('CustomAwsEMRSecurityConfiguration')