Repository: bridgecrewio/checkov

Issue:
Checkov failing to perform a check against a Terraform Plan when skipping a specific AWS check
**Describe the issue**
Checkov failing to perform a check against a Terraform Plan when skipping a specific AWS check

**Examples**
```
resource "aws_iam_role" "backend" {
  #checkov:skip=CKV_AWS_274:TODO Generate a policy from CloudTrail later
  name                = "${var.repo}-foo"
  assume_role_policy  = data.aws_iam_policy_document.backend-assume.json
  managed_policy_arns = ["arn:aws:iam::aws:policy/AdministratorAccess"]
  inline_policy {
    name   = "foo"
    policy = data.aws_iam_policy_document.backend-permissions.json
  }
  tags = {
    component = var.foo
  }
}
```

**Exception Trace**
```
Traceback (most recent call last):
  File "/usr/local/bin/checkov", line 9, in <module>
    sys.exit(run())
  File "/usr/local/lib/python3.9/site-packages/checkov/main.py", line 355, in run
    scan_reports = runner_registry.run(external_checks_dir=external_checks_dir, files=config.file,
  File "/usr/local/lib/python3.9/site-packages/checkov/common/runners/runner_registry.py", line 79, in run
    self.runners[0].run(root_folder, external_checks_dir=external_checks_dir, files=files,
  File "/usr/local/lib/python3.9/site-packages/checkov/terraform/plan_runner.py", line 81, in run
    self.check_tf_definition(report, root_folder, runner_filter)
  File "/usr/local/lib/python3.9/site-packages/checkov/terraform/plan_runner.py", line 99, in check_tf_definition
    self.run_block(definition[block_type], None, full_file_path, root_folder, report, scanned_file,
  File "/usr/local/lib/python3.9/site-packages/checkov/terraform/plan_runner.py", line 119, in run_block
    results = registry.scan(scanned_file, entity, [], runner_filter, report_type=CheckType.TERRAFORM_PLAN)
  File "/usr/local/lib/python3.9/site-packages/checkov/common/checks/base_check_registry.py", line 127, in scan
    result = self.run_check(check, entity_configuration, entity_name, entity_type, scanned_file, skip_info)
  File "/usr/local/lib/python3.9/site-packages/checkov/common/checks/base_check_registry.py", line 141, in run_check
    result = check.run(
  File "/usr/local/lib/python3.9/site-packages/checkov/common/checks/base_check.py", line 70, in run
    check_result["result"] = self.scan_entity_conf(entity_configuration, entity_type)
  File "/usr/local/lib/python3.9/site-packages/checkov/terraform/checks/resource/base_resource_check.py", line 43, in scan_entity_conf
    return self.scan_resource_conf(conf)
  File "/usr/local/lib/python3.9/site-packages/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py", line 42, in scan_resource_conf
    if conf.get("policy_arn")[0] == ADMIN_POLICY_ARN:
TypeError: 'NoneType' object is not subscriptable
```

**Desktop (please complete the following information):**
 - MacOS 11.7
 - Checkov Version 2.2.0

**Additional context**
This fails as of whateverv version CKV_AWS_274 was added. Last time a build didn't crash I was using 2.1.294 and it worked.
Also if I skip it with a command-line switch then this crash does not happen (which is going to be my temp workaround)



Discussion:
hey @citrix-eg thanks for reaching out. Sadly I can't reproduce it. The error also indicates it is not the provided `aws_iam_role`, which causes the error, there has to be an IAM attachment resource like `aws_iam_policy_attachment` in your plan file.
Gah, shame on me! I clipped off too much of the error itself and only pasted the traceback! Yes, this is not even remotely related to the role I mentioned at first. The fact that I was responding to the initial checkov flagging for that resource threw me off.

Here is shell output including invocation but not including the traceback I sent (which is the same):
```
➜ checkov -f ~/Downloads/tfplan.json --repo-root-for-plan-enrichment . --download-external-modules true --framework terraform_plan --check CKV_AWS_274 
2022-10-27 08:50:43,940 [MainThread  ] [ERROR]  Failed to run check:
Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy for configuration:
{'start_line': [0], 'end_line': [0], '__address__':
'module.vpc.aws_iam_role_policy_attachment.vpc_flow_log_cloudwatch[0]', '__change_actions__':
['create']} at file: /../../../../Downloads/tfplan.json
```

That helps because it makes my plan file a lot smaller and I feel a lot more confident I sanitized it well so I can post it here. I generated this plan by targeting the specific resource that was mentioned in the error message so hopefully this is helpful!

Some additional context, this is generated from the [common VPC module](https://registry.terraform.io/modules/terraform-aws-modules/vpc/aws/latest).

[tfplan.json.zip](https://github.com/bridgecrewio/checkov/files/9879677/tfplan.json.zip)
thanks, now I can reproduce it 😄 

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py b/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py
--- a/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py
+++ b/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py
@@ -1,3 +1,7 @@
+from __future__ import annotations
+
+from typing import Any
+
 from checkov.common.models.enums import CheckResult, CheckCategories
 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
 
@@ -7,7 +11,7 @@
 
 
 class IAMManagedAdminPolicy(BaseResourceCheck):
-    def __init__(self):
+    def __init__(self) -> None:
         # This is the full description of your check
         description = "Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy"
 
@@ -27,10 +31,10 @@ def __init__(self):
         categories = (CheckCategories.IAM,)
         super().__init__(name=description, id=id, categories=categories, supported_resources=supported_resources)
 
-    def scan_resource_conf(self, conf):
+    def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:
         if self.entity_type == "aws_iam_role":
             if "managed_policy_arns" in conf.keys():
-                if ADMIN_POLICY_ARN in conf.get("managed_policy_arns")[0]:
+                if ADMIN_POLICY_ARN in conf["managed_policy_arns"][0]:
                     return CheckResult.FAILED
 
         elif self.entity_type in (
@@ -39,10 +43,11 @@ def scan_resource_conf(self, conf):
             "aws_iam_user_policy_attachment",
             "aws_iam_group_policy_attachment",
         ):
-            if conf.get("policy_arn")[0] == ADMIN_POLICY_ARN:
+            policy_arn = conf.get("policy_arn")
+            if policy_arn and policy_arn[0] == ADMIN_POLICY_ARN:
                 return CheckResult.FAILED
 
         return CheckResult.PASSED
 
 
-check = IAMManagedAdminPolicy()
\ No newline at end of file
+check = IAMManagedAdminPolicy()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/example_IAMManagedAdminPolicy/IAMManagedAdminPolicy.tf b/tests/terraform/checks/resource/aws/example_IAMManagedAdminPolicy/IAMManagedAdminPolicy.tf
--- a/tests/terraform/checks/resource/aws/example_IAMManagedAdminPolicy/IAMManagedAdminPolicy.tf
+++ b/tests/terraform/checks/resource/aws/example_IAMManagedAdminPolicy/IAMManagedAdminPolicy.tf
@@ -56,6 +56,10 @@ resource "aws_iam_group_policy_attachment" "pass5" {
   policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
 }
 
+resource "aws_iam_role_policy_attachment" "pass6" {
+  role       = aws_iam_role.fail1.name
+#  policy_arn = ""  # not valid, just to simulate a TF plan behaviour
+}
 
 # Data
 
diff --git a/tests/terraform/checks/resource/aws/test_IAMManagedAdminPolicy.py b/tests/terraform/checks/resource/aws/test_IAMManagedAdminPolicy.py
--- a/tests/terraform/checks/resource/aws/test_IAMManagedAdminPolicy.py
+++ b/tests/terraform/checks/resource/aws/test_IAMManagedAdminPolicy.py
@@ -23,6 +23,7 @@ def test(self):
             "aws_iam_role_policy_attachment.pass3",
             "aws_iam_user_policy_attachment.pass4",
             "aws_iam_group_policy_attachment.pass5",
+            "aws_iam_role_policy_attachment.pass6",
         }
 
         failing_resources = {
@@ -36,8 +37,8 @@ def test(self):
         passed_check_resources = {c.resource for c in report.passed_checks}
         failed_check_resources = {c.resource for c in report.failed_checks}
 
-        self.assertEqual(summary["passed"], 5)
-        self.assertEqual(summary["failed"], 5)
+        self.assertEqual(summary["passed"], len(passing_resources))
+        self.assertEqual(summary["failed"], len(failing_resources))
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)