Repository: bridgecrewio/checkov

Issue:
CKV_AWS_148 fails on resource "aws_default_vpc"  with  count 
**Describe the bug**
Does checkov 2.0 evaluate count value?
In the following example manage_default_vpc variable is default false but checkov 2.0 triggers a failure.

Hi @nimrodkor  @schosterbarak 
Does checkov 2.0 evaluate count value?
In the following example `manage_default_vpc` variable is default false but checkov 2.0 triggers a failure.

```
Check: CKV_AWS_148: "Ensure no default VPC is planned to be provisioned"
	FAILED for resource: module.vpc.aws_default_vpc.this
	File: /.external_modules/terraform-aws-modules/vpc/aws/main.tf:1148-1162
	Calling File: /main.tf:5-28

		1148 | resource "aws_default_vpc" "this" {
		1149 |   count = var.manage_default_vpc ? 1 : 0
		1150 | 
		1151 |   enable_dns_support   = var.default_vpc_enable_dns_support
		1152 |   enable_dns_hostnames = var.default_vpc_enable_dns_hostnames
		1153 |   enable_classiclink   = var.default_vpc_enable_classiclink
		1154 | 
		1155 |   tags = merge(
		1156 |     {
		1157 |       "Name" = format("%s", var.default_vpc_name)
		1158 |     },
		1159 |     var.tags,
		1160 |     var.default_vpc_tags,
		1161 |   )
		1162 | }


debug log
DEBUG:checkov.common.checks.base_check_registry:Running check: Ensure no default VPC is planned to be provisioned on file /.external_modules/terraform-aws-modules/vpc/aws/main.tf
2021-04-13 12:39:16,127 [MainThread  ] [DEBUG]  Running check: Ensure no default VPC is planned to be provisioned on file /.external_modules/terraform-aws-modules/vpc/aws/main.tf
DEBUG:checkov.terraform.checks.resource.aws.VPCDefaultNetwork:File /.external_modules/terraform-aws-modules/vpc/aws/main.tf, resource  "aws_default_vpc.this" check "Ensure no default VPC is planned to be provisioned" Result: {'result': <CheckResult.FAILED: 'FAILED'>, 'evaluated_keys': []} 
2021-04-13 12:39:16,127 [MainThread  ] [DEBUG]  File /.external_modules/terraform-aws-modules/vpc/aws/main.tf, resource  "aws_default_vpc.this" check "Ensure no default VPC is planned to be provisioned" Result: {'result': <CheckResult.FAILED: 'FAILED'>, 'evaluated_keys': []} 

```
source code to reproduce:


```
provider "aws" {
  region = "eu-west-2"
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "2.70.0"

  name = "my-vpc"
  cidr = "10.0.0.0/16"

  azs             = ["eu-west-2a", "eu-west-2b", "eu-west-2c"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]

  enable_s3_endpoint              = false
  enable_dns_hostnames            = true
  enable_dns_support              = true
  create_database_subnet_group    = true
  create_elasticache_subnet_group = false
  enable_nat_gateway              = false
  enable_vpn_gateway              = false

  tags = {
    Terraform   = "true"
    Environment = "dev"
  }
}
```

**To Reproduce**
Steps to reproduce the behavior:
1.  create main.tf in above
2. Run cli command  `checkov -d . --download-external-modules true`
3. See error



**Desktop (please complete the following information):**
 - OS: MacOS
 - Checkov Version  2.0.39






Discussion:
Hi @ismailyenigul , this is the output I'm getting when running the above example:
```

       _               _              
   ___| |__   ___  ___| | _______   __
  / __| '_ \ / _ \/ __| |/ / _ \ \ / /
 | (__| | | |  __/ (__|   < (_) \ V / 
  \___|_| |_|\___|\___|_|\_\___/ \_/  
                                      
By bridgecrew.io | version: 2.0.46 

terraform scan results:

Passed checks: 1, Failed checks: 0, Skipped checks: 0

Check: CKV_AWS_41: "Ensure no hard coded AWS access key and secret key exists in provider"
        PASSED for resource: aws.default
        File: /main.tf:1-3
        Guide: https://docs.bridgecrew.io/docs/bc_aws_secrets_5
```

Can you check if it was somehow resolved between 2.0.39 and 2.0.46?
Hi @nimrodkor 
Did you  pass  `--download-external-modules true` ?
same error with  2.0.46
```
$ checkov -v
2.0.46

$ checkov -d . --download-external-modules true`

hceck: CKV_AWS_148: "Ensure no default VPC is planned to be provisioned"
	FAILED for resource: module.vpc.aws_default_vpc.this
	File: /.external_modules/terraform-aws-modules/vpc/aws/main.tf:1148-1162
	Calling File: /main.tf:5-28

		1148 | resource "aws_default_vpc" "this" {
		1149 |   count = var.manage_default_vpc ? 1 : 0
		1150 | 
		1151 |   enable_dns_support   = var.default_vpc_enable_dns_support
		1152 |   enable_dns_hostnames = var.default_vpc_enable_dns_hostnames
		1153 |   enable_classiclink   = var.default_vpc_enable_classiclink
		1154 | 
		1155 |   tags = merge(
		1156 |     {
		1157 |       "Name" = format("%s", var.default_vpc_name)
		1158 |     },
		1159 |     var.tags,
		1160 |     var.default_vpc_tags,
		1161 |   )
		1162 | }
```

Resolving patch:
diff --git a/checkov/terraform/checks/resource/base_resource_check.py b/checkov/terraform/checks/resource/base_resource_check.py
--- a/checkov/terraform/checks/resource/base_resource_check.py
+++ b/checkov/terraform/checks/resource/base_resource_check.py
@@ -1,24 +1,31 @@
+import json
 from abc import abstractmethod
+from typing import Dict, List, Callable, Optional
 
 from checkov.common.checks.base_check import BaseCheck
+from checkov.common.models.enums import CheckResult, CheckCategories
 from checkov.common.multi_signature import multi_signature
 from checkov.terraform.checks.resource.registry import resource_registry
 
 
 class BaseResourceCheck(BaseCheck):
-    def __init__(self, name, id, categories, supported_resources):
-        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_resources,
-                         block_type="resource")
+    def __init__(self, name: str, id: str, categories: List[CheckCategories], supported_resources: List[str]) -> None:
+        super().__init__(
+            name=name, id=id, categories=categories, supported_entities=supported_resources, block_type="resource"
+        )
         self.supported_resources = supported_resources
         resource_registry.register(self)
 
-    def scan_entity_conf(self, conf, entity_type):
+    def scan_entity_conf(self, conf: Dict[str, List], entity_type: str) -> CheckResult:
+        if conf.get("count") == [0]:
+            return CheckResult.UNKNOWN
+
         self.handle_dynamic_values(conf)
         return self.scan_resource_conf(conf, entity_type)
 
     @multi_signature()
     @abstractmethod
-    def scan_resource_conf(self, conf, entity_type):
+    def scan_resource_conf(self, conf: Dict[str, List], entity_type: str) -> CheckResult:
         """
         self.evaluated_keys should be set with a JSONPath of the attribute inspected.
         If not relevant it should be set to an empty array so the previous check's value gets overridden in the report.
@@ -27,14 +34,14 @@ def scan_resource_conf(self, conf, entity_type):
 
     @classmethod
     @scan_resource_conf.add_signature(args=["self", "conf"])
-    def _scan_resource_conf_self_conf(cls, wrapped):
-        def wrapper(self, conf, entity_type=None):
+    def _scan_resource_conf_self_conf(cls, wrapped: Callable) -> Callable:
+        def wrapper(self: "BaseResourceCheck", conf: Dict[str, List], entity_type: Optional[str] = None) -> CheckResult:
             # keep default argument for entity_type so old code, that doesn't set it, will work.
             return wrapped(self, conf)
 
         return wrapper
 
-    def handle_dynamic_values(self, conf):
+    def handle_dynamic_values(self, conf: Dict[str, List]) -> None:
         for dynamic_element in conf.get("dynamic", {}):
             if isinstance(dynamic_element, str):
                 try:
@@ -42,4 +49,4 @@ def handle_dynamic_values(self, conf):
                 except Exception:
                     dynamic_element = {}
             for element_name in dynamic_element.keys():
-                conf[element_name] = dynamic_element[element_name].get('content', [])
+                conf[element_name] = dynamic_element[element_name].get("content", [])
diff --git a/checkov/terraform/variable_rendering/evaluate_terraform.py b/checkov/terraform/variable_rendering/evaluate_terraform.py
--- a/checkov/terraform/variable_rendering/evaluate_terraform.py
+++ b/checkov/terraform/variable_rendering/evaluate_terraform.py
@@ -93,7 +93,11 @@ def strip_double_quotes(input_str):
     return input_str
 
 
-def evaluate_conditional_expression(input_str):
+def evaluate_conditional_expression(input_str: str) -> str:
+    variable_ref = re.match(r"^\${(.*)}$", input_str)
+    if variable_ref:
+        input_str = variable_ref.groups()[0]
+
     condition = re.match(CONDITIONAL_EXPR, input_str)
     while condition:
         groups = condition.groups()


Test patch:
diff --git a/tests/graph/terraform/runner/test_graph_builder.py b/tests/graph/terraform/runner/test_graph_builder.py
--- a/tests/graph/terraform/runner/test_graph_builder.py
+++ b/tests/graph/terraform/runner/test_graph_builder.py
@@ -52,7 +52,7 @@ def test_module_and_variables(self):
         runner = Runner()
         report = runner.run(root_folder=resources_path)
         self.assertLessEqual(3, len(report.failed_checks))
-        self.assertLessEqual(40, len(report.passed_checks))
+        self.assertLessEqual(34, len(report.passed_checks))
         self.assertEqual(0, len(report.skipped_checks))
 
         found_versioning_failure = False
diff --git a/tests/terraform/checks/example_WildcardEntities/main.tf b/tests/terraform/checks/example_WildcardEntities/main.tf
--- a/tests/terraform/checks/example_WildcardEntities/main.tf
+++ b/tests/terraform/checks/example_WildcardEntities/main.tf
@@ -4,6 +4,10 @@ locals {
   bucket_name          = var.bucket_name
 }
 
+variable "user_exists" {
+  default = false
+}
+
 resource "aws_cognito_user_group" "user_group" {
   name         = "${var.customer_name}_group"
   description  = "${var.customer_name} user group"
diff --git a/tests/terraform/checks/resource/test_base_resource_check.py b/tests/terraform/checks/resource/test_base_resource_check.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/test_base_resource_check.py
@@ -0,0 +1,43 @@
+import pytest
+
+from checkov.common.models.enums import CheckCategories, CheckResult
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+
+
+class TestStaticCheck(BaseResourceCheck):
+    # for pytest not to collect this class as tests
+    __test__ = False
+
+    def __init__(self):
+        name = "Test something"
+        id = "CKV_TEST_1"
+        supported_resources = ["ckv_test"]
+        categories = [CheckCategories.CONVENTION]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def scan_resource_conf(self, conf):
+        if "check_result" in conf.keys():
+            check_result = conf["check_result"][0]
+            if check_result:
+                return CheckResult.PASSED
+
+            return CheckResult.FAILED
+
+        return CheckResult.UNKNOWN
+
+
+@pytest.mark.parametrize(
+    "conf,expected",
+    [
+        ({"check_result": [True]}, CheckResult.PASSED),
+        ({"check_result": [False]}, CheckResult.FAILED),
+        ({"foo": ["bar"]}, CheckResult.UNKNOWN),
+        ({"count": [0], "check_result": [True]}, CheckResult.UNKNOWN),
+        ({"count": [1], "check_result": [True]}, CheckResult.PASSED),
+    ],
+    ids=["pass", "fail", "unknown", "count_zero", "count_one"],
+)
+def test_scan_entity_conf(conf, expected):
+    result = TestStaticCheck().scan_entity_conf(conf, "ckv_test")
+
+    assert result == expected