Repository: bridgecrewio/checkov

Issue:
False positive for tests in bicep: CKV_AZURE_4, CKV_AZURE_5, CKV_AZURE_7, CKV_AZURE_8
**Describe the issue**
false positive for tests CKV_AZURE_4, CKV_AZURE_5, CKV_AZURE_7, CKV_AZURE_8


**Examples**
Here is the bicep code
 Code made shorter.
```
resource aks 'Microsoft.ContainerService/managedClusters@2022-11-01' = {
  properties: {
    enableRBAC: true
    }
    addonProfiles: {
      omsAgent: {
        enabled: true
        config: {
          logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceId
        }
      }
      azurePolicy: {
        enabled: true
        config: {
          version: 'v2'
        }
      }
      kubeDashboard: {
        enabled: false
      }
    }
    networkProfile: {
      networkPlugin: 'azure'
      networkPolicy: 'azure'
    }
  }
}
```

**Version (please complete the following information):**
 - checkov v2.1.244




Discussion:
hey @JonasCordsen thanks for reaching out.

I tested it and only `CKV_AZURE_4` is failing, which is related to the way `omsAgent` is written, we expect it to be all lower case `omsagent`. This looks like a valid case and I can create a PR for it.

I recommend you to update your `checkov` version to the latest one (currently `2.3.59`) and keep it up-to-date.

```shell
Check: CKV_AZURE_4: "Ensure AKS logging to Azure Monitoring is Configured"
        FAILED for resource: Microsoft.ContainerService/managedClusters.aks
        File: //example.bicep:1-26
        Guide: https://docs.bridgecrew.io/docs/bc_azr_kubernetes_1

                1  | resource aks 'Microsoft.ContainerService/managedClusters@2022-11-01' = {
                2  |   properties: {
                3  |     enableRBAC: true
                4  |     addonProfiles: {
                5  |       omsAgent: {
                6  |         enabled: true
                7  |         config: {
                8  |           logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceId
                9  |         }
                10 |       }
                11 |       azurePolicy: {
                12 |         enabled: true
                13 |         config: {
                14 |           version: 'v2'
                15 |         }
                16 |       }
                17 |       kubeDashboard: {
                18 |         enabled: false
                19 |       }
                20 |     }
                21 |     networkProfile: {
                22 |       networkPlugin: 'azure'
                23 |       networkPolicy: 'azure'
                24 |     }
                25 |   }
                26 | }

```

Resolving patch:
diff --git a/checkov/arm/checks/resource/AKSLoggingEnabled.py b/checkov/arm/checks/resource/AKSLoggingEnabled.py
--- a/checkov/arm/checks/resource/AKSLoggingEnabled.py
+++ b/checkov/arm/checks/resource/AKSLoggingEnabled.py
@@ -1,18 +1,22 @@
+from __future__ import annotations
+
+from typing import Any
+
 from checkov.common.models.enums import CheckResult, CheckCategories
 from checkov.arm.base_resource_check import BaseResourceCheck
 
 
 class AKSLoggingEnabled(BaseResourceCheck):
-    def __init__(self):
+    def __init__(self) -> None:
         # apiVersion 2017-08-03 = Fail - No addonProfiles option to configure
         name = "Ensure AKS logging to Azure Monitoring is Configured"
         id = "CKV_AZURE_4"
-        supported_resources = ['Microsoft.ContainerService/managedClusters']
-        categories = [CheckCategories.KUBERNETES]
+        supported_resources = ("Microsoft.ContainerService/managedClusters",)
+        categories = (CheckCategories.KUBERNETES,)
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def scan_resource_conf(self, conf):
-        if conf.get("apiVersion"):
+    def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
+        if "apiVersion" in conf:
             if conf["apiVersion"] == "2017-08-31":
                 # No addonProfiles option to configure
                 return CheckResult.FAILED
@@ -22,6 +26,10 @@ def scan_resource_conf(self, conf):
             addon_profiles = properties.get("addonProfiles")
             if isinstance(addon_profiles, dict):
                 omsagent = addon_profiles.get("omsagent")
+                if not omsagent:
+                    # it can be written in lowercase or camelCase
+                    omsagent = addon_profiles.get("omsAgent")
+
                 if isinstance(omsagent, dict) and omsagent.get("enabled"):
                     return CheckResult.PASSED
 


Test patch:
diff --git a/tests/bicep/checks/resource/azure/example_AKSLoggingEnabled/main.bicep b/tests/bicep/checks/resource/azure/example_AKSLoggingEnabled/main.bicep
--- a/tests/bicep/checks/resource/azure/example_AKSLoggingEnabled/main.bicep
+++ b/tests/bicep/checks/resource/azure/example_AKSLoggingEnabled/main.bicep
@@ -49,6 +49,55 @@ resource enabled 'Microsoft.ContainerService/managedClusters@2022-08-03-preview'
   }
 }
 
+resource enabledCamelCase 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = {
+  name: 'string'
+  location: resourceGroup().location
+  identity: {
+    type: 'SystemAssigned'
+  }
+  properties: {
+    enableRBAC: true
+    agentPoolProfiles: [
+      {
+        name: 'agentpool'
+        osDiskSizeGB: osDiskSizeGB
+        osSKU: 'Ubuntu'
+        osType: 'Linux'
+      }
+    ]
+    addonProfiles: {
+      omsAgent: {
+        config: {
+          logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id
+        }
+        enabled: true
+      }
+      kubeDashboard: {
+        enabled: false
+      }
+    }
+    apiServerAccessProfile: {
+      authorizedIPRanges: [
+        '10.0.0.0/8'
+      ]
+    }
+    networkProfile: {
+      networkPlugin: 'azure'
+      networkPolicy: 'azure'
+    }
+    linuxProfile: {
+      adminUsername: linuxAdminUsername
+      ssh: {
+        publicKeys: [
+          {
+            keyData: sshRSAPublicKey
+          }
+        ]
+      }
+    }
+  }
+}
+
 // fail
 
 resource default 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = {
diff --git a/tests/bicep/checks/resource/azure/test_AKSLoggingEnabled.py b/tests/bicep/checks/resource/azure/test_AKSLoggingEnabled.py
--- a/tests/bicep/checks/resource/azure/test_AKSLoggingEnabled.py
+++ b/tests/bicep/checks/resource/azure/test_AKSLoggingEnabled.py
@@ -17,6 +17,7 @@ def test_examples():
 
     passing_resources = {
         "Microsoft.ContainerService/managedClusters.enabled",
+        "Microsoft.ContainerService/managedClusters.enabledCamelCase",
     }
 
     failing_resources = {