Repository: bridgecrewio/checkov

Issue:
Failed to run check CKV_AWS_224: TemplateAttributeError: get is invalid
**Describe the issue**
Error occurs when checked ECS Cluster using terraform_plan framework.

**Examples**
```
module "cluster" {
  source  = "terraform-aws-modules/ecs/aws"
  version = "4.1.3"

  cluster_name = "foo"
  fargate_capacity_providers = {
    FARGATE = {}
  }
}
```

**Version (please complete the following information):**
- checkov 2.3.165
- terraform 1.4.5
- aws provider 4.63.0

**Additional context**
traceback:
```
2023-04-18 09:53:09,676 [MainThread  ] [ERROR]  Failed to run check CKV_AWS_224 on /tfplan.json:aws_ecs_cluster.this
Traceback (most recent call last):
  File "/usr/local/lib/python3.9/site-packages/checkov/common/checks/base_check.py", line 73, in run
    check_result["result"] = self.scan_entity_conf(entity_configuration, entity_type)
  File "/usr/local/lib/python3.9/site-packages/checkov/terraform/checks/resource/base_resource_check.py", line 43, in scan_entity_conf
    return self.scan_resource_conf(conf)
  File "/usr/local/lib/python3.9/site-packages/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py", line 21, in scan_resource_conf
    if log_conf.get('cloud_watch_encryption_enabled') == [True] or \
  File "/usr/local/lib/python3.9/site-packages/checkov/common/parsers/node.py", line 189, in __getattr__
    raise TemplateAttributeError(f'{name} is invalid')
checkov.common.parsers.node.TemplateAttributeError: get is invalid
```

This only occurs when using terraform_plan framework. It works without issue when using vanilla terraform framework.

The plan generation is just `terraform plan -out tfplan.bin && terraform show -json tfplan.bin > tfplan.json` then running `checkof -f tfplan.json`.

Here is my checkov config file in repo:
```
➜ cat .checkov.yaml     
block-list-secret-scan: []
compact: true
download-external-modules: true
evaluate-variables: true
external-modules-download-path: .external_modules
file:
- tfplan.json
framework:
- terraform_plan
mask: []
quiet: true
repo-root-for-plan-enrichment:
- .
secrets-history-timeout: 12h
secrets-scan-file-type: []
skip-check:
- CKV2_AWS_34
summary-position: top
```



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py b/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py
--- a/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py
+++ b/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py
@@ -1,28 +1,36 @@
+from __future__ import annotations
+
+from typing import Any
+
 from checkov.common.models.enums import CheckResult, CheckCategories
 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
 
 
 class ECSClusterLoggingEncryptedWithCMK(BaseResourceCheck):
-    def __init__(self):
-        name = "Ensure Cluster logging with CMK"
+    def __init__(self) -> None:
+        name = "Ensure ECS Cluster logging uses CMK"
         id = "CKV_AWS_224"
-        supported_resources = ['aws_ecs_cluster']
-        categories = [CheckCategories.ENCRYPTION]
+        supported_resources = ("aws_ecs_cluster",)
+        categories = (CheckCategories.ENCRYPTION,)
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def scan_resource_conf(self, conf):
+    def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:
         configuration = conf.get("configuration")
-        if configuration and isinstance(configuration[0], dict) and configuration[0].get('execute_command_configuration'):
-            command_conf = configuration[0].get('execute_command_configuration')[0]
-            if not command_conf.get('logging') == ['NONE']:
-                if command_conf.get('kms_key_id'):
-                    if command_conf.get('log_configuration'):
-                        log_conf = command_conf.get('log_configuration')[0]
-                        if log_conf.get('cloud_watch_encryption_enabled') == [True] or \
-                                log_conf.get('s3_bucket_encryption_enabled') == [True]:
-                            return CheckResult.PASSED
-                    return CheckResult.FAILED
-                else:
+        if configuration and isinstance(configuration, list) and isinstance(configuration[0], dict):
+            execute_command = configuration[0].get("execute_command_configuration")
+            if execute_command and isinstance(execute_command, list):
+                execute_command = execute_command[0]
+                if isinstance(execute_command, dict) and not execute_command.get("logging") == ["NONE"]:
+                    if execute_command.get("kms_key_id"):
+                        log_conf = execute_command.get("log_configuration")
+                        if log_conf and isinstance(log_conf, list):
+                            log_conf = log_conf[0]
+                            if isinstance(log_conf, dict) and (
+                                log_conf.get("cloud_watch_encryption_enabled") == [True]
+                                or log_conf.get("s3_bucket_encryption_enabled") == [True]
+                            ):
+                                return CheckResult.PASSED
+
                     return CheckResult.FAILED
 
         return CheckResult.UNKNOWN


Test patch:
diff --git a/tests/terraform/checks/resource/aws/example_ECSClusterLoggingEncryptedWithCMK/main.tf b/tests/terraform/checks/resource/aws/example_ECSClusterLoggingEncryptedWithCMK/main.tf
--- a/tests/terraform/checks/resource/aws/example_ECSClusterLoggingEncryptedWithCMK/main.tf
+++ b/tests/terraform/checks/resource/aws/example_ECSClusterLoggingEncryptedWithCMK/main.tf
@@ -13,7 +13,7 @@ resource "aws_ecs_cluster" "unknown" {
   tags = { test = "fail" }
 }
 
-resource "aws_ecs_cluster" "unknown" {
+resource "aws_ecs_cluster" "unknown2" {
   name = "white-hart"
   configuration {
     execute_command_configuration {
@@ -92,6 +92,18 @@ resource "aws_ecs_cluster" "fail3" {
   tags = { test = "fail" }
 }
 
+resource "aws_ecs_cluster" "fail5" {
+  name = "white-hart"
+  configuration {
+    execute_command_configuration {
+      kms_key_id = aws_kms_key.example.arn
+
+      log_configuration = [null]
+    }
+  }
+  tags = { test = "fail" }
+}
+
 resource "aws_ecs_cluster" "pass" {
   name = "white-hart"
   configuration {
diff --git a/tests/terraform/checks/resource/aws/test_ECSClusterLoggingEncryptedWithCMK.py b/tests/terraform/checks/resource/aws/test_ECSClusterLoggingEncryptedWithCMK.py
--- a/tests/terraform/checks/resource/aws/test_ECSClusterLoggingEncryptedWithCMK.py
+++ b/tests/terraform/checks/resource/aws/test_ECSClusterLoggingEncryptedWithCMK.py
@@ -26,13 +26,14 @@ def test(self):
             "aws_ecs_cluster.fail2",
             "aws_ecs_cluster.fail3",
             "aws_ecs_cluster.fail4",
+            "aws_ecs_cluster.fail5",
         }
 
         passed_check_resources = {c.resource for c in report.passed_checks}
         failed_check_resources = {c.resource for c in report.failed_checks}
 
-        self.assertEqual(summary["passed"], 2)
-        self.assertEqual(summary["failed"], 4)
+        self.assertEqual(summary["passed"], len(passing_resources))
+        self.assertEqual(summary["failed"], len(failing_resources))
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)