Repository: bridgecrewio/checkov

Issue:
[bicep] Checks on referenced resources executed
**Describe the issue**
If I reference an existing resource in a bicep file, eg a Storage Account, checks are executed. Because I could not add any properties of a reference. Keyword is "existing"

Check: CKV_AZURE_3: "Ensure that 'supportsHttpsTrafficOnly' is set to 'true'"
	PASSED for resource: Microsoft.Storage/storageAccounts.StorageAccount

**Examples**
```bicep
resource StorageAccount 'Microsoft.Storage/storageAccounts@2021-08-01' existing = {
  name: storageAccountName
}
```

**Version (please complete the following information):**
 - Checkov Version [2.0.1084]

**Additional context**




Discussion:
hey @holly79 thanks for pointing this out, you are right. `checkov` doesn't take into account that resource with the `existing` keyword can't be changed and is only used to be referenced. It shouldn't be too hard to fix it, I hope 😄 

Resolving patch:
diff --git a/checkov/arm/base_resource_check.py b/checkov/arm/base_resource_check.py
--- a/checkov/arm/base_resource_check.py
+++ b/checkov/arm/base_resource_check.py
@@ -39,7 +39,7 @@ def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResul
         # the "existing" key indicates a Bicep resource
         if "existing" in conf:
             if conf["existing"] is True:
-                # an existing is used to retrieve information about an already deployed one
+                # the existing keyword is used to retrieve information about an already deployed resource
                 return CheckResult.UNKNOWN
 
             self.api_version = conf["api_version"]
diff --git a/checkov/bicep/checks/resource/base_resource_check.py b/checkov/bicep/checks/resource/base_resource_check.py
--- a/checkov/bicep/checks/resource/base_resource_check.py
+++ b/checkov/bicep/checks/resource/base_resource_check.py
@@ -32,6 +32,10 @@ def __init__(
         registry.register(self)
 
     def scan_entity_conf(self, conf: ResourceAttributes, entity_type: str) -> CheckResult:
+        if conf["existing"] is True:
+            # the existing keyword is used to retrieve information about an already deployed resource
+            return CheckResult.UNKNOWN
+
         self.entity_type = entity_type
         self.api_version = conf["api_version"]
 
diff --git a/checkov/main.py b/checkov/main.py
--- a/checkov/main.py
+++ b/checkov/main.py
@@ -524,12 +524,4 @@ def normalize_config(config: Namespace) -> None:
 
 
 if __name__ == '__main__':
-    from timeit import default_timer as timer
-    from datetime import timedelta
-
-    start = timer()
-
-    run()
-
-    end = timer()
-    print(f"elapsed time: {timedelta(seconds=end - start)}")
+    sys.exit(run())


Test patch:
diff --git a/tests/bicep/examples/existing.bicep b/tests/bicep/examples/existing.bicep
new file mode 100644
--- /dev/null
+++ b/tests/bicep/examples/existing.bicep
@@ -0,0 +1,8 @@
+// should not flag an existing resource for any check
+resource storageAccountExisting 'Microsoft.Storage/storageAccounts@2021-08-01' existing = {
+  name: 'existing'
+}
+
+resource storageAccount 'Microsoft.Storage/storageAccounts@2021-08-01' = {
+  name: 'new'
+}
diff --git a/tests/bicep/test_graph_manager.py b/tests/bicep/test_graph_manager.py
--- a/tests/bicep/test_graph_manager.py
+++ b/tests/bicep/test_graph_manager.py
@@ -10,16 +10,17 @@
 
 def test_build_graph_from_source_directory():
     # given
-    test_file = EXAMPLES_DIR / "playground.bicep"
+    existing_file = EXAMPLES_DIR / "existing.bicep"
+    playground_file = EXAMPLES_DIR / "playground.bicep"
     graph_manager = BicepGraphManager(db_connector=NetworkxConnector())
 
     # when
     local_graph, definitions = graph_manager.build_graph_from_source_directory(source_dir=str(EXAMPLES_DIR))
 
     # then
-    assert list(definitions.keys()) == [test_file]  # should no include 'malformed.bicep' file
+    assert set(definitions.keys()) == {existing_file, playground_file}  # should no include 'malformed.bicep' file
 
-    assert len(local_graph.vertices) == 24
+    assert len(local_graph.vertices) == 27
     assert len(local_graph.edges) == 29
 
     storage_account_idx = local_graph.vertices_by_name["diagsAccount"]  # vertices_by_name exists for BicepGraphManager
diff --git a/tests/bicep/test_runner.py b/tests/bicep/test_runner.py
--- a/tests/bicep/test_runner.py
+++ b/tests/bicep/test_runner.py
@@ -85,3 +85,22 @@ def test_runner_parsing_errors():
     assert summary["failed"] == 0
     assert summary["skipped"] == 0
     assert summary["parsing_errors"] == 1
+
+
+def test_runner_ignore_existing_resource():
+    # given
+    test_file = EXAMPLES_DIR / "existing.bicep"
+
+    # when
+    report = Runner().run(root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV_AZURE_35"]))
+
+    # then
+    summary = report.get_summary()
+
+    assert summary["passed"] == 0
+    assert summary["failed"] == 1
+    assert summary["skipped"] == 0
+    assert summary["parsing_errors"] == 0
+    assert summary["resource_count"] == 2  # 1 should be unknown
+
+    assert report.failed_checks[0].resource == "Microsoft.Storage/storageAccounts.storageAccount"