Repository: bridgecrewio/checkov

Issue:
Scanning IAM Role Public Access
Describe the bug
It seems when specifying more than one  json, the policy does not scan all principals, rather it looks at the first one. 

To Reproduce
Steps to reproduce the behavior:

Create policy with more than one SID
`resource "aws_iam_role" "lambdaRole" {
  name               = "test-role"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
      {
        "Action": "sts:AssumeRole",
        "Principal" : {"Service": "lambda.amazonaws.com"},
        "Effect": "Allow"
      },
      {
        "Action": "sts:AssumeRole",
        "Principal" : {"AWS": "*"},
        "Effect": "Allow"
      },
      {
        "Action": "sts:AssumeRole",
        "Principal" : {"Service": "events.amazonaws.com"},
        "Effect": "Allow"
      },
  ]
}

EOF
}`
Run Checkov against policy
Expected behavior
I would expect the scan to check each json within the policy rather than the first one

Desktop (please complete the following information):

OS: Mac
Checkov Version: 1.0.459



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py b/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py
--- a/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py
+++ b/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py
@@ -17,10 +17,10 @@ def scan_resource_conf(self, conf):
             try:
                 assume_role_block = json.loads(conf['assume_role_policy'][0])
                 if 'Statement' in assume_role_block.keys():
-                    if 'Principal' in assume_role_block['Statement'][0]:
-                        if 'AWS' in assume_role_block['Statement'][0]['Principal']:
-                            if assume_role_block['Statement'][0]['Principal']['AWS'] == '*':
-                                    return CheckResult.FAILED
+                    for statement in assume_role_block['Statement']:
+                        if 'AWS' in statement['Principal']:
+                            if statement['Principal']['AWS'] == '*':
+                                return CheckResult.FAILED
             except: # nosec
                 pass
         return CheckResult.PASSED


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_IAMRoleAllowsPublicAssume.py b/tests/terraform/checks/resource/aws/test_IAMRoleAllowsPublicAssume.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_IAMRoleAllowsPublicAssume.py
@@ -0,0 +1,68 @@
+import unittest
+import hcl2
+
+from checkov.terraform.checks.resource.aws.IAMRoleAllowsPublicAssume import check
+from checkov.common.models.enums import CheckResult
+
+
+class TestIAMRoleAllowAssumeFromAccount(unittest.TestCase):
+
+    def test_failure(self):
+        hcl_res = hcl2.loads("""
+resource "aws_iam_role" "lambdaRole" {
+    name = "test-role"
+    assume_role_policy = <<EOF
+{
+"Version": "2012-10-17",
+"Statement": [
+{
+"Action": "sts:AssumeRole",
+"Principal" : {"Service": "lambda.amazonaws.com"},
+"Effect": "Allow"
+},
+{
+"Action": "sts:AssumeRole",
+"Principal" : {"AWS": "*"},
+"Effect": "Allow"
+},
+{
+"Action": "sts:AssumeRole",
+"Principal" : {"Service": "events.amazonaws.com"},
+"Effect": "Allow"
+}
+]
+}
+
+EOF
+}        
+        """)
+        resource_conf = hcl_res['resource'][0]['aws_iam_role']['lambdaRole']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        hcl_res = hcl2.loads("""
+resource "aws_iam_role" "lambdaRole" {
+    name = "test-role"
+    assume_role_policy = <<EOF
+{
+"Version": "2012-10-17",
+"Statement": [
+{
+"Action": "sts:AssumeRole",
+"Principal" : {"Service": "lambda.amazonaws.com"},
+"Effect": "Allow"
+}
+]
+}
+
+EOF
+}        
+        """)
+        resource_conf = hcl_res['resource'][0]['aws_iam_role']['lambdaRole']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()