Repository: bridgecrewio/checkov

Issue:
Don't crash on IAM Policies that do not have an "effect"
**Describe the bug**
[`Effect`](https://www.terraform.io/docs/providers/aws/d/iam_policy_document.html#effect) is an optional token on AWS IAM policy documents.  It will default to Allow.
While it is perhaps good to be explicit, it should not crash Checkov.

```
ERROR:checkov.terraform.checks.data.aws.AdminPolicyDocument:Failed to run check: Ensure IAM policies that allow full "*-*" administrative privileges are not created for configuration: {'statement': ....
Traceback (most recent call last):
  File "/usr/local/bin/checkov", line 5, in <module>
    run()
  File "/usr/local/lib/python3.8/site-packages/checkov/main.py", line 47, in run
    scan_reports = runner_registry.run(root_folder, external_checks_dir=args.external_checks_dir, files=file)
  File "/usr/local/lib/python3.8/site-packages/checkov/common/runners/runner_registry.py", line 20, in run
    scan_report = runner.run(root_folder, external_checks_dir=external_checks_dir, files=files)
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 38, in run
    self.check_tf_definition(report, root_folder, tf_definitions)
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 66, in check_tf_definition
    self.run_block(definition[1][block_type], definitions_context, full_file_path, report, scanned_file,
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 88, in run_block
    results = registry.scan(scanned_file, entity,
  File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check_registry.py", line 48, in scan
    result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,
  File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check.py", line 44, in run
    raise e
  File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check.py", line 33, in run
    check_result['result'] = self.scan_entity_conf(entity_configuration)
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/checks/data/base_check.py", line 19, in scan_entity_conf
    return self.scan_data_conf(conf)
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/checks/data/aws/AdminPolicyDocument.py", line 23, in scan_data_conf
    if 'actions' in statement and statement['effect'][0] == 'Allow' and '*' in statement['actions'][0] and '*' in statement['resources'][0]:
KeyError: 'effect'
```

**To Reproduce**
Steps to reproduce the behavior:
1. Write a terraform file:
```
provider "aws" {
  region = "us-east-1"
}

data "aws_iam_policy_document" "test-policy" {
  statement {
    actions   = ["s3:ListBucket"]
    resources = ["arn:aws:s3:::*"]
  }
}

resource "aws_iam_policy" "test-policy" {
  name   = "test-policy"
  policy = data.aws_iam_policy_document.test-policy.json
}

```

**Expected behavior**
This should not crash

**Additional context**
When trying to debug this, I started getting a *different* error.
```Traceback (most recent call last):
  File "/home/matthew/.local/bin/checkov", line 2, in <module>
    from checkov.main import run
  File "/home/matthew/.local/lib/python3.7/site-packages/checkov/main.py", line 5, in <module>
    from checkov.common.util.docs_generator import print_checks
  File "/home/matthew/.local/lib/python3.7/site-packages/checkov/common/util/docs_generator.py", line 5, in <module>
    from checkov.terraform.checks.data.registry import data_registry
  File "/home/matthew/.local/lib/python3.7/site-packages/checkov/terraform/__init__.py", line 1, in <module>
    from checkov.terraform.checks.resource import *
  File "/home/matthew/.local/lib/python3.7/site-packages/checkov/terraform/checks/resource/__init__.py", line 1, in <module>
    from checkov.terraform.checks.resource.aws import *
  File "/home/matthew/.local/lib/python3.7/site-packages/checkov/terraform/checks/resource/aws/AdminPolicyDocument.py", line 27, in <module>
    check = AdminPolicyDocument()
  File "/home/matthew/.local/lib/python3.7/site-packages/checkov/terraform/checks/resource/aws/AdminPolicyDocument.py", line 11, in __init__
    super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource)
  File "/home/matthew/.local/lib/python3.7/site-packages/checkov/terraform/checks/resource/base_check.py", line 18, in __init__
    resource_registry.register(self)
  File "/home/matthew/.local/lib/python3.7/site-packages/checkov/common/checks/base_check_registry.py", line 16, in register
    for entity in check.supported_entities:
AttributeError: 'AdminPolicyDocument' object has no attribute 'supported_entities'
```



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/data/aws/AdminPolicyDocument.py b/checkov/terraform/checks/data/aws/AdminPolicyDocument.py
--- a/checkov/terraform/checks/data/aws/AdminPolicyDocument.py
+++ b/checkov/terraform/checks/data/aws/AdminPolicyDocument.py
@@ -20,7 +20,8 @@ def scan_data_conf(self, conf):
         key = 'statement'
         if key in conf.keys():
             for statement in conf[key]:
-                if 'actions' in statement and statement['effect'][0] == 'Allow' and '*' in statement['actions'][0] and '*' in statement['resources'][0]:
+                if 'actions' in statement and statement.get('effect', ['Allow'])[0] == 'Allow' and '*' in statement['actions'][0] \
+                        and '*' in statement['resources'][0]:
                     return CheckResult.FAILED
         return CheckResult.PASSED
 
diff --git a/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py b/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
--- a/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
+++ b/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
@@ -20,7 +20,7 @@ def scan_data_conf(self, conf):
         key = 'statement'
         if key in conf.keys():
             for statement in conf['statement']:
-                if 'actions' in statement and '*' in statement['actions'][0] and statement['effect'][0] == "Allow":
+                if 'actions' in statement and '*' in statement['actions'][0] and statement.get('effect', ['Allow'])[0] == 'Allow':
                     return CheckResult.FAILED
         return CheckResult.PASSED
 


Test patch:
diff --git a/tests/terraform/runner/resources/example/example.tf b/tests/terraform/runner/resources/example/example.tf
--- a/tests/terraform/runner/resources/example/example.tf
+++ b/tests/terraform/runner/resources/example/example.tf
@@ -515,7 +515,6 @@ data aws_iam_policy_document "bad_policy_document" {
   statement {
     actions = ["*"]
     resources = ["*"]
-    effect = "Allow"
   }
 }