Repository: bridgecrewio/checkov

Issue:
Policy Document Check Bugs
**Describe the bug**
StarActionPolicyDocument  has issues with SCPs that use not_action.

Stack trace:
```
 Traceback (most recent call last):
   File "/usr/local/bin/checkov", line 5, in <module>
     run()
   File "/usr/local/lib/python3.8/site-packages/checkov/main.py", line 47, in run
     scan_reports = runner_registry.run(root_folder, external_checks_dir=args.external_checks_dir, files=file)
   File "/usr/local/lib/python3.8/site-packages/checkov/common/runners/runner_registry.py", line 20, in run
     scan_report = runner.run(root_folder, external_checks_dir=external_checks_dir, files=files)
   File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 38, in run
     self.check_tf_definition(report, root_folder, tf_definitions)
   File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 66, in check_tf_definition
     self.run_block(definition[1][block_type], definitions_context, full_file_path, report, scanned_file,
   File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 88, in run_block
     results = registry.scan(scanned_file, entity,
   File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check_registry.py", line 48, in scan
     result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,
   File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check.py", line 44, in run
     raise e
   File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check.py", line 33, in run
     check_result['result'] = self.scan_entity_conf(entity_configuration)
   File "/usr/local/lib/python3.8/site-packages/checkov/terraform/checks/data/base_check.py", line 19, in scan_entity_conf
     return self.scan_data_conf(conf)
   File "/usr/local/lib/python3.8/site-packages/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py", line 23, in scan_data_conf
     if '*' in statement['actions'][0] and statement['effect'][0] == "Allow":
 KeyError: 'actions'
```

**To Reproduce**
Attempt to scan a SCP policy document with a statement like:
```
  statement {
    sid    = "NoIAMUsers"
    effect = "Deny"
    not_actions = [
      "iam:Get*",
      "iam:List*",
      "iam:Describe*",
    ]
    resources = [
      "arn:aws:iam::*:user/*",
    ]
  }
```

**Expected behavior**
The checks should probably ignore statements that use not_actions.

**Screenshots**
N/A

**Desktop (please complete the following information):**
 - Docker (GitLab CI)
 - Checkov Version: 1.0.230 

**Additional context**
Add any other context about the problem here (e.g. code snippets).



Discussion:
Investigating
Thank you. No rush. I've added a skip comment to work around for now.

Resolving patch:
diff --git a/checkov/terraform/checks/data/aws/AdminPolicyDocument.py b/checkov/terraform/checks/data/aws/AdminPolicyDocument.py
--- a/checkov/terraform/checks/data/aws/AdminPolicyDocument.py
+++ b/checkov/terraform/checks/data/aws/AdminPolicyDocument.py
@@ -20,7 +20,7 @@ def scan_data_conf(self, conf):
         key = 'statement'
         if key in conf.keys():
             for statement in conf[key]:
-                if statement['effect'][0] == 'Allow' and '*' in statement['actions'][0] and '*' in statement['resources'][0]:
+                if 'actions' in statement and statement['effect'][0] == 'Allow' and '*' in statement['actions'][0] and '*' in statement['resources'][0]:
                     return CheckResult.FAILED
         return CheckResult.PASSED
 
diff --git a/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py b/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
--- a/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
+++ b/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
@@ -20,7 +20,7 @@ def scan_data_conf(self, conf):
         key = 'statement'
         if key in conf.keys():
             for statement in conf['statement']:
-                if '*' in statement['actions'][0] and statement['effect'][0] == "Allow":
+                if 'actions' in statement and '*' in statement['actions'][0] and statement['effect'][0] == "Allow":
                     return CheckResult.FAILED
         return CheckResult.PASSED
 


Test patch:
diff --git a/tests/terraform/runner/resources/example/example.tf b/tests/terraform/runner/resources/example/example.tf
--- a/tests/terraform/runner/resources/example/example.tf
+++ b/tests/terraform/runner/resources/example/example.tf
@@ -555,3 +555,18 @@ data aws_iam_policy_document "good_deny_policy_document" {
     }
   }
 }
+
+data aws_iam_policy_document "scp_deny_example" {
+  statement {
+    sid    = "NoIAMUsers"
+    effect = "Deny"
+    not_actions = [
+      "iam:Get*",
+      "iam:List*",
+      "iam:Describe*",
+    ]
+    resources = [
+      "arn:aws:iam::*:user/*",
+    ]
+  }
+}
\ No newline at end of file