Repository: bridgecrewio/checkov

Issue:
Unable to Evaluate Final Result from condition 
**Describe the issue**
CKV_GCP_43: "Ensure KMS encryption keys are rotated within a period of 90 days"

**Examples**
Check: CKV_GCP_43: "Ensure KMS encryption keys are rotated within a period of 90 days"
	FAILED for resource: module.kms.google_kms_crypto_key.key
	File: /main.tf:11-29
	Calling File: /example/production/main.tf:1-6
	Guide: https://docs.bridgecrew.io/docs/bc_gcp_general_4

		11 | resource "google_kms_crypto_key" "key" {
		12 |   count           = var.prevent_destroy ? length(var.keys) : 0
		13 |   name            = var.keys[count.index]
		14 |   key_ring        = google_kms_key_ring.key_ring.id
		15 |   rotation_period = contains(["ASYMMETRIC_SIGN", "ASYMMETRIC_DECRYPT"], var.purpose) ? null : var.key_rotation_period
		16 |   #rotation_period = var.key_rotation_period
		17 |   purpose = var.purpose
		18 |
		19 |   lifecycle {
		20 |     prevent_destroy = true
		21 |   }
		22 |
		23 |   version_template {
		24 |     algorithm        = var.key_algorithm
		25 |     protection_level = var.key_protection_level
		26 |   }
		27 |
		28 |   labels = var.labels
		29 | }

Checkov should providing error only in ASYMMETRIC key creation not the ENCRYPT_DCRYPT purpose for KMS key. Even after setting the purpose to ENCRYPT_DCRYPT and key_rotation_period variable to 90 days(7776000s), check is failing.
**Version (please complete the following information):**
 - Checkov Version 2.3.156

**Additional context**
`contains(["ASYMMETRIC_SIGN", "ASYMMETRIC_DECRYPT"], var.purpose) ? null : var.key_rotation_period`
Above line should be evaluated and marked as passed for GCP KMS as ASYMMETRIC key is not supporting Automatic rotation.



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/gcp/GoogleKMSRotationPeriod.py b/checkov/terraform/checks/resource/gcp/GoogleKMSRotationPeriod.py
--- a/checkov/terraform/checks/resource/gcp/GoogleKMSRotationPeriod.py
+++ b/checkov/terraform/checks/resource/gcp/GoogleKMSRotationPeriod.py
@@ -5,6 +5,7 @@
 from checkov.common.models.enums import CheckResult, CheckCategories
 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
 
+ASYMMETRIC_KEYS = {"ASYMMETRIC_DECRYPT", "ASYMMETRIC_SIGN"}
 # rotation_period time unit is seconds
 ONE_DAY = 24 * 60 * 60
 NINETY_DAYS = 90 * ONE_DAY
@@ -14,11 +15,17 @@ class GoogleKMSKeyRotationPeriod(BaseResourceCheck):
     def __init__(self) -> None:
         name = "Ensure KMS encryption keys are rotated within a period of 90 days"
         id = "CKV_GCP_43"
-        supported_resources = ["google_kms_crypto_key"]
-        categories = [CheckCategories.GENERAL_SECURITY]
+        supported_resources = ("google_kms_crypto_key",)
+        categories = (CheckCategories.GENERAL_SECURITY,)
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
     def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:
+        purpose = conf.get("purpose")
+        if purpose and isinstance(purpose, list) and purpose[0] in ASYMMETRIC_KEYS:
+            # https://cloud.google.com/kms/docs/key-rotation#asymmetric
+            # automatic key rotation is not supported for asymmetric keys
+            return CheckResult.UNKNOWN
+
         self.evaluated_keys = ["rotation_period"]
         rotation = conf.get("rotation_period")
         if rotation and rotation[0]:


Test patch:
diff --git a/tests/terraform/checks/resource/gcp/example_GoogleKMSRotationPeriod/main.tf b/tests/terraform/checks/resource/gcp/example_GoogleKMSRotationPeriod/main.tf
--- a/tests/terraform/checks/resource/gcp/example_GoogleKMSRotationPeriod/main.tf
+++ b/tests/terraform/checks/resource/gcp/example_GoogleKMSRotationPeriod/main.tf
@@ -24,3 +24,11 @@ resource "google_kms_crypto_key" "default" {
   name     = "crypto-key-example"
   key_ring = "google_kms_key_ring.keyring.id"
 }
+
+# unknown
+
+resource "google_kms_crypto_key" "asymmetric" {
+  name     = "crypto-key-example"
+  key_ring = "google_kms_key_ring.keyring.id"
+  purpose  = "ASYMMETRIC_SIGN"
+}
diff --git a/tests/terraform/checks/resource/gcp/test_GoogleKMSKeyRotationPeriod.py b/tests/terraform/checks/resource/gcp/test_GoogleKMSKeyRotationPeriod.py
--- a/tests/terraform/checks/resource/gcp/test_GoogleKMSKeyRotationPeriod.py
+++ b/tests/terraform/checks/resource/gcp/test_GoogleKMSKeyRotationPeriod.py
@@ -34,6 +34,7 @@ def test(self):
         self.assertEqual(summary["failed"], 2)
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)
+        self.assertEqual(summary["resource_count"], 5)  # 1 unknown
 
         self.assertEqual(passing_resources, passed_check_resources)
         self.assertEqual(failing_resources, failed_check_resources)