Repository: bridgecrewio/checkov

Issue:
Checkov v2.3.261 fails with CKV_AWS_356 for KMS actions which must specify 'all resources'
**Describe the issue**
Checkov v2.3.261 fails with CKV_AWS_356 highlights IAM policies which are overly permissive but is incorrectly identifying actions for KMS policies which need to be for all resources potentially scoped with conditional access per https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-services.html

Similar issue for https://github.com/bridgecrewio/checkov/issues/5134 where certain actions like 'list' require all resources.

**Examples**
```
data "aws_iam_policy_document" "myKmsKey" {
    actions = [
      "kms:GenerateDataKey",
      "kms:Decrypt"
    ]
    resources = [
      "*"
    ]

    condition {
      test     = "ArnEquals"
      variable = "aws:SourceArn"
      values = [
        <SOME OTHER RESOURCE>.arn
      ]
    }
  }
}
```
**Version (please complete the following information):**
 - Checkov Version 2.3.261



Discussion:
hey @aidenvaines-bjss thanks for reaching out.

I think my fix, which was released today with version `2.3.263` should also handle your case, feel free to give it a try.
Sadly, still seeing the issue with 2.3.263 and 2.3.264 I am still seeing the issue

Assuming that fix is https://github.com/bridgecrewio/checkov/pull/5135 it looks like KMS isn't covered
thanks for verifying, it looks like we don't consider the `condition` block correctly. Actually we don't parse it correctly, so it becomes empty.

Resolving patch:
diff --git a/checkov/terraform/checks/utils/iam_terraform_document_to_policy_converter.py b/checkov/terraform/checks/utils/iam_terraform_document_to_policy_converter.py
--- a/checkov/terraform/checks/utils/iam_terraform_document_to_policy_converter.py
+++ b/checkov/terraform/checks/utils/iam_terraform_document_to_policy_converter.py
@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 from typing import Dict, List, Any
 
 from checkov.common.util.data_structures_utils import pickle_deepcopy
@@ -23,4 +25,13 @@ def convert_terraform_conf_to_iam_policy(conf: Dict[str, List[Dict[str, Any]]])
                 statement["Effect"] = statement.pop("effect")[0]
             if "effect" not in statement and "Effect" not in statement:
                 statement["Effect"] = "Allow"
+            if "condition" in statement:
+                conditions = statement.pop("condition")
+                if conditions and isinstance(conditions, list):
+                    statement["Condition"] = {}
+                    for condition in conditions:
+                        cond_operator = condition["test"][0]
+                        cond_key = condition["variable"][0]
+                        cond_value = condition["values"][0]
+                        statement["Condition"].setdefault(cond_operator, {})[cond_key] = cond_value
     return result


Test patch:
diff --git a/tests/terraform/checks/data/aws/example_ResourcePolicyDocument/main.tf b/tests/terraform/checks/data/aws/example_ResourcePolicyDocument/main.tf
--- a/tests/terraform/checks/data/aws/example_ResourcePolicyDocument/main.tf
+++ b/tests/terraform/checks/data/aws/example_ResourcePolicyDocument/main.tf
@@ -86,3 +86,23 @@ data "aws_iam_policy_document" "pass_unrestrictable" {
     ]
   }
 }
+
+data "aws_iam_policy_document" "pass_condition" {
+  statement {
+    actions = [
+      "kms:GenerateDataKey",
+      "kms:Decrypt"
+    ]
+    resources = [
+      "*"
+    ]
+
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      values   = [
+        "arn"
+      ]
+    }
+  }
+}
diff --git a/tests/terraform/checks/data/aws/test_ResourcePolicyDocument.py b/tests/terraform/checks/data/aws/test_ResourcePolicyDocument.py
--- a/tests/terraform/checks/data/aws/test_ResourcePolicyDocument.py
+++ b/tests/terraform/checks/data/aws/test_ResourcePolicyDocument.py
@@ -17,6 +17,7 @@ def test(self):
             "aws_iam_policy_document.pass",
             "aws_iam_policy_document.pass2",
             "aws_iam_policy_document.pass_unrestrictable",
+            "aws_iam_policy_document.pass_condition",
         }
         failing_resources = {
             "aws_iam_policy_document.fail",
diff --git a/tests/terraform/util/test_iam_converter.py b/tests/terraform/util/test_iam_converter.py
--- a/tests/terraform/util/test_iam_converter.py
+++ b/tests/terraform/util/test_iam_converter.py
@@ -1,19 +1,79 @@
 import unittest
 
-from checkov.terraform.checks.utils.iam_terraform_document_to_policy_converter import \
-    convert_terraform_conf_to_iam_policy
+from checkov.terraform.checks.utils.iam_terraform_document_to_policy_converter import (
+    convert_terraform_conf_to_iam_policy,
+)
 
 
 class TestIAMConverter(unittest.TestCase):
-
     def test_iam_converter(self):
         conf = {'version': ['2012-10-17'], 'statement': [{'actions': [['*']], 'resources': [['*']]}]}
         expected_result = {'version': ['2012-10-17'], 'Statement': [{'Action': ['*'], 'Resource': ['*'], 'Effect': 'Allow'}]}
         result = convert_terraform_conf_to_iam_policy(conf)
-        self.assertDictEqual(result,expected_result)
-        self.assertNotEqual(result,conf)
+        self.assertDictEqual(result, expected_result)
+        self.assertNotEqual(result, conf)
+
+    def test_convert_condition(self):
+        # given
+        conf = {
+            "__end_line__": 77,
+            "__start_line__": 42,
+            "statement": [
+                {
+                    "actions": [["kms:Decrypt", "kms:GenerateDataKey"]],
+                    "condition": [
+                        {
+                            "test": ["ForAnyValue:StringEquals"],
+                            "values": [["pi"]],
+                            "variable": ["kms:EncryptionContext:service"],
+                        },
+                        {
+                            "test": ["ForAnyValue:StringEquals"],
+                            "values": [["rds"]],
+                            "variable": ["kms:EncryptionContext:aws:pi:service"],
+                        },
+                        {
+                            "test": ["ForAnyValue:StringEquals"],
+                            "values": [["db-AAAAABBBBBCCCCCDDDDDEEEEE", "db-EEEEEDDDDDCCCCCBBBBBAAAAA"]],
+                            "variable": ["kms:EncryptionContext:aws:rds:db-id"],
+                        },
+                        {"test": ["ArnEquals"], "values": [["arn"]], "variable": ["aws:SourceArn"]},
+                    ],
+                    "resources": [["*"]],
+                }
+            ],
+            "__address__": "aws_iam_policy_document.example_multiple_condition_keys_and_values",
+        }
+
+        result = convert_terraform_conf_to_iam_policy(conf)
 
+        self.assertDictEqual(
+            result,
+            {
+                "__end_line__": 77,
+                "__start_line__": 42,
+                "__address__": "aws_iam_policy_document.example_multiple_condition_keys_and_values",
+                "Statement": [
+                    {
+                        "Action": ["kms:Decrypt", "kms:GenerateDataKey"],
+                        "Resource": ["*"],
+                        "Effect": "Allow",
+                        "Condition": {
+                            "ForAnyValue:StringEquals": {
+                                "kms:EncryptionContext:service": ["pi"],
+                                "kms:EncryptionContext:aws:pi:service": ["rds"],
+                                "kms:EncryptionContext:aws:rds:db-id": [
+                                    "db-AAAAABBBBBCCCCCDDDDDEEEEE",
+                                    "db-EEEEEDDDDDCCCCCBBBBBAAAAA",
+                                ],
+                            },
+                            "ArnEquals": {"aws:SourceArn": ["arn"]},
+                        },
+                    }
+                ],
+            },
+        )
 
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     unittest.main()