Repository: bridgecrewio/checkov

Issue:
check CKV_SECRET_6 fails even when suppressed
**Describe the bug**
Checkov raises FAILED check CKV_SECRET_6 when running against a project even if the check is suppressed. However if running checkov on a single terraform file it doesn't flag the same error.

**To Reproduce**
Steps to reproduce the behaviour:
1. Create a single terraform file and save in under a new dir (test/main.tf) with a resource would fail this check but make a comment so checkov suppresses the alert:
```
resource "aws_emr_cluster" "cluster" {
  #checkov:skip=CKV_SECRET_6:todo
  #checkov:skip=CKV2_AWS_7:todo
  name          = "emr"
  termination_protection = true
  ebs_root_volume_size = 10
  service_role = "emr_role"
  master_instance_fleet {
    name = "emr-leader"
    target_on_demand_capacity = 1
    instance_type_configs {
      instance_type = var.emr_leader_instance_type

      ebs_config {
        size = "64"
        type = "gp2"
        volumes_per_instance = 1
      }
      configurations {
        classification = "spark-defaults"
        properties = {
          "spark.cassandra.connection.host" = "cassandra.domain.co.uk",
          "spark.cassandra.connection.port" = "9999",
          "spark.cassandra.auth.username" = "user123",
          "spark.cassandra.auth.password" = "pass123", #checkov:skip=CKV_SECRET_6:todo
        }
      }
    }
  }
}
```
2. Run cli command  `checkov -f test/main.tf`
3. Observe result behaves as expected:
```
...
 secrets scan results:

Passed checks: 0, Failed checks: 0, Skipped checks: 1

Check: CKV_SECRET_6: "Base64 High Entropy String"
	SKIPPED for resource: d34df506cfa43c623b4da8853ce91637ed575be6
	Suppress comment: checkov:skip=
	File: /test/main.tf:29-30
	Guide: https://docs.bridgecrew.io/docs/git_secrets_6
```
4. Run cli command `checkov --directory test/`
5. Observe the same test fail:
```
...
secrets scan results:

Passed checks: 0, Failed checks: 1, Skipped checks: 0

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: d34df506cfa43c623b4da8853ce91637ed575be6
	File: /main.tf:29-30
	Guide: https://docs.bridgecrew.io/docs/git_secrets_6

		29 |
```

**Expected behaviour**
There is no terraform code difference, checkov should behave the same way in both tests, it should show SKIPPED for CKV_SECRET_6.

**Desktop (please complete the following information):**
 - Terraform 1.0.1
 - Checkov Version 2.0.259

**Additional context**
I have not been able to observe if this behaviour is unique to check CKV_SECRET_6 or not. But it's the first time I have observed a suppressed check still show as failure.



Discussion:
super interesting, it works when you are in the folder and do the check like
```shell
checkov -d .
```
but it fails, when doing it from the parent folder, like you did it.
And an other observation, using an absolute path works also. So, it means it is a problem with relative paths!

Resolving patch:
diff --git a/checkov/secrets/runner.py b/checkov/secrets/runner.py
--- a/checkov/secrets/runner.py
+++ b/checkov/secrets/runner.py
@@ -8,6 +8,7 @@
 from detect_secrets import SecretsCollection
 from detect_secrets.core.potential_secret import PotentialSecret
 from detect_secrets.settings import transient_settings
+from typing_extensions import TypedDict
 
 from checkov.common.comment.enum import COMMENT_REGEX
 from checkov.common.graph.graph_builder.utils import run_function_multithreaded
@@ -46,6 +47,11 @@
 PROHIBITED_FILES = ['Pipfile.lock', 'yarn.lock', 'package-lock.json', 'requirements.txt']
 
 
+class _CheckResult(TypedDict, total=False):
+    result: CheckResult
+    suppress_comment: str
+
+
 class Runner(BaseRunner):
     check_type = 'secrets'
 
@@ -138,12 +144,15 @@ def _scan_file(file_paths: List[str]):
                     continue
                 if runner_filter.checks and check_id not in runner_filter.checks:
                     continue
-                result = {'result': CheckResult.FAILED}
-                line_text = linecache.getline(secret.filename,secret.line_number)
+                result: _CheckResult = {'result': CheckResult.FAILED}
+                line_text = linecache.getline(secret.filename, secret.line_number)
                 if line_text != "" and line_text.split()[0] == 'git_commit':
                     continue
-                result = self.search_for_suppression(check_id, secret, runner_filter.skip_checks,
-                                                     CHECK_ID_TO_SECRET_TYPE) or result
+                result = self.search_for_suppression(
+                    check_id=check_id,
+                    secret=secret,
+                    skipped_checks=runner_filter.skip_checks,
+                ) or result
                 report.add_record(Record(
                     check_id=check_id,
                     check_name=secret.type,
@@ -160,17 +169,23 @@ def _scan_file(file_paths: List[str]):
             return report
 
     @staticmethod
-    def search_for_suppression(check_id: str, secret: PotentialSecret, skipped_checks: list,
-                               CHECK_ID_TO_SECRET_TYPE: dict) -> Optional[dict]:
-        if skipped_checks:
-            for skipped_check in skipped_checks:
-                if skipped_check == check_id and skipped_check in CHECK_ID_TO_SECRET_TYPE:
-                    return {'result': CheckResult.SKIPPED,
-                            'suppress_comment': f"Secret scan {skipped_check} is skipped"}
+    def search_for_suppression(
+        check_id: str,
+        secret: PotentialSecret,
+        skipped_checks: List[str]
+    ) -> Optional[_CheckResult]:
+        if check_id in skipped_checks and check_id in CHECK_ID_TO_SECRET_TYPE.keys():
+            return {
+                "result": CheckResult.SKIPPED,
+                "suppress_comment": f"Secret scan {check_id} is skipped"
+            }
         # Check for suppression comment in the line before, the line of, and the line after the secret
         for line_number in [secret.line_number, secret.line_number - 1, secret.line_number + 1]:
             lt = linecache.getline(secret.filename, line_number)
             skip_search = re.search(COMMENT_REGEX, lt)
-            if skip_search:
-                return {'result': CheckResult.SKIPPED, 'suppress_comment': skip_search[1]}
+            if skip_search and skip_search.group(2) == check_id:
+                return {
+                    "result": CheckResult.SKIPPED,
+                    "suppress_comment": skip_search.group(3)[1:] if skip_search.group(3) else "No comment provided"
+                }
         return None


Test patch:
diff --git a/tests/secrets/resources/terraform_skip/main.tf b/tests/secrets/resources/terraform_skip/main.tf
new file mode 100644
--- /dev/null
+++ b/tests/secrets/resources/terraform_skip/main.tf
@@ -0,0 +1,33 @@
+resource "aws_lambda_function" "skip" {
+  filename      = "lambda_function_payload.zip"
+  function_name = "lambda_function_name"
+  role          = aws_iam_role.iam_for_lambda.arn
+  handler       = "exports.test"
+
+  source_code_hash = filebase64sha256("lambda_function_payload.zip")
+  runtime = "nodejs12.x"
+
+  environment {
+    variables = {
+      access_key = "AKIAIOSFODNN7EXAMPLE" #checkov:skip=CKV_SECRET_2:example
+      secret_key = ""
+    }
+  }
+}
+
+resource "aws_lambda_function" "wrong_skip" {
+  filename      = "lambda_function_payload.zip"
+  function_name = "lambda_function_name"
+  role          = aws_iam_role.iam_for_lambda.arn
+  handler       = "exports.test"
+
+  source_code_hash = filebase64sha256("lambda_function_payload.zip")
+  runtime = "nodejs12.x"
+
+  environment {
+    variables = {
+      access_key = "AKIAIOS3F6KN7EXAMPLE" #checkov:skip=CKV_SECRET_5:wrong check id
+      secret_key = ""
+    }
+  }
+}
diff --git a/tests/secrets/test_runner.py b/tests/secrets/test_runner.py
--- a/tests/secrets/test_runner.py
+++ b/tests/secrets/test_runner.py
@@ -1,6 +1,7 @@
 import unittest
 
 import os
+from pathlib import Path
 
 from checkov.secrets.runner import Runner
 from checkov.runner_filter import RunnerFilter
@@ -44,6 +45,22 @@ def test_runner_tf_failing_check(self):
         self.assertEqual(report.skipped_checks, [])
         report.print_console()
 
+    def test_runner_tf_skip_check(self):
+        valid_dir_path = Path(__file__).parent / "resources/terraform_skip"
+
+        report = Runner().run(
+            root_folder=valid_dir_path,
+            external_checks_dir=None,
+            runner_filter=RunnerFilter(framework='secrets')
+        )
+
+        self.assertEqual(len(report.skipped_checks), 1)
+        self.assertEqual(report.parsing_errors, [])
+        self.assertEqual(report.passed_checks, [])
+        self.assertEqual(len(report.skipped_checks), 1)
+
+        report.print_console()
+
     def test_runner_skip_check(self):
         current_dir = os.path.dirname(os.path.realpath(__file__))
         valid_dir_path = current_dir + "/resources/cfn"
@@ -60,10 +77,10 @@ def test_runner_multiple_files(self):
         runner = Runner()
         report = runner.run(root_folder=valid_dir_path, external_checks_dir=None,
                             runner_filter=RunnerFilter(framework='secrets'))
-        self.assertEqual(4, len(report.failed_checks))
+        self.assertEqual(5, len(report.failed_checks))
         self.assertEqual(report.parsing_errors, [])
         self.assertEqual(report.passed_checks, [])
-        self.assertEqual(report.skipped_checks, [])
+        self.assertEqual(len(report.skipped_checks), 1)
 
 if __name__ == '__main__':
     unittest.main()