Repository: bridgecrewio/checkov

Issue:
CKV_AZURE_12: Retention policy of 0 is not supported
**Describe the bug**
When setting the `retention_period.days` value on `azurerm_network_watcher_flow_log` to `0`, `CKV_AZURE_12` still fails. `0` is the value to signify indefinite/forever retention.

**To Reproduce**
Steps to reproduce the behavior:
1. Create an `azurerm_network_watcher_flow_log` resource
2. Set
```
  retention_policy {
    enabled = true
    days    = 0
  }
```
3. Run `checkov`
4. Receive failure for `CKV_AZURE_12`

**Expected behavior**
`0` is an accepted value as documented at https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview#how-logging-works

**Desktop (please complete the following information):**
 - OS: Linux
 - Checkov Version: 2.0.26


**Additional context**
At https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/azure/NetworkWatcherFlowLogPeriod.py#L17 likely need to adjust the innermost `if` statement to something like:

```python
if retention_in_days is not None and (retention_days == 0 or retention_days >= 90):
```

Happy to open a pull request if this is an acceptable solution.


Discussion:
That would be a very welcome contribution @kylelaker !

Resolving patch:
diff --git a/checkov/terraform/checks/resource/azure/NetworkWatcherFlowLogPeriod.py b/checkov/terraform/checks/resource/azure/NetworkWatcherFlowLogPeriod.py
--- a/checkov/terraform/checks/resource/azure/NetworkWatcherFlowLogPeriod.py
+++ b/checkov/terraform/checks/resource/azure/NetworkWatcherFlowLogPeriod.py
@@ -16,7 +16,7 @@ def scan_resource_conf(self, conf):
             retention_block = conf['retention_policy'][0]
             if retention_block['enabled'][0]:
                 retention_in_days = force_int(retention_block['days'][0])
-                if retention_in_days and retention_in_days >= 90:
+                if retention_in_days is not None and (retention_in_days == 0 or retention_in_days >= 90):
                     return CheckResult.PASSED
         return CheckResult.FAILED
 


Test patch:
diff --git a/tests/terraform/checks/resource/azure/test_NetworkWatcherFlowLogPeriod.py b/tests/terraform/checks/resource/azure/test_NetworkWatcherFlowLogPeriod.py
--- a/tests/terraform/checks/resource/azure/test_NetworkWatcherFlowLogPeriod.py
+++ b/tests/terraform/checks/resource/azure/test_NetworkWatcherFlowLogPeriod.py
@@ -28,6 +28,26 @@ def test_failure(self):
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
+    def test_failure_invalid_days_string(self):
+        hcl_res = hcl2.loads("""
+            resource "azurerm_network_watcher_flow_log" "test" {
+              network_watcher_name = azurerm_network_watcher.test.name
+              resource_group_name  = azurerm_resource_group.test.name
+              network_security_group_id = azurerm_network_security_group.test.id
+              storage_account_id        = azurerm_storage_account.test.id
+              enabled                   = true
+            
+              retention_policy {
+                enabled = true
+                days = var.watcher_flow_logs.days
+              }
+              }
+
+                """)
+        resource_conf = hcl_res['resource'][0]['azurerm_network_watcher_flow_log']['test']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
     def test_success(self):
         hcl_res = hcl2.loads("""
             resource "azurerm_network_watcher_flow_log" "test" {
@@ -48,6 +68,46 @@ def test_success(self):
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.PASSED, scan_result)
 
+    def test_success_with_0_days(self):
+        hcl_res = hcl2.loads("""
+            resource "azurerm_network_watcher_flow_log" "test" {
+              network_watcher_name = azurerm_network_watcher.test.name
+              resource_group_name  = azurerm_resource_group.test.name
+              network_security_group_id = azurerm_network_security_group.test.id
+              storage_account_id        = azurerm_storage_account.test.id
+              enabled                   = true
+            
+              retention_policy {
+                enabled = true
+                days    = 0
+              }
+              }
+
+                """)
+        resource_conf = hcl_res['resource'][0]['azurerm_network_watcher_flow_log']['test']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_success_with_valid_day_string(self):
+        hcl_res = hcl2.loads("""
+            resource "azurerm_network_watcher_flow_log" "test" {
+              network_watcher_name = azurerm_network_watcher.test.name
+              resource_group_name  = azurerm_resource_group.test.name
+              network_security_group_id = azurerm_network_security_group.test.id
+              storage_account_id        = azurerm_storage_account.test.id
+              enabled                   = true
+            
+              retention_policy {
+                enabled = true
+                days    = "100"
+              }
+              }
+
+                """)
+        resource_conf = hcl_res['resource'][0]['azurerm_network_watcher_flow_log']['test']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
 
 if __name__ == '__main__':
     unittest.main()