Repository: bridgecrewio/checkov

Issue:
GCP: GoogleCloudSqlDatabasePublicallyAccessible raises AttributeError
# Description

A SQL database instance declared like this crashes the check for publically-accessible instances:

```hcl
resource "google_sql_database_instance" "sql_instance" {
  name   = "${var.gcp-project}-db-dev"
  region = "${var.region}"
  settings {
    tier = "${var.db_machine_type}"
    ip_configuration {
                ipv4_enabled = true
                authorized_networks {
                name = "${var.gcp-project}-sql-network"
                value = google_compute_address.ip_address-dev.address
                }
  }
 }
}
```

## Crash Log

```
ERROR:checkov.terraform.checks.resource.gcp.GoogleCloudSqlDatabasePublicallyAccessible:Failed to run check: Ensure that Cloud SQL database Instances are not open to the world for configuration: {'name': ['${var.gcp-project}-db-dev'], 'region': ['us-central1'], 'settings': [{'tier': ['${var.db_machine_type}'], 'ip_configuration': [{'ipv4_enabled': [True], 'authorized_networks': [{'name': ['${var.gcp-project}-sql-network'], 'value': ['${google_compute_address.ip_address-dev.address}']}]}]}]} at file: /bcs/modules/aws/prod/cloud-sql.tf
```

<details>

```
Traceback (most recent call last):
  File "/usr/local/bin/checkov", line 5, in <module>
    run()
  File "/usr/local/lib/python3.8/site-packages/checkov/main.py", line 80, in run
    scan_reports = runner_registry.run(root_folder=root_folder, external_checks_dir=args.external_checks_dir,
  File "/usr/local/lib/python3.8/site-packages/checkov/common/runners/runner_registry.py", line 23, in run
    scan_report = runner.run(root_folder, external_checks_dir=external_checks_dir, files=files,
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 48, in run
    self.check_tf_definition(report, root_folder,runner_filter)
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 88, in check_tf_definition
    self.run_block(definition[block_type], definitions_context, full_file_path, report, scanned_file,
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 110, in run_block
    results = registry.scan(scanned_file, entity, skipped_checks,runner_filter)
  File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check_registry.py", line 64, in scan
    result = self.run_check(check, entity_configuration, entity_name, entity_type, scanned_file, skip_info)
  File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check_registry.py", line 70, in run_check
    result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,
  File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check.py", line 44, in run
    raise e
  File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check.py", line 33, in run
    check_result['result'] = self.scan_entity_conf(entity_configuration)
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/checks/resource/base_resource_check.py", line 20, in scan_entity_conf
    return self.scan_resource_conf(conf)
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/checks/resource/gcp/GoogleCloudSqlDatabasePublicallyAccessible.py", line 24, in scan_resource_conf
    if 'value' in authorized_network.keys():
AttributeError: 'str' object has no attribute 'keys'
```

</details>

## System Information

 - macOS 10.15.4
- Python 3.8.2
 - 1.0.308



Discussion:

Resolving patch:
diff --git a/checkov/kubernetes/parser/parser.py b/checkov/kubernetes/parser/parser.py
--- a/checkov/kubernetes/parser/parser.py
+++ b/checkov/kubernetes/parser/parser.py
@@ -20,10 +20,10 @@ def parse(filename):
         if filename.endswith(".json"):
             (template, template_lines) = k8_json.load(filename)
         if template:
-            if isinstance(template,list):
+            if isinstance(template, list):
                 for i in range(len(template)):
-                    if isinstance(template[i],dict):
-                        if (not 'apiVersion' in template[i].keys()) and (not 'kind' in template[i].keys()):
+                    if isinstance(template[i], dict):
+                        if not ('apiVersion' in template[i].keys() and 'kind' in template[i].keys()):
                             return
                     else:
                         return
diff --git a/checkov/terraform/checks/resource/gcp/GoogleCloudSqlDatabasePublicallyAccessible.py b/checkov/terraform/checks/resource/gcp/GoogleCloudSqlDatabasePublicallyAccessible.py
--- a/checkov/terraform/checks/resource/gcp/GoogleCloudSqlDatabasePublicallyAccessible.py
+++ b/checkov/terraform/checks/resource/gcp/GoogleCloudSqlDatabasePublicallyAccessible.py
@@ -21,6 +21,8 @@ def scan_resource_conf(self, conf):
             if 'authorized_networks' in conf['settings'][0]['ip_configuration'][0].keys():
                 authorized_networks_count = len(conf['settings'][0]['ip_configuration'][0]['authorized_networks'][0])
                 for authorized_network in conf['settings'][0]['ip_configuration'][0]['authorized_networks'][0]:
+                    if isinstance(authorized_network, str):
+                        return CheckResult.UNKNOWN
                     if 'value' in authorized_network.keys():
                         if "/0" not in authorized_network['value']:
                             authorized_networks_passed += 1
@@ -30,4 +32,5 @@ def scan_resource_conf(self, conf):
         else: 
             return CheckResult.FAILED
 
+
 check = GoogleCloudSqlDatabasePublicallyAccessible()


Test patch:
diff --git a/tests/terraform/checks/resource/gcp/test_GoogleCloudSqlDatabasePublicallyAccessible.py b/tests/terraform/checks/resource/gcp/test_GoogleCloudSqlDatabasePublicallyAccessible.py
--- a/tests/terraform/checks/resource/gcp/test_GoogleCloudSqlDatabasePublicallyAccessible.py
+++ b/tests/terraform/checks/resource/gcp/test_GoogleCloudSqlDatabasePublicallyAccessible.py
@@ -1,4 +1,5 @@
 import unittest
+import hcl2
 
 from checkov.terraform.checks.resource.gcp.GoogleCloudSqlDatabasePublicallyAccessible import check
 from checkov.common.models.enums import CheckResult
@@ -16,6 +17,26 @@ def test_success(self):
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.PASSED, scan_result)
 
+    def test_unknown(self):
+            hcl_parsed = hcl2.loads("""
+    resource "google_sql_database_instance" "sql_instance" {
+      name   = "${var.gcp-project}-db-dev"
+      region = "${var.region}"
+      settings {
+        tier = "${var.db_machine_type}"
+        ip_configuration {
+                    ipv4_enabled = true
+                    authorized_networks {
+                    name = "${var.gcp-project}-sql-network"
+                    value = google_compute_address.ip_address-dev.address
+                    }
+      }
+     }
+    }""")
+            resource_conf = hcl_parsed['resource'][0]['google_sql_database_instance']['sql_instance']
+            scan_result = check.scan_resource_conf(conf=resource_conf)
+            self.assertEqual(CheckResult.UNKNOWN, scan_result)
+
 
 if __name__ == '__main__':
     unittest.main()