Repository: bridgecrewio/checkov

Issue:
CKV_GCP_26 is not working as expected when using terraform plan output.
**Describe the bug**
CKV_GCP_26 check is not providing expected output when it is ran against terraform output json file. Check is gives the result as PASSED even if we don't have the flow logs enabled for the subnet. However if we run it against the directory where we have the .tf files then the check returns the FAILED status which is expected. 

checkov version used: `2.0.236`
Terraform version used: `1.0.1`

**To Reproduce**
1. Create a sample subnet resource in a network.tf file. 
```
resource "google_compute_network" "vpc" {
  name                    = "test-vpc"
  auto_create_subnetworks = "false"
  routing_mode            = "REGIONAL"
}

resource "google_compute_subnetwork" "private-subnet" {
  name                     = "test-sub"
  ip_cidr_range            = "10.1.0.0/16"
  network                  = google_compute_network.vpc.self_link
  private_ip_google_access = true
}
```
2. terraform plan -out tf.plan
3. terraform show -json tf.plan  > tf.json 
4. checkov -f tf.json
5. Now run checkov -f network.tf

Both the commands will give conflicting results

```
Check: CKV_GCP_26: "Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network"
        PASSED for resource: google_compute_subnetwork.private-subnet
        File: /tf/tfplan.json:0-0
        Guide: https://docs.bridgecrew.io/docs/bc_gcp_logging_1
```
```
Check: CKV_GCP_26: "Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network"
        FAILED for resource: google_compute_subnetwork.private-subnet
        File: /network.tf:6-11
        Guide: https://docs.bridgecrew.io/docs/bc_gcp_logging_1

                6  | resource "google_compute_subnetwork" "private-subnet" {
                7  |   name                     = var.private_subnet_name
                8  |   ip_cidr_range            = var.private_subnet_cidr
                9  |   network                  = google_compute_network.vpc.self_link
                10 |   private_ip_google_access = true
                11 | }
```
**Expected behavior**
The check should return the status as FAILED when running it against terraform plan output json



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py b/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py
--- a/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py
+++ b/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py
@@ -1,21 +1,23 @@
-from checkov.common.models.enums import CheckCategories
+from typing import List, Any
+
 from checkov.common.models.consts import ANY_VALUE
+from checkov.common.models.enums import CheckCategories
 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
 
 
 class AKSApiServerAuthorizedIpRanges(BaseResourceValueCheck):
-    def __init__(self):
+    def __init__(self) -> None:
         name = "Ensure AKS has an API Server Authorized IP Ranges enabled"
         id = "CKV_AZURE_6"
-        supported_resources = ['azurerm_kubernetes_cluster']
-        categories = [CheckCategories.KUBERNETES]
+        supported_resources = ("azurerm_kubernetes_cluster",)
+        categories = (CheckCategories.KUBERNETES,)
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def get_inspected_key(self):
-        return 'api_server_authorized_ip_ranges/[0]'
+    def get_inspected_key(self) -> str:
+        return "api_server_authorized_ip_ranges/[0]"
 
-    def get_expected_value(self):
-        return ANY_VALUE
+    def get_expected_values(self) -> List[Any]:
+        return [ANY_VALUE]
 
 
 check = AKSApiServerAuthorizedIpRanges()
diff --git a/checkov/terraform/checks/resource/base_resource_value_check.py b/checkov/terraform/checks/resource/base_resource_value_check.py
--- a/checkov/terraform/checks/resource/base_resource_value_check.py
+++ b/checkov/terraform/checks/resource/base_resource_value_check.py
@@ -65,7 +65,7 @@ def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:
             value = dpath.get(conf, inspected_key)
             if isinstance(value, list) and len(value) == 1:
                 value = value[0]
-            if value is None:
+            if value is None or (isinstance(value, list) and not value):
                 return self.missing_block_result
             if ANY_VALUE in expected_values and value is not None and (not isinstance(value, str) or value):
                 # Key is found on the configuration - if it accepts any value, the check is PASSED
diff --git a/checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py b/checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py
--- a/checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py
+++ b/checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py
@@ -1,20 +1,30 @@
-from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
-from checkov.common.models.enums import CheckCategories
+from typing import Any, List, Dict
+
 from checkov.common.models.consts import ANY_VALUE
+from checkov.common.models.enums import CheckCategories, CheckResult
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
 
 
 class GoogleSubnetworkLoggingEnabled(BaseResourceValueCheck):
-    def __init__(self):
+    def __init__(self) -> None:
         name = "Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network"
         id = "CKV_GCP_26"
-        supported_resources = ['google_compute_subnetwork']
-        categories = [CheckCategories.LOGGING]
+        supported_resources = ("google_compute_subnetwork",)
+        categories = (CheckCategories.LOGGING,)
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def get_inspected_key(self):
-        return 'log_config'
+    def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:
+        # flow logs can't be enabled for `INTERNAL_HTTPS_LOAD_BALANCER` subnetworks
+        purpose = conf.get("purpose")
+        if purpose and purpose[0] == "INTERNAL_HTTPS_LOAD_BALANCER":
+            return CheckResult.UNKNOWN
+
+        return super().scan_resource_conf(conf)
+
+    def get_inspected_key(self) -> str:
+        return "log_config"
 
-    def get_expected_values(self):
+    def get_expected_values(self) -> List[Any]:
         return [ANY_VALUE]
 
 


Test patch:
diff --git a/tests/terraform/checks/resource/azure/example_AKSApiServerAuthorizedIpRanges/main.tf b/tests/terraform/checks/resource/azure/example_AKSApiServerAuthorizedIpRanges/main.tf
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/azure/example_AKSApiServerAuthorizedIpRanges/main.tf
@@ -0,0 +1,58 @@
+# pass
+
+resource "azurerm_kubernetes_cluster" "enabled" {
+  name                = "example"
+  location            = "azurerm_resource_group.example.location"
+  resource_group_name = "azurerm_resource_group.example.name"
+  dns_prefix          = "example"
+
+  default_node_pool {
+    name       = "default"
+    node_count = 1
+    vm_size    = "Standard_D2_v2"
+  }
+
+  identity {
+    type = "SystemAssigned"
+  }
+
+  api_server_authorized_ip_ranges = ["192.168.0.0/16"]
+}
+
+# fail
+
+resource "azurerm_kubernetes_cluster" "default" {
+  name                = "example"
+  location            = "azurerm_resource_group.example.location"
+  resource_group_name = "azurerm_resource_group.example.name"
+  dns_prefix          = "example"
+
+  default_node_pool {
+    name       = "default"
+    node_count = 1
+    vm_size    = "Standard_D2_v2"
+  }
+
+  identity {
+    type = "SystemAssigned"
+  }
+}
+
+resource "azurerm_kubernetes_cluster" "empty" {
+  name                = "example"
+  location            = "azurerm_resource_group.example.location"
+  resource_group_name = "azurerm_resource_group.example.name"
+  dns_prefix          = "example"
+
+  default_node_pool {
+    name       = "default"
+    node_count = 1
+    vm_size    = "Standard_D2_v2"
+  }
+
+  identity {
+    type = "SystemAssigned"
+  }
+
+  api_server_authorized_ip_ranges = []
+}
diff --git a/tests/terraform/checks/resource/azure/test_AKSApiServerAuthorizedIpRanges.py b/tests/terraform/checks/resource/azure/test_AKSApiServerAuthorizedIpRanges.py
--- a/tests/terraform/checks/resource/azure/test_AKSApiServerAuthorizedIpRanges.py
+++ b/tests/terraform/checks/resource/azure/test_AKSApiServerAuthorizedIpRanges.py
@@ -1,42 +1,42 @@
 import unittest
+from pathlib import Path
 
-from checkov.common.models.enums import CheckResult
+from checkov.runner_filter import RunnerFilter
 from checkov.terraform.checks.resource.azure.AKSApiServerAuthorizedIpRanges import check
+from checkov.terraform.runner import Runner
 
 
 class TestAKSApiServerAuthorizedIpRanges(unittest.TestCase):
+    def test(self):
+        # given
+        test_files_dir = Path(__file__).parent / "example_AKSApiServerAuthorizedIpRanges"
 
-    def test_failure(self):
-        resource_conf = {'name': ['example-aks1'], 'location': ['${azurerm_resource_group.example.location}'],
-                         'resource_group_name': ['${azurerm_resource_group.example.name}'], 'dns_prefix': ['exampleaks1'],
-                         'default_node_pool': [{'name': ['default'], 'node_count': [1], 'vm_size': ['Standard_D2_v2']}],
-                         'identity': [{'type': ['SystemAssigned']}], 'agent_pool_profile': [{}], 'service_principal': [{}],
-                         'role_based_access_control': [{'enabled': [False]}], 'tags': [{'Environment': 'Production'}]}
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.FAILED, scan_result)
-
-    def test_success(self):
-        resource_conf = {'name': ['example-aks1'], 'location': ['${azurerm_resource_group.example.location}'],
-                         'resource_group_name': ['${azurerm_resource_group.example.name}'], 'dns_prefix': ['exampleaks1'],
-                         'default_node_pool': [{'name': ['default'], 'node_count': [1], 'vm_size': ['Standard_D2_v2']}],
-                         'identity': [{'type': ['SystemAssigned']}], 'agent_pool_profile': [{}], 'service_principal': [{}],
-                         'api_server_authorized_ip_ranges': [['192.168.0.0/16']], 'tags': [{'Environment': 'Production'}],
-                         'addon_profile': [{'oms_agent': [{'enabled': [True], 'log_analytics_workspace_id': ['']}]}]}
-
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.PASSED, scan_result)
-
-    def test_success2(self):
-        resource_conf = {'name': ['example-aks1'], 'location': ['${azurerm_resource_group.example.location}'],
-                         'resource_group_name': ['${azurerm_resource_group.example.name}'], 'dns_prefix': ['exampleaks1'],
-                         'default_node_pool': [{'name': ['default'], 'node_count': [1], 'vm_size': ['Standard_D2_v2']}],
-                         'identity': [{'type': ['SystemAssigned']}], 'agent_pool_profile': [{}], 'service_principal': [{}],
-                         'api_server_authorized_ip_ranges': [[]], 'role_based_access_control': [{'enabled': [True]}],
-                         'tags': [{'Environment': 'Production'}]}
-
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.PASSED, scan_result)
-
-
-if __name__ == '__main__':
+        # when
+        report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id]))
+
+        # then
+        summary = report.get_summary()
+
+        passing_resources = {
+            "azurerm_kubernetes_cluster.enabled",
+        }
+
+        failing_resources = {
+            "azurerm_kubernetes_cluster.default",
+            "azurerm_kubernetes_cluster.empty",
+        }
+
+        passed_check_resources = {c.resource for c in report.passed_checks}
+        failed_check_resources = {c.resource for c in report.failed_checks}
+
+        self.assertEqual(summary["passed"], 1)
+        self.assertEqual(summary["failed"], 2)
+        self.assertEqual(summary["skipped"], 0)
+        self.assertEqual(summary["parsing_errors"], 0)
+
+        self.assertEqual(passing_resources, passed_check_resources)
+        self.assertEqual(failing_resources, failed_check_resources)
+
+
+if __name__ == "__main__":
     unittest.main()
diff --git a/tests/terraform/checks/resource/gcp/example_GoogleSubnetworkLoggingEnabled/main.tf b/tests/terraform/checks/resource/gcp/example_GoogleSubnetworkLoggingEnabled/main.tf
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/gcp/example_GoogleSubnetworkLoggingEnabled/main.tf
@@ -0,0 +1,32 @@
+# pass
+
+resource "google_compute_subnetwork" "enabled" {
+  name          = "example"
+  ip_cidr_range = "10.0.0.0/16"
+  network       = "google_compute_network.vpc.self_link"
+
+  log_config {
+    aggregation_interval = "INTERVAL_10_MIN"
+    flow_sampling        = 0.5
+    metadata             = "INCLUDE_ALL_METADATA"
+  }
+}
+
+# fail
+
+resource "google_compute_subnetwork" "default" {
+  name          = "example"
+  ip_cidr_range = "10.0.0.0/16"
+  network       = "google_compute_network.vpc.id"
+}
+
+# unknown
+
+resource "google_compute_subnetwork" "internal_https_lb" {
+  name          = "example"
+  ip_cidr_range = "10.0.0.0/22"
+  network       = "google_compute_network.vpc.id"
+
+  purpose       = "INTERNAL_HTTPS_LOAD_BALANCER"
+  role          = "ACTIVE"
+}
diff --git a/tests/terraform/checks/resource/gcp/test_GoogleSubnetworkLoggingEnabled.py b/tests/terraform/checks/resource/gcp/test_GoogleSubnetworkLoggingEnabled.py
--- a/tests/terraform/checks/resource/gcp/test_GoogleSubnetworkLoggingEnabled.py
+++ b/tests/terraform/checks/resource/gcp/test_GoogleSubnetworkLoggingEnabled.py
@@ -1,44 +1,42 @@
 import unittest
+from pathlib import Path
 
-import hcl2
-
-from checkov.common.models.enums import CheckResult
+from checkov.runner_filter import RunnerFilter
 from checkov.terraform.checks.resource.gcp.GoogleSubnetworkLoggingEnabled import check
+from checkov.terraform.runner import Runner
 
 
 class TestGoogleSubnetworkLoggingEnabled(unittest.TestCase):
+    def test(self):
+        # given
+        test_files_dir = Path(__file__).parent / "example_GoogleSubnetworkLoggingEnabled"
+
+        # when
+        report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id]))
 
-    def test_failure(self):
-        hcl_res = hcl2.loads("""
-        resource "google_compute_subnetwork" "without logging" {
-          name          = "log-test-subnetwork"
-          ip_cidr_range = "10.2.0.0/16"
-          region        = "us-central1"
-          network       = google_compute_network.custom-test.id
+        # then
+        summary = report.get_summary()
+
+        passing_resources = {
+            "google_compute_subnetwork.enabled",
         }
-        """)
-        resource_conf = hcl_res['resource'][0]['google_compute_subnetwork']['without logging']
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.FAILED, scan_result)
-
-    def test_success(self):
-        hcl_res = hcl2.loads("""
-        resource "google_compute_subnetwork" "with logging" {
-          name          = "log-test-subnetwork"
-          ip_cidr_range = "10.2.0.0/16"
-          region        = "us-central1"
-          network       = google_compute_network.custom-test.id
-        
-          log_config {
-            aggregation_interval = "INTERVAL_10_MIN"
-            flow_sampling        = 0.5
-            metadata             = "INCLUDE_ALL_METADATA"
-          }
+
+        failing_resources = {
+            "google_compute_subnetwork.default",
         }
-        """)
-        resource_conf = hcl_res['resource'][0]['google_compute_subnetwork']['with logging']
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.PASSED, scan_result)
 
-if __name__ == '__main__':
+        passed_check_resources = {c.resource for c in report.passed_checks}
+        failed_check_resources = {c.resource for c in report.failed_checks}
+
+        self.assertEqual(summary["passed"], 1)
+        self.assertEqual(summary["failed"], 1)
+        self.assertEqual(summary["skipped"], 0)
+        self.assertEqual(summary["parsing_errors"], 0)
+        self.assertEqual(summary["resource_count"], 3)  # 1 unknown
+
+        self.assertEqual(passing_resources, passed_check_resources)
+        self.assertEqual(failing_resources, failed_check_resources)
+
+
+if __name__ == "__main__":
     unittest.main()
diff --git a/tests/terraform/runner/test_plan_runner.py b/tests/terraform/runner/test_plan_runner.py
--- a/tests/terraform/runner/test_plan_runner.py
+++ b/tests/terraform/runner/test_plan_runner.py
@@ -163,7 +163,7 @@ def test_runner_root_dir(self):
         root_dir = current_dir + "/resources"
         runner = Runner()
         report = runner.run(
-            root_folder=root_dir, files=None, external_checks_dir=None, runner_filter=RunnerFilter(framework="all")
+            root_folder=root_dir, files=None, external_checks_dir=None, runner_filter=RunnerFilter(framework=["all"])
         )
         report_json = report.get_json()
         self.assertIsInstance(report_json, str)
@@ -172,8 +172,8 @@ def test_runner_root_dir(self):
         self.assertEqual(report.get_exit_code(soft_fail=False), 1)
         self.assertEqual(report.get_exit_code(soft_fail=True), 0)
 
-        self.assertGreaterEqual(report.get_summary()["failed"], 82)
-        self.assertGreaterEqual(report.get_summary()["passed"], 76)
+        self.assertGreaterEqual(report.get_summary()["failed"], 92)
+        self.assertGreaterEqual(report.get_summary()["passed"], 72)
 
         files_scanned = list(set(map(lambda rec: rec.file_path, report.failed_checks)))
         self.assertGreaterEqual(len(files_scanned), 6)