Repository: bridgecrewio/checkov

Issue:
Azure Container Registry - Dedicated data endpoint should be enabled
**Describe the issue**
It seems that there are no Checkov test to ensure that dedicated data endpoint are enabled.

**Examples**

````hcl
resource "azurerm_container_registry" "acr" {
  name                = "containerRegistry1"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  sku                 = "Premium"
  data_endpoint_enabled = true
}
````

**Version (please complete the following information):**
 - Current
 
**Additional context**

Azure Container Registry introduces dedicated data endpoints. The feature enables tightly scoped client firewall rules to specific registries, minimizing data exfiltration concerns. 

Dedicated data endpoints, help retrieve layers from the Azure Container Registry service, with fully qualified domain names representing the registry domain.

Source: https://learn.microsoft.com/en-us/azure/container-registry/container-registry-dedicated-data-endpoints


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/azure/ACRDedicatedDataEndpointEnabled.py b/checkov/terraform/checks/resource/azure/ACRDedicatedDataEndpointEnabled.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/azure/ACRDedicatedDataEndpointEnabled.py
@@ -0,0 +1,17 @@
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
+
+
+class ACRDedicatedDataEndpointEnabled(BaseResourceValueCheck):
+    def __init__(self) -> None:
+        name = "Ensure dedicated data endpoints are enabled."
+        id = "CKV_AZURE_237"
+        supported_resources = ("azurerm_container_registry",)
+        categories = (CheckCategories.GENERAL_SECURITY,)
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_inspected_key(self) -> str:
+        return "data_endpoint_enabled"
+
+
+check = ACRDedicatedDataEndpointEnabled()


Test patch:
diff --git a/tests/terraform/checks/resource/azure/example_ACRDedicatedDataEndpointEnabled/main.tf b/tests/terraform/checks/resource/azure/example_ACRDedicatedDataEndpointEnabled/main.tf
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/azure/example_ACRDedicatedDataEndpointEnabled/main.tf
@@ -0,0 +1,26 @@
+
+resource "azurerm_container_registry" "pass" {
+  name                      = "containerRegistry1"
+  resource_group_name       = azurerm_resource_group.rg.name
+  location                  = azurerm_resource_group.rg.location
+  sku                       = "Premium"
+  anonymous_pull_enabled    = false
+  data_endpoint_enabled = true
+}
+
+
+resource "azurerm_container_registry" "fail" {
+  name                = "containerRegistry1"
+  resource_group_name = azurerm_resource_group.rg.name
+  location            = azurerm_resource_group.rg.location
+  sku                 = "Premium"
+}
+
+
+resource "azurerm_container_registry" "fail2" {
+  name                      = "containerRegistry1"
+  resource_group_name       = azurerm_resource_group.rg.name
+  location                  = azurerm_resource_group.rg.location
+  sku                       = "Standard"
+  data_endpoint_enabled = false
+}
diff --git a/tests/terraform/checks/resource/azure/test_ACRDedicatedDataEndpointEnabled.py b/tests/terraform/checks/resource/azure/test_ACRDedicatedDataEndpointEnabled.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/azure/test_ACRDedicatedDataEndpointEnabled.py
@@ -0,0 +1,42 @@
+import os
+import unittest
+
+from checkov.runner_filter import RunnerFilter
+from checkov.terraform.runner import Runner
+from checkov.terraform.checks.resource.azure.ACRDedicatedDataEndpointEnabled import check
+
+
+class TestACRDedicatedDataEndpointEnabled(unittest.TestCase):
+
+    def test(self):
+        runner = Runner()
+        current_dir = os.path.dirname(os.path.realpath(__file__))
+
+        test_files_dir = os.path.join(current_dir, "example_ACRDedicatedDataEndpointEnabled")
+        report = runner.run(root_folder=test_files_dir,
+                            runner_filter=RunnerFilter(checks=[check.id]))
+        summary = report.get_summary()
+
+        passing_resources = {
+            'azurerm_container_registry.pass',
+        }
+        failing_resources = {
+            'azurerm_container_registry.fail',
+            'azurerm_container_registry.fail2'
+        }
+        skipped_resources = {}
+
+        passed_check_resources = set([c.resource for c in report.passed_checks])
+        failed_check_resources = set([c.resource for c in report.failed_checks])
+
+        self.assertEqual(summary['passed'], len(passing_resources))
+        self.assertEqual(summary['failed'], len(failing_resources))
+        self.assertEqual(summary['skipped'], len(skipped_resources))
+        self.assertEqual(summary['parsing_errors'], 0)
+
+        self.assertEqual(passing_resources, passed_check_resources)
+        self.assertEqual(failing_resources, failed_check_resources)
+
+
+if __name__ == '__main__':
+    unittest.main()
\ No newline at end of file