Repository: bridgecrewio/checkov

Issue:
Avoiding provisioning of Default VPC on AWS
**Why?**
It is recommended not to use the default VPC, and they can create extra trouble when we want to check if VPC flow logs are enabled as by default the default VPCs do not enable the flow logs. 

**How? **
As check would be about scanning terraform plan file, the recommended method would be deleting all default VPCs and running Checkov to fail any attempt to provision a default VPC

**Describe alternatives you've considered**
Not to write this feature, as not everyone may want to avoid, and want to use default VPCs on purpose (with different motivations)

**Additional context**
There are 2 challenges, 
1. Is it a good idea to avoid a resource being provisioned? Could it a bit more generic, i.e. reading from a config file. But then, is there a way of handling this. 
2. When/if we want to list/alert the flow logs not enabled, default vpc ones will be the first suspects. How can we handle them if we don't want to avoid/touch default vpcs?
New Check for avoiding new default_VPC
By submitting this pull request for the issue #1034 , I confirm that my contribution is made under the terms of the Apache 2.0 license.

The PR has: 
1. A new check, where avoid provisioning of an "aws_default_vpc" resource, with a number chk_aws_114, on NETWORKING category
2. A test associated with it. As whenever there is this resource is used, we should avoid it, there is no pass/success scenario written for this resource. I am happy to take any feedback on this. 
3. A new version number
4. Minor modifications on the documentation for contribution.


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/VPCDefaultNetwork.py b/checkov/terraform/checks/resource/aws/VPCDefaultNetwork.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/VPCDefaultNetwork.py
@@ -0,0 +1,23 @@
+from checkov.common.models.enums import CheckResult, CheckCategories
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+
+class VPCDefaultNetwork(BaseResourceCheck):
+    def __init__(self):
+        name = "Ensure no default VPC is planned to be provisioned"
+        id = "CKV_AWS_148"
+        supported_resources = ['aws_default_vpc']
+        categories = [CheckCategories.NETWORKING]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def scan_resource_conf(self, conf):
+        """
+            Checks if there is any attempt to create a default VPC configuration :
+            https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_vpc
+            :param conf: aws_default_vpc configuration
+            :return: <CheckResult>
+        """
+    
+        return CheckResult.FAILED
+check = VPCDefaultNetwork()
+
+


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_VPCDefaultNetwork.py b/tests/terraform/checks/resource/aws/test_VPCDefaultNetwork.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_VPCDefaultNetwork.py
@@ -0,0 +1,39 @@
+import unittest
+
+import hcl2
+
+from checkov.common.models.enums import CheckResult
+from checkov.terraform.checks.resource.aws.VPCDefaultNetwork import check
+
+
+class TestDefaultVPC(unittest.TestCase):
+
+    def test_failure(self):
+        """
+          When there is a resource with aws_default_vpc, it should fail whatever the config is.
+        """
+        hcl_res = hcl2.loads("""
+        resource "aws_default_vpc" "default" {
+            tags = {
+                Name = "Default VPC"
+            }
+        }
+        """)
+
+        resource_conf = hcl_res['resource'][0]['aws_default_vpc']['default']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_failure_config(self):
+        """
+        There is no success/pass scenario for this resource as we want to avoid the creation of this resource.
+        """
+        resource_conf = {
+            "enable_dns_support": "true"
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()