Repository: bridgecrewio/checkov

Issue:
CloudFormation EC2Credentials.py does evaluate if the UserData is base64 encoded
**Describe the issue**
The check EC2Credentials.py which checks the UserData of a CloudFormation template against secrets does not work if the userdata are already encoded in base64. 
The check is not returning the correct result and the processing time is very slow.

**Examples**
```yaml
AWSTemplateFormatVersion: "2010-09-09"
Resources:
  Resource0:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-04169656fea786776
      UserData: IyEgL2Jpbi9iYXNoCnN1ZG8gYXB0LWdldCB1cGRhdGUKc3VkbyBhcHQtZ2V0IGluc3RhbGwgLXkgYXBhY2hlMgpzdWRvIHN5c3RlbWN0bCBzdGFydCBhcGFjaGUyCnN1ZG8gc3lzdGVtY3RsIGVuYWJsZSBhcGFjaGUyCmV4cG9ydCBBV1NfQUNDRVNTX0tFWV9JRApleHBvcnQgQVdTX0FDQ0VTU19LRVlfSUQ9QUtJQUlPU0ZPRE5ON0VYQU1QTEUKZXhwb3J0IEFXU19TRUNSRVRfQUNDRVNTX0tFWT13SmFsclhVdG5GRU1JL0s3TURFTkcvYlB4UmZpQ1lFWEFNUExFS0VZCmV4cG9ydCBBV1NfREVGQVVMVF9SRUdJT049dXMtd2VzdC0yCmVjaG8gIjxoMT5EZXBsb3llZCB2aWEgVGVycmFmb3JtPC9oMT4iIHwgc3VkbyB0ZWUgL3Zhci93d3cvaHRtbC9pbmRleC5odG1s

```

**Version (please complete the following information):**
 - Checkov Version [e.g. 22]
 - >2.0.0

**Additional context**
Fix implemented here by trying to decode the base64 string.
https://github.com/j2clerck/checkov/commit/af9abd724520ec21ec5510dfc5db2ef83fd9e6dc



Discussion:

Resolving patch:
diff --git a/checkov/cloudformation/checks/resource/aws/EC2Credentials.py b/checkov/cloudformation/checks/resource/aws/EC2Credentials.py
--- a/checkov/cloudformation/checks/resource/aws/EC2Credentials.py
+++ b/checkov/cloudformation/checks/resource/aws/EC2Credentials.py
@@ -1,4 +1,5 @@
 from typing import List
+from base64 import b64decode
 
 from checkov.common.models.enums import CheckResult, CheckCategories
 from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck
@@ -17,9 +18,15 @@ def scan_resource_conf(self, conf):
         if 'Properties' in conf.keys():
             if 'UserData' in conf['Properties'].keys():
                 user_data = conf['Properties']['UserData']
-                # Cast to string as user data object can look slightly different depending
-                # on Yaml or JSON CF Templates and how the B64 conversion is done.
-                user_data_str = str(user_data)
+                # In some case, the UserData might be a base64 encoded string which will slow down (3 minutes)
+                # the get_secrets_from_string function.
+                try:
+                    user_data_str = b64decode(user_data).decode()
+                except Exception:
+                    # Cast to string as user data object can look slightly different depending
+                    # on Yaml or JSON CF Templates and how the B64 conversion is done.
+                    user_data_str = str(user_data)
+
                 if isinstance(user_data_str, str):
                     secrets = get_secrets_from_string(str(user_data_str))
                     if secrets:


Test patch:
diff --git a/tests/cloudformation/checks/resource/aws/example_EC2Credentials/EC2Credentials-FAILED_B64encoded.yaml b/tests/cloudformation/checks/resource/aws/example_EC2Credentials/EC2Credentials-FAILED_B64encoded.yaml
new file mode 100644
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_EC2Credentials/EC2Credentials-FAILED_B64encoded.yaml
@@ -0,0 +1,7 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Resources:
+  Resource0:
+    Type: AWS::EC2::Instance
+    Properties:
+      ImageId: ami-04169656fea786776
+      UserData: IyEgL2Jpbi9iYXNoCnN1ZG8gYXB0LWdldCB1cGRhdGUKc3VkbyBhcHQtZ2V0IGluc3RhbGwgLXkgYXBhY2hlMgpzdWRvIHN5c3RlbWN0bCBzdGFydCBhcGFjaGUyCnN1ZG8gc3lzdGVtY3RsIGVuYWJsZSBhcGFjaGUyCmV4cG9ydCBBV1NfQUNDRVNTX0tFWV9JRApleHBvcnQgQVdTX0FDQ0VTU19LRVlfSUQ9QUtJQUlPU0ZPRE5ON0VYQU1QTEUKZXhwb3J0IEFXU19TRUNSRVRfQUNDRVNTX0tFWT13SmFsclhVdG5GRU1JL0s3TURFTkcvYlB4UmZpQ1lFWEFNUExFS0VZCmV4cG9ydCBBV1NfREVGQVVMVF9SRUdJT049dXMtd2VzdC0yCmVjaG8gIjxoMT5EZXBsb3llZCB2aWEgVGVycmFmb3JtPC9oMT4iIHwgc3VkbyB0ZWUgL3Zhci93d3cvaHRtbC9pbmRleC5odG1s
diff --git a/tests/cloudformation/checks/resource/aws/test_EC2Credentials.py b/tests/cloudformation/checks/resource/aws/test_EC2Credentials.py
--- a/tests/cloudformation/checks/resource/aws/test_EC2Credentials.py
+++ b/tests/cloudformation/checks/resource/aws/test_EC2Credentials.py
@@ -17,7 +17,7 @@ def test_summary(self):
         summary = report.get_summary()
 
         self.assertEqual(summary['passed'], 2)
-        self.assertEqual(summary['failed'], 1)
+        self.assertEqual(summary['failed'], 2)
         self.assertEqual(summary['skipped'], 0)
         self.assertEqual(summary['parsing_errors'], 0)