Repository: bridgecrewio/checkov

Issue:
`CKV_AZURE_4` cannot work with AzureRM 3.0 provider
**Describe the issue**

Scan an aks resource with AzrueRM 3.0 provider will get the following false error:

```text
terraform scan results:

Passed checks: 0, Failed checks: 1, Skipped checks: 0

Check: CKV_AZURE_4: "Ensure AKS logging to Azure Monitoring is Configured"
        FAILED for resource: azurerm_kubernetes_cluster.example
        File: /main.tf:35-58
        Guide: https://docs.bridgecrew.io/docs/bc_azr_kubernetes_1

                35 | resource "azurerm_kubernetes_cluster" "example" {
                36 |   name                = "example-aks1"
                37 |   location            = azurerm_resource_group.example.location
                38 |   resource_group_name = azurerm_resource_group.example.name
                39 |   dns_prefix          = "exampleaks1"
                40 |
                41 |   default_node_pool {
                42 |     name       = "default"
                43 |     node_count = 1
                44 |     vm_size    = "Standard_D2_v2"
                45 |   }
                46 |
                47 |   oms_agent {
                48 |     log_analytics_workspace_id = azurerm_log_analytics_workspace.main.id
                49 |   }
                50 |
                51 |   identity {
                52 |     type = "SystemAssigned"
                53 |   }
                54 |
                55 |   tags = {
                56 |     Environment = "Production"
                57 |   }
                58 | }
```

**Examples**
```hcl
variable "admin_user" {
  default = null
}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "example" {
  location = "eastus"
  name     = "checkov-dynamic"
}

resource "azurerm_log_analytics_workspace" "main" {
  name                = "workspace"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "PerGB2018"
  retention_in_days   = 7
}

resource "azurerm_log_analytics_solution" "main" {
  solution_name         = "ContainerInsights"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  workspace_resource_id = azurerm_log_analytics_workspace.main[0].id
  workspace_name        = azurerm_log_analytics_workspace.main[0].name

  plan {
    publisher = "Microsoft"
    product   = "OMSGallery/ContainerInsights"
  }
}

resource "azurerm_kubernetes_cluster" "example" {
  name                = "example-aks1"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  dns_prefix          = "exampleaks1"

  default_node_pool {
    name       = "default"
    node_count = 1
    vm_size    = "Standard_D2_v2"
  }

  oms_agent {
    log_analytics_workspace_id = azurerm_log_analytics_workspace.main.id
  }

  identity {
    type = "SystemAssigned"
  }

  tags = {
    Environment = "Production"
  }
}
```

**Version (please complete the following information):**
 - 2.1.20

**Additional context**

The [current implemention](https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/azure/AKSLoggingEnabled.py#L13-L14) are based on 2.x and not work for 3.x.

`CKV_AZURE_4` cannot work with AzureRM 3.0 provider
**Describe the issue**

Scan an aks resource with AzrueRM 3.0 provider will get the following false error:

```text
terraform scan results:

Passed checks: 0, Failed checks: 1, Skipped checks: 0

Check: CKV_AZURE_4: "Ensure AKS logging to Azure Monitoring is Configured"
        FAILED for resource: azurerm_kubernetes_cluster.example
        File: /main.tf:35-58
        Guide: https://docs.bridgecrew.io/docs/bc_azr_kubernetes_1

                35 | resource "azurerm_kubernetes_cluster" "example" {
                36 |   name                = "example-aks1"
                37 |   location            = azurerm_resource_group.example.location
                38 |   resource_group_name = azurerm_resource_group.example.name
                39 |   dns_prefix          = "exampleaks1"
                40 |
                41 |   default_node_pool {
                42 |     name       = "default"
                43 |     node_count = 1
                44 |     vm_size    = "Standard_D2_v2"
                45 |   }
                46 |
                47 |   oms_agent {
                48 |     log_analytics_workspace_id = azurerm_log_analytics_workspace.main.id
                49 |   }
                50 |
                51 |   identity {
                52 |     type = "SystemAssigned"
                53 |   }
                54 |
                55 |   tags = {
                56 |     Environment = "Production"
                57 |   }
                58 | }
```

**Examples**
```hcl
variable "admin_user" {
  default = null
}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "example" {
  location = "eastus"
  name     = "checkov-dynamic"
}

resource "azurerm_log_analytics_workspace" "main" {
  name                = "workspace"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "PerGB2018"
  retention_in_days   = 7
}

resource "azurerm_log_analytics_solution" "main" {
  solution_name         = "ContainerInsights"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  workspace_resource_id = azurerm_log_analytics_workspace.main[0].id
  workspace_name        = azurerm_log_analytics_workspace.main[0].name

  plan {
    publisher = "Microsoft"
    product   = "OMSGallery/ContainerInsights"
  }
}

resource "azurerm_kubernetes_cluster" "example" {
  name                = "example-aks1"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  dns_prefix          = "exampleaks1"

  default_node_pool {
    name       = "default"
    node_count = 1
    vm_size    = "Standard_D2_v2"
  }

  oms_agent {
    log_analytics_workspace_id = azurerm_log_analytics_workspace.main.id
  }

  identity {
    type = "SystemAssigned"
  }

  tags = {
    Environment = "Production"
  }
}
```

**Version (please complete the following information):**
 - 2.1.20

**Additional context**

The [current implemention](https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/azure/AKSLoggingEnabled.py#L13-L14) are based on 2.x and not work for 3.x.



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/azure/AKSLoggingEnabled.py b/checkov/terraform/checks/resource/azure/AKSLoggingEnabled.py
--- a/checkov/terraform/checks/resource/azure/AKSLoggingEnabled.py
+++ b/checkov/terraform/checks/resource/azure/AKSLoggingEnabled.py
@@ -1,8 +1,10 @@
-from checkov.common.models.enums import CheckCategories
-from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
+import dpath
 
+from checkov.common.models.enums import CheckCategories, CheckResult
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck
 
-class AKSLoggingEnabled(BaseResourceValueCheck):
+
+class AKSLoggingEnabled(BaseResourceCheck):
     def __init__(self):
         name = "Ensure AKS logging to Azure Monitoring is Configured"
         id = "CKV_AZURE_4"
@@ -10,8 +12,17 @@ def __init__(self):
         categories = [CheckCategories.KUBERNETES]
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def get_inspected_key(self):
-        return "addon_profile/[0]/oms_agent/[0]/enabled"
+    def scan_resource_conf(self, conf):
+        provider_version_2_path = "addon_profile/[0]/oms_agent/[0]/enabled"
+        provider_version_3_path = "oms_agent/[0]"
+        if dpath.search(conf, provider_version_2_path) and dpath.get(conf, provider_version_2_path)[0]:
+            self.evaluated_keys = [provider_version_2_path]
+            return CheckResult.PASSED
+        elif dpath.search(conf, provider_version_3_path):
+            self.evaluated_keys = [provider_version_3_path]
+            return CheckResult.PASSED
+
+        return CheckResult.FAILED
 
 
 check = AKSLoggingEnabled()


Test patch:
diff --git a/tests/terraform/checks/resource/azure/test_AKSLoggingEnabled.py b/tests/terraform/checks/resource/azure/test_AKSLoggingEnabled.py
--- a/tests/terraform/checks/resource/azure/test_AKSLoggingEnabled.py
+++ b/tests/terraform/checks/resource/azure/test_AKSLoggingEnabled.py
@@ -26,6 +26,25 @@ def test_success(self):
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.PASSED, scan_result)
 
+    def test_success(self):
+        resource_conf = {'name': ['example-aks1'], 'location': ['${azurerm_resource_group.example.location}'],
+                         'resource_group_name': ['${azurerm_resource_group.example.name}'], 'dns_prefix': ['exampleaks1'],
+                         'default_node_pool': [{'name': ['default'], 'node_count': [1], 'vm_size': ['Standard_D2_v2']}],
+                         'identity': [{'type': ['SystemAssigned']}], 'agent_pool_profile': [{}], 'service_principal': [{}],
+                         'tags': [{'Environment': 'Production'}],
+                         'addon_profile': [{'oms_agent': [{'enabled': [True], 'log_analytics_workspace_id': ['']}]}]}
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_success_new_syntax(self):
+        resource_conf = {'name': ['example-aks1'], 'location': ['${azurerm_resource_group.example.location}'],
+                         'resource_group_name': ['${azurerm_resource_group.example.name}'], 'dns_prefix': ['exampleaks1'],
+                         'default_node_pool': [{'name': ['default'], 'node_count': [1], 'vm_size': ['Standard_D2_v2']}],
+                         'identity': [{'type': ['SystemAssigned']}], 'agent_pool_profile': [{}], 'service_principal': [{}],
+                         'tags': [{'Environment': 'Production'}],
+                         'oms_agent': [{'log_analytics_workspace_id': 'mock_workspace_id'}]}
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
 
 if __name__ == '__main__':
     unittest.main()