Repository: bridgecrewio/checkov

Issue:
crashing on GCP EGRESS firewall rule which doesn't have allow field defined
**Describe the bug**
Checkov crashing on GCP EGRESS firewall rule which doesn't have allow field defined. Tf version 0.12.26 Google provider version: 3.23

**To Reproduce**
Steps to reproduce the behavior:
1. Resource defined as 
```
resource "google_compute_firewall" "default_deny_egress" {
  name        = "deny-all-egress-all"
  description = "Prevent all egress traffic by default"
  disabled = true

  network        = google_compute_network.vpc_network.name
  enable_logging = true

  priority           = 65534
  direction          = "EGRESS"
  destination_ranges = ["0.0.0.0/0"]
  deny { protocol = "all" }
}
```
2. Run cli command : checkov -d folder
3. See error
```
ERROR:checkov.terraform.checks.resource.gcp.GoogleComputeFirewallUnrestrictedIngress3389:Failed to run check: Ensure Google compute firewall ingress does not allow unrestricted rdp access for configuration: {'name': ['${var.env}-deny-all-egress-all'], 'description': ['Prevent all egress traffic by default'], 'disabled': [True], 'network': ['${google_compute_network.vpc_network.name}'], 'enable_logging': [True], 'priority': [65534], 'direction': ['EGRESS'], 'destination_ranges': [['0.0.0.0/0']], 'deny': [{'protocol': {'all': {}}}]} at file: /../../modules/network/firewalls.tf
Traceback (most recent call last):
  File "/Users/jakub/Development/GIT_REPO/tfenv/bin/checkov", line 5, in <module>
    run()
  File "/Users/jakub/Development/GIT_REPO/tfenv/lib/python3.7/site-packages/checkov/main.py", line 76, in run
    files=file)
  File "/Users/jakub/Development/GIT_REPO/tfenv/lib/python3.7/site-packages/checkov/common/runners/runner_registry.py", line 26, in run
    runner_filter=self.runner_filter)
  File "/Users/jakub/Development/GIT_REPO/tfenv/lib/python3.7/site-packages/checkov/terraform/runner.py", line 50, in run
    self.check_tf_definition(report, root_folder, runner_filter)
  File "/Users/jakub/Development/GIT_REPO/tfenv/lib/python3.7/site-packages/checkov/terraform/runner.py", line 91, in check_tf_definition
    block_type, runner_filter)
  File "/Users/jakub/Development/GIT_REPO/tfenv/lib/python3.7/site-packages/checkov/terraform/runner.py", line 113, in run_block
    results = registry.scan(scanned_file, entity, skipped_checks, runner_filter)
  File "/Users/jakub/Development/GIT_REPO/tfenv/lib/python3.7/site-packages/checkov/common/checks/base_check_registry.py", line 64, in scan
    result = self.run_check(check, entity_configuration, entity_name, entity_type, scanned_file, skip_info)
  File "/Users/jakub/Development/GIT_REPO/tfenv/lib/python3.7/site-packages/checkov/common/checks/base_check_registry.py", line 71, in run_check
    entity_name=entity_name, entity_type=entity_type, skip_info=skip_info)
  File "/Users/jakub/Development/GIT_REPO/tfenv/lib/python3.7/site-packages/checkov/common/checks/base_check.py", line 44, in run
    raise e
  File "/Users/jakub/Development/GIT_REPO/tfenv/lib/python3.7/site-packages/checkov/common/checks/base_check.py", line 33, in run
    check_result['result'] = self.scan_entity_conf(entity_configuration)
  File "/Users/jakub/Development/GIT_REPO/tfenv/lib/python3.7/site-packages/checkov/terraform/checks/resource/base_resource_check.py", line 20, in scan_entity_conf
    return self.scan_resource_conf(conf)
  File "/Users/jakub/Development/GIT_REPO/tfenv/lib/python3.7/site-packages/checkov/terraform/checks/resource/gcp/**GoogleComputeFirewallUnrestrictedIngress3389.py**", line 22, in scan_resource_conf
    allow_blocks = conf['allow']
KeyError: 'allow'
```

**Expected behavior**
Not to crash when resource has valid specification

**Screenshots**
If applicable, add screenshots to help explain your problem.

**Desktop (please complete the following information):**
 - OS: Mac OS
 - Checkov Version: 1.0.346

**Additional context**
Add any other context about the problem here (e.g. code snippets).



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress22.py b/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress22.py
--- a/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress22.py
+++ b/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress22.py
@@ -19,14 +19,15 @@ def scan_resource_conf(self, conf):
         :param conf: azure_instance configuration
         :return: <CheckResult>
         """
-        allow_blocks = conf['allow']
-        for block in allow_blocks:
-            if 'ports' in block.keys():
-                if PORT in block['ports'][0]:
-                    if 'source_ranges' in conf.keys():
-                        source_ranges = conf['source_ranges'][0]
-                        if "0.0.0.0/0" in source_ranges:
-                            return CheckResult.FAILED
+        if 'allow' in conf:
+            allow_blocks = conf['allow']
+            for block in allow_blocks:
+                if 'ports' in block.keys():
+                    if PORT in block['ports'][0]:
+                        if 'source_ranges' in conf.keys():
+                            source_ranges = conf['source_ranges'][0]
+                            if "0.0.0.0/0" in source_ranges:
+                                return CheckResult.FAILED
         return CheckResult.PASSED
 
 
diff --git a/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3389.py b/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3389.py
--- a/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3389.py
+++ b/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3389.py
@@ -19,14 +19,15 @@ def scan_resource_conf(self, conf):
         :param conf: azure_instance configuration
         :return: <CheckResult>
         """
-        allow_blocks = conf['allow']
-        for block in allow_blocks:
-            if 'ports' in block.keys():
-                if PORT in block['ports'][0]:
-                    if 'source_ranges' in conf.keys():
-                        source_ranges = conf['source_ranges'][0]
-                        if "0.0.0.0/0" in source_ranges:
-                            return CheckResult.FAILED
+        if 'allow' in conf:
+            allow_blocks = conf['allow']
+            for block in allow_blocks:
+                if 'ports' in block.keys():
+                    if PORT in block['ports'][0]:
+                        if 'source_ranges' in conf.keys():
+                            source_ranges = conf['source_ranges'][0]
+                            if "0.0.0.0/0" in source_ranges:
+                                return CheckResult.FAILED
         return CheckResult.PASSED
 
 


Test patch:
diff --git a/tests/terraform/checks/resource/gcp/test_TestGoogleComputeFirewallUnrestrictedIngress3389.py b/tests/terraform/checks/resource/gcp/test_TestGoogleComputeFirewallUnrestrictedIngress3389.py
--- a/tests/terraform/checks/resource/gcp/test_TestGoogleComputeFirewallUnrestrictedIngress3389.py
+++ b/tests/terraform/checks/resource/gcp/test_TestGoogleComputeFirewallUnrestrictedIngress3389.py
@@ -1,5 +1,7 @@
 import unittest
 
+import hcl2
+
 from checkov.terraform.checks.resource.gcp.GoogleComputeFirewallUnrestrictedIngress3389 import check, PORT
 from checkov.common.models.enums import CheckResult
 
@@ -15,7 +17,7 @@ def test_failure(self):
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
-    def test_success(self):
+    def test_success_1(self):
         resource_conf = {'name': ['${var.name}-${var.region}-mesos-ssh'],
                          'network': ['${google_compute_network.mesos-global-net.name}'],
                          'allow': [{'protocol': ['tcp'], 'ports': [[
@@ -23,6 +25,26 @@ def test_success(self):
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.PASSED, scan_result)
 
+    def test_success_2(self):
+        hcl_res = hcl2.loads("""
+                    resource "google_compute_firewall" "no-allow-blocks" {
+                      name        = "deny-all-egress-all"
+                      description = "Prevent all egress traffic by default"
+                      disabled = true
+                    
+                      network        = google_compute_network.vpc_network.name
+                      enable_logging = true
+                    
+                      priority           = 65534
+                      direction          = "EGRESS"
+                      destination_ranges = ["0.0.0.0/0"]
+                      deny { protocol = "all" }
+                    }
+                        """)
+        resource_conf = hcl_res['resource'][0]['google_compute_firewall']['no-allow-blocks']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
 
 if __name__ == '__main__':
     unittest.main()