Repository: bridgecrewio/checkov

Issue:
--check and --skip-check does not work properly when severity (LOW, MEDIUM, HIGH, CRITICAL) is specified.
**Describe the issue**
When run checkov without providing severity level in --check and --skip-check it works fine and reports different issues (LOW and  MEDIUM).
`checkov -d /path/to/terraform`

When I run checkov with provided severity level it returns no alerts at all 
`checkov --check MEDIUM -d /path/to/terraform`

**Examples**
The command that returns no alerts:
`checkov --check MEDIUM -d /path/to/terraform`


**Version (please complete the following information):**
 version: 2.3.44

**Additional context**
When providing severity level with `--check MEDIUM` I expect to filter out LOW level alerts and get only MEDIUM, HIGH and CRITICAL alerts but receiving empty result instead.


Discussion:

Resolving patch:
diff --git a/checkov/main.py b/checkov/main.py
--- a/checkov/main.py
+++ b/checkov/main.py
@@ -38,6 +38,7 @@
 from checkov.common.bridgecrew.integration_features.integration_feature_registry import integration_feature_registry
 from checkov.common.bridgecrew.platform_integration import bc_integration
 from checkov.common.bridgecrew.integration_features.features.licensing_integration import integration as licensing_integration
+from checkov.common.bridgecrew.severities import BcSeverities
 from checkov.common.goget.github.get_git import GitGetter
 from checkov.common.output.baseline import Baseline
 from checkov.common.bridgecrew.check_type import checkov_runners
@@ -628,6 +629,15 @@ def run(self, banner: str = checkov_banner) -> int | None:
             # if a bc_api_key is passed it'll save it.  Otherwise it will check ~/.bridgecrew/credentials
             self.config.bc_api_key = bc_integration.persist_bc_api_key(self.config)
 
+            if not self.config.bc_api_key:
+                # check, if someone tries to use a severity filter without an API key
+                severities = {severity for severity in BcSeverities.__dict__.values() if isinstance(severity, str)}
+                if (
+                    (self.config.check and any(check in severities for check in self.config.check))
+                    or (self.config.skip_check and any(check in severities for check in self.config.skip_check))
+                ):
+                    logging.warning("Filtering checks by severity is only possible with an API key")
+
             excluded_paths = self.config.skip_path or []
 
             if self.config.var_file:


Test patch:
diff --git a/tests/test_main.py b/tests/test_main.py
--- a/tests/test_main.py
+++ b/tests/test_main.py
@@ -1,8 +1,10 @@
 from __future__ import annotations
 
+import logging
 from pathlib import Path
 from typing import TYPE_CHECKING
 
+from _pytest.logging import LogCaptureFixture
 from typing_extensions import Literal
 
 from checkov import main
@@ -77,3 +79,65 @@ def test_run():
 
     assert len(ckv.scan_reports) == 2
     assert {report.check_type for report in ckv.scan_reports} == {"kubernetes", "terraform"}
+
+
+def test_run_with_severity_filter_and_api_key(caplog: LogCaptureFixture):
+    # given
+    caplog.set_level(logging.WARNING)
+    custom_banner = "custom banner"
+    resource_dir = Path(__file__).parent / "common/runner_registry/example_multi_iac"
+    argv = [
+        "-d", str(resource_dir),
+        "--framework", "terraform",
+        "--check", "MEDIUM",
+        "--bc-api-key", "12345678-abcd-1234-abcd-123456789012",
+        "--show-config",  # just set to terminate the run early enough
+    ]
+
+    # when
+    ckv = Checkov()
+    ckv.parse_config(argv=argv)
+    ckv.run(banner=custom_banner)
+
+    # then
+    assert not caplog.messages
+
+
+def test_run_with_severity_filter_without_api_key(caplog: LogCaptureFixture):
+    # given
+    caplog.set_level(logging.WARNING)
+    custom_banner = "custom banner"
+    resource_dir = Path(__file__).parent / "common/runner_registry/example_multi_iac"
+    argv = [
+        "-d", str(resource_dir),
+        "--framework", "terraform",
+        "--check", "MEDIUM",
+    ]
+
+    # when
+    ckv = Checkov()
+    ckv.parse_config(argv=argv)
+    ckv.run(banner=custom_banner)
+
+    # then
+    assert caplog.messages == ["Filtering checks by severity is only possible with an API key"]
+
+
+def test_run_with_severity_skip_filter_without_api_key(caplog: LogCaptureFixture):
+    # given
+    caplog.set_level(logging.WARNING)
+    custom_banner = "custom banner"
+    resource_dir = Path(__file__).parent / "common/runner_registry/example_multi_iac"
+    argv = [
+        "-d", str(resource_dir),
+        "--framework", "terraform",
+        "--skip-check", "MEDIUM",
+    ]
+
+    # when
+    ckv = Checkov()
+    ckv.parse_config(argv=argv)
+    ckv.run(banner=custom_banner)
+
+    # then
+    assert caplog.messages == ["Filtering checks by severity is only possible with an API key"]