Repository: bridgecrewio/checkov

Issue:
Rules CKV_AWS_18 and CKV_AWS_19 fail if s3 resources are defined in a terraform module
**Describe the issue**

When upgrading the AWS provider in Terraform to a version > 3.75 there has been significant change to the aws_s3_bucket resource. If the S3 resources are referenced in a child module rather than the root level it seems Checkov is still failing CKV_AWS_18 and CKV_AWS_19 based upon our usage. I believe these to be false positives.

CKV_AWS_18: "Ensure the S3 bucket has access logging enabled"

access logging is configured by the resource aws_s3_bucket_logging

CKV_AWS_19: "Ensure all data stored in the S3 bucket is securely encrypted at rest"

encryption at rest is configured by the resource aws_s3_bucket_server_side_encryption_configuration

**Examples**

### modules/s3/main.tf

```

resource "aws_kms_key" "s3_key" {
  description             = "KMS key 1"
  deletion_window_in_days = 10
}

resource "aws_s3_bucket" "bucket" {
  bucket = "sample-bucket"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "bucket" {
  bucket = aws_s3_bucket.bucket.id

  rule {
    apply_server_side_encryption_by_default {
      kms_master_key_id = aws_kms_key.s3_key.key_id
      sse_algorithm     = "aws:kms"
    }
    bucket_key_enabled = false
  }
}

resource "aws_s3_bucket_logging" "bucket" {
  bucket = aws_s3_bucket.bucket.id

  target_bucket = "logging-bucket"
  target_prefix = "sample-bucket/"
}

```
### main.tf

```

module "s3" {
  source = "./modules/s3"
}

```

Command: checkov -f plan.json --check CKV_AWS_18,CKV_AWS_19 --repo-root-for-plan-enrichment "./"

Expected both rules pass for resource aws_s3_bucket.bucket

**Version (please complete the following information):**
 - Checkov Version 2.1.81

**Additional context**
Terraform version: 1.2.6
AWS Provider version: 4.23.0

If I move the contents of the module file to the root module both rules pass as expected.



Discussion:

Resolving patch:
diff --git a/checkov/terraform/plan_parser.py b/checkov/terraform/plan_parser.py
--- a/checkov/terraform/plan_parser.py
+++ b/checkov/terraform/plan_parser.py
@@ -121,24 +121,50 @@ def _prepare_resource_block(
 
 
 def _find_child_modules(
-    child_modules: ListNode, resource_changes: dict[str, dict[str, Any]]
+    child_modules: ListNode, resource_changes: dict[str, dict[str, Any]], root_module_conf: dict[str, Any]
 ) -> List[Dict[str, Dict[str, Any]]]:
+    """ Find all child modules if any. Including any amount of nested child modules.
+
+    :param child_modules: list of terraform child_module objects
+    :param resource_changes: a resource address to resource changes dict
+    :param root_module_conf: configuration block of the root module
+    :returns:
+        list of terraform resource blocks
     """
-    Find all child modules if any. Including any amount of nested child modules.
-    :type: child_modules: list of tf child_module objects
-    :rtype: resource_blocks: list of hcl resources
-    """
+
     resource_blocks = []
     for child_module in child_modules:
-        if child_module.get("child_modules", []):
-            nested_child_modules = child_module.get("child_modules", [])
-            nested_blocks = _find_child_modules(nested_child_modules, resource_changes)
+        nested_child_modules = child_module.get("child_modules", [])
+        if nested_child_modules:
+            nested_blocks = _find_child_modules(
+                child_modules=nested_child_modules,
+                resource_changes=resource_changes,
+                root_module_conf=root_module_conf
+            )
             for resource in nested_blocks:
                 resource_blocks.append(resource)
+
+        module_address = child_module.get("address", "")
+        module_call_resources = _get_module_call_resources(
+            module_address=module_address,
+            root_module_conf=root_module_conf,
+        )
+
         for resource in child_module.get("resources", []):
+            module_call_conf = None
+            if module_address and module_call_resources:
+                module_call_conf = next(
+                    (
+                        module_call_resource
+                        for module_call_resource in module_call_resources
+                        if f"{module_address}.{module_call_resource['address']}" == resource["address"]
+                    ),
+                    None
+                )
+
             resource_block, prepared = _prepare_resource_block(
                 resource=resource,
-                conf=None,
+                conf=module_call_conf,
                 resource_changes=resource_changes,
             )
             if prepared is True:
@@ -146,6 +172,18 @@ def _find_child_modules(
     return resource_blocks
 
 
+def _get_module_call_resources(module_address: str, root_module_conf: dict[str, Any]) -> list[dict[str, Any]]:
+    """Extracts the resources from the 'module_calls' block under 'configuration'"""
+
+    for module_name in module_address.split("."):
+        if module_name == "module":
+            # module names are always prefixed with 'module.', therefore skip it
+            continue
+        root_module_conf = root_module_conf.get("module_calls", {}).get(module_name, {}).get("module", {})
+
+    return root_module_conf.get("resources", [])
+
+
 def _get_resource_changes(template: dict[str, Any]) -> dict[str, dict[str, Any]]:
     """Returns a resource address to resource changes dict"""
 
@@ -190,9 +228,14 @@ def parse_tf_plan(tf_plan_file: str, out_parsing_errors: Dict[str, str]) -> Tupl
         if prepared is True:
             tf_definition["resource"].append(resource_block)
     child_modules = template.get("planned_values", {}).get("root_module", {}).get("child_modules", [])
+    root_module_conf = template.get("configuration", {}).get("root_module", {})
     # Terraform supports modules within modules so we need to search
     # in nested modules to find all resource blocks
-    resource_blocks = _find_child_modules(child_modules, resource_changes)
+    resource_blocks = _find_child_modules(
+        child_modules=child_modules,
+        resource_changes=resource_changes,
+        root_module_conf=root_module_conf,
+    )
     for resource in resource_blocks:
         tf_definition["resource"].append(resource)
     return tf_definition, template_lines


Test patch:
diff --git a/tests/terraform/runner/resources/plan_nested_child_modules_with_connections/tfplan.json b/tests/terraform/runner/resources/plan_nested_child_modules_with_connections/tfplan.json
new file mode 100644
--- /dev/null
+++ b/tests/terraform/runner/resources/plan_nested_child_modules_with_connections/tfplan.json
@@ -0,0 +1,2035 @@
+{
+  "format_version": "1.1",
+  "terraform_version": "1.2.4",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "aws_s3_bucket.root_bucket",
+          "mode": "managed",
+          "type": "aws_s3_bucket",
+          "name": "root_bucket",
+          "provider_name": "registry.terraform.io/hashicorp/aws",
+          "schema_version": 0,
+          "values": {
+            "bucket": "testing",
+            "bucket_prefix": null,
+            "force_destroy": false,
+            "tags": null
+          },
+          "sensitive_values": {
+            "cors_rule": [],
+            "grant": [],
+            "lifecycle_rule": [],
+            "logging": [],
+            "object_lock_configuration": [],
+            "replication_configuration": [],
+            "server_side_encryption_configuration": [],
+            "tags_all": {},
+            "versioning": [],
+            "website": []
+          }
+        },
+        {
+          "address": "aws_s3_bucket_public_access_block.root",
+          "mode": "managed",
+          "type": "aws_s3_bucket_public_access_block",
+          "name": "root",
+          "provider_name": "registry.terraform.io/hashicorp/aws",
+          "schema_version": 0,
+          "values": {
+            "block_public_acls": true,
+            "block_public_policy": true,
+            "ignore_public_acls": true,
+            "restrict_public_buckets": true
+          },
+          "sensitive_values": {}
+        }
+      ],
+      "child_modules": [
+        {
+          "resources": [
+            {
+              "address": "module.s3_bucket.aws_s3_bucket.this[0]",
+              "mode": "managed",
+              "type": "aws_s3_bucket",
+              "name": "this",
+              "index": 0,
+              "provider_name": "registry.terraform.io/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "bucket": "my-s3-bucket",
+                "bucket_prefix": null,
+                "force_destroy": false,
+                "object_lock_enabled": false,
+                "tags": null
+              },
+              "sensitive_values": {
+                "cors_rule": [],
+                "grant": [],
+                "lifecycle_rule": [],
+                "logging": [],
+                "object_lock_configuration": [],
+                "replication_configuration": [],
+                "server_side_encryption_configuration": [],
+                "tags_all": {},
+                "versioning": [],
+                "website": []
+              }
+            },
+            {
+              "address": "module.s3_bucket.aws_s3_bucket_acl.this[0]",
+              "mode": "managed",
+              "type": "aws_s3_bucket_acl",
+              "name": "this",
+              "index": 0,
+              "provider_name": "registry.terraform.io/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "acl": "public-read-write",
+                "expected_bucket_owner": null
+              },
+              "sensitive_values": {
+                "access_control_policy": []
+              }
+            },
+            {
+              "address": "module.s3_bucket.aws_s3_bucket_public_access_block.this[0]",
+              "mode": "managed",
+              "type": "aws_s3_bucket_public_access_block",
+              "name": "this",
+              "index": 0,
+              "provider_name": "registry.terraform.io/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "block_public_acls": false,
+                "block_public_policy": false,
+                "ignore_public_acls": false,
+                "restrict_public_buckets": false
+              },
+              "sensitive_values": {}
+            }
+          ],
+          "address": "module.s3_bucket"
+        },
+        {
+          "resources": [
+            {
+              "address": "module.s3_module.aws_s3_bucket.module_bucket",
+              "mode": "managed",
+              "type": "aws_s3_bucket",
+              "name": "module_bucket",
+              "provider_name": "registry.terraform.io/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "bucket": "testing",
+                "bucket_prefix": null,
+                "force_destroy": false,
+                "tags": null
+              },
+              "sensitive_values": {
+                "cors_rule": [],
+                "grant": [],
+                "lifecycle_rule": [],
+                "logging": [],
+                "object_lock_configuration": [],
+                "replication_configuration": [],
+                "server_side_encryption_configuration": [],
+                "tags_all": {},
+                "versioning": [],
+                "website": []
+              }
+            },
+            {
+              "address": "module.s3_module.aws_s3_bucket_public_access_block.module_bucket",
+              "mode": "managed",
+              "type": "aws_s3_bucket_public_access_block",
+              "name": "module_bucket",
+              "provider_name": "registry.terraform.io/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "block_public_acls": true,
+                "block_public_policy": true,
+                "ignore_public_acls": true,
+                "restrict_public_buckets": true
+              },
+              "sensitive_values": {}
+            }
+          ],
+          "address": "module.s3_module",
+          "child_modules": [
+            {
+              "resources": [
+                {
+                  "address": "module.s3_module.module.s3_submodule.aws_s3_bucket.submodule_bucket",
+                  "mode": "managed",
+                  "type": "aws_s3_bucket",
+                  "name": "submodule_bucket",
+                  "provider_name": "registry.terraform.io/hashicorp/aws",
+                  "schema_version": 0,
+                  "values": {
+                    "bucket": "testing",
+                    "bucket_prefix": null,
+                    "force_destroy": false,
+                    "tags": null
+                  },
+                  "sensitive_values": {
+                    "cors_rule": [],
+                    "grant": [],
+                    "lifecycle_rule": [],
+                    "logging": [],
+                    "object_lock_configuration": [],
+                    "replication_configuration": [],
+                    "server_side_encryption_configuration": [],
+                    "tags_all": {},
+                    "versioning": [],
+                    "website": []
+                  }
+                },
+                {
+                  "address": "module.s3_module.module.s3_submodule.aws_s3_bucket_public_access_block.submodule_bucket",
+                  "mode": "managed",
+                  "type": "aws_s3_bucket_public_access_block",
+                  "name": "submodule_bucket",
+                  "provider_name": "registry.terraform.io/hashicorp/aws",
+                  "schema_version": 0,
+                  "values": {
+                    "block_public_acls": true,
+                    "block_public_policy": true,
+                    "ignore_public_acls": true,
+                    "restrict_public_buckets": true
+                  },
+                  "sensitive_values": {}
+                }
+              ],
+              "address": "module.s3_module.module.s3_submodule"
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "aws_s3_bucket.root_bucket",
+      "mode": "managed",
+      "type": "aws_s3_bucket",
+      "name": "root_bucket",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "bucket": "testing",
+          "bucket_prefix": null,
+          "force_destroy": false,
+          "tags": null
+        },
+        "after_unknown": {
+          "acceleration_status": true,
+          "acl": true,
+          "arn": true,
+          "bucket_domain_name": true,
+          "bucket_regional_domain_name": true,
+          "cors_rule": true,
+          "grant": true,
+          "hosted_zone_id": true,
+          "id": true,
+          "lifecycle_rule": true,
+          "logging": true,
+          "object_lock_configuration": true,
+          "object_lock_enabled": true,
+          "policy": true,
+          "region": true,
+          "replication_configuration": true,
+          "request_payer": true,
+          "server_side_encryption_configuration": true,
+          "tags_all": true,
+          "versioning": true,
+          "website": true,
+          "website_domain": true,
+          "website_endpoint": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "cors_rule": [],
+          "grant": [],
+          "lifecycle_rule": [],
+          "logging": [],
+          "object_lock_configuration": [],
+          "replication_configuration": [],
+          "server_side_encryption_configuration": [],
+          "tags_all": {},
+          "versioning": [],
+          "website": []
+        }
+      }
+    },
+    {
+      "address": "aws_s3_bucket_public_access_block.root",
+      "mode": "managed",
+      "type": "aws_s3_bucket_public_access_block",
+      "name": "root",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "block_public_acls": true,
+          "block_public_policy": true,
+          "ignore_public_acls": true,
+          "restrict_public_buckets": true
+        },
+        "after_unknown": {
+          "bucket": true,
+          "id": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {}
+      }
+    },
+    {
+      "address": "module.s3_bucket.aws_s3_bucket.this[0]",
+      "module_address": "module.s3_bucket",
+      "mode": "managed",
+      "type": "aws_s3_bucket",
+      "name": "this",
+      "index": 0,
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "bucket": "my-s3-bucket",
+          "bucket_prefix": null,
+          "force_destroy": false,
+          "object_lock_enabled": false,
+          "tags": null
+        },
+        "after_unknown": {
+          "acceleration_status": true,
+          "acl": true,
+          "arn": true,
+          "bucket_domain_name": true,
+          "bucket_regional_domain_name": true,
+          "cors_rule": true,
+          "grant": true,
+          "hosted_zone_id": true,
+          "id": true,
+          "lifecycle_rule": true,
+          "logging": true,
+          "object_lock_configuration": true,
+          "policy": true,
+          "region": true,
+          "replication_configuration": true,
+          "request_payer": true,
+          "server_side_encryption_configuration": true,
+          "tags_all": true,
+          "versioning": true,
+          "website": true,
+          "website_domain": true,
+          "website_endpoint": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "cors_rule": [],
+          "grant": [],
+          "lifecycle_rule": [],
+          "logging": [],
+          "object_lock_configuration": [],
+          "replication_configuration": [],
+          "server_side_encryption_configuration": [],
+          "tags_all": {},
+          "versioning": [],
+          "website": []
+        }
+      }
+    },
+    {
+      "address": "module.s3_bucket.aws_s3_bucket_acl.this[0]",
+      "module_address": "module.s3_bucket",
+      "mode": "managed",
+      "type": "aws_s3_bucket_acl",
+      "name": "this",
+      "index": 0,
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "acl": "public-read-write",
+          "expected_bucket_owner": null
+        },
+        "after_unknown": {
+          "access_control_policy": true,
+          "bucket": true,
+          "id": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "access_control_policy": []
+        }
+      }
+    },
+    {
+      "address": "module.s3_bucket.aws_s3_bucket_public_access_block.this[0]",
+      "module_address": "module.s3_bucket",
+      "mode": "managed",
+      "type": "aws_s3_bucket_public_access_block",
+      "name": "this",
+      "index": 0,
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "block_public_acls": false,
+          "block_public_policy": false,
+          "ignore_public_acls": false,
+          "restrict_public_buckets": false
+        },
+        "after_unknown": {
+          "bucket": true,
+          "id": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {}
+      }
+    },
+    {
+      "address": "module.s3_module.aws_s3_bucket.module_bucket",
+      "module_address": "module.s3_module",
+      "mode": "managed",
+      "type": "aws_s3_bucket",
+      "name": "module_bucket",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "bucket": "testing",
+          "bucket_prefix": null,
+          "force_destroy": false,
+          "tags": null
+        },
+        "after_unknown": {
+          "acceleration_status": true,
+          "acl": true,
+          "arn": true,
+          "bucket_domain_name": true,
+          "bucket_regional_domain_name": true,
+          "cors_rule": true,
+          "grant": true,
+          "hosted_zone_id": true,
+          "id": true,
+          "lifecycle_rule": true,
+          "logging": true,
+          "object_lock_configuration": true,
+          "object_lock_enabled": true,
+          "policy": true,
+          "region": true,
+          "replication_configuration": true,
+          "request_payer": true,
+          "server_side_encryption_configuration": true,
+          "tags_all": true,
+          "versioning": true,
+          "website": true,
+          "website_domain": true,
+          "website_endpoint": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "cors_rule": [],
+          "grant": [],
+          "lifecycle_rule": [],
+          "logging": [],
+          "object_lock_configuration": [],
+          "replication_configuration": [],
+          "server_side_encryption_configuration": [],
+          "tags_all": {},
+          "versioning": [],
+          "website": []
+        }
+      }
+    },
+    {
+      "address": "module.s3_module.aws_s3_bucket_public_access_block.module_bucket",
+      "module_address": "module.s3_module",
+      "mode": "managed",
+      "type": "aws_s3_bucket_public_access_block",
+      "name": "module_bucket",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "block_public_acls": true,
+          "block_public_policy": true,
+          "ignore_public_acls": true,
+          "restrict_public_buckets": true
+        },
+        "after_unknown": {
+          "bucket": true,
+          "id": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {}
+      }
+    },
+    {
+      "address": "module.s3_module.module.s3_submodule.aws_s3_bucket.submodule_bucket",
+      "module_address": "module.s3_module.module.s3_submodule",
+      "mode": "managed",
+      "type": "aws_s3_bucket",
+      "name": "submodule_bucket",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "bucket": "testing",
+          "bucket_prefix": null,
+          "force_destroy": false,
+          "tags": null
+        },
+        "after_unknown": {
+          "acceleration_status": true,
+          "acl": true,
+          "arn": true,
+          "bucket_domain_name": true,
+          "bucket_regional_domain_name": true,
+          "cors_rule": true,
+          "grant": true,
+          "hosted_zone_id": true,
+          "id": true,
+          "lifecycle_rule": true,
+          "logging": true,
+          "object_lock_configuration": true,
+          "object_lock_enabled": true,
+          "policy": true,
+          "region": true,
+          "replication_configuration": true,
+          "request_payer": true,
+          "server_side_encryption_configuration": true,
+          "tags_all": true,
+          "versioning": true,
+          "website": true,
+          "website_domain": true,
+          "website_endpoint": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "cors_rule": [],
+          "grant": [],
+          "lifecycle_rule": [],
+          "logging": [],
+          "object_lock_configuration": [],
+          "replication_configuration": [],
+          "server_side_encryption_configuration": [],
+          "tags_all": {},
+          "versioning": [],
+          "website": []
+        }
+      }
+    },
+    {
+      "address": "module.s3_module.module.s3_submodule.aws_s3_bucket_public_access_block.submodule_bucket",
+      "module_address": "module.s3_module.module.s3_submodule",
+      "mode": "managed",
+      "type": "aws_s3_bucket_public_access_block",
+      "name": "submodule_bucket",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "block_public_acls": true,
+          "block_public_policy": true,
+          "ignore_public_acls": true,
+          "restrict_public_buckets": true
+        },
+        "after_unknown": {
+          "bucket": true,
+          "id": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {}
+      }
+    }
+  ],
+  "prior_state": {
+    "format_version": "1.0",
+    "terraform_version": "1.2.4",
+    "values": {
+      "root_module": {
+        "child_modules": [
+          {
+            "resources": [
+              {
+                "address": "module.s3_bucket.data.aws_canonical_user_id.this",
+                "mode": "data",
+                "type": "aws_canonical_user_id",
+                "name": "this",
+                "provider_name": "registry.terraform.io/hashicorp/aws",
+                "schema_version": 0,
+                "values": {
+                  "display_name": "aws-admin-accounts+619572639823",
+                  "id": "21a5f9b1fa8ae5dc2c10639e5db8652fe3b67fee8c6a4fb229e81831604e80b3"
+                },
+                "sensitive_values": {}
+              }
+            ],
+            "address": "module.s3_bucket"
+          }
+        ]
+      }
+    }
+  },
+  "configuration": {
+    "provider_config": {
+      "aws": {
+        "name": "aws",
+        "full_name": "registry.terraform.io/hashicorp/aws",
+        "expressions": {
+          "profile": {
+            "constant_value": "dev2"
+          },
+          "region": {
+            "constant_value": "us-west-2"
+          }
+        }
+      }
+    },
+    "root_module": {
+      "resources": [
+        {
+          "address": "aws_s3_bucket.root_bucket",
+          "mode": "managed",
+          "type": "aws_s3_bucket",
+          "name": "root_bucket",
+          "provider_config_key": "aws",
+          "expressions": {
+            "bucket": {
+              "constant_value": "testing"
+            }
+          },
+          "schema_version": 0
+        },
+        {
+          "address": "aws_s3_bucket_public_access_block.root",
+          "mode": "managed",
+          "type": "aws_s3_bucket_public_access_block",
+          "name": "root",
+          "provider_config_key": "aws",
+          "expressions": {
+            "block_public_acls": {
+              "constant_value": true
+            },
+            "block_public_policy": {
+              "constant_value": true
+            },
+            "bucket": {
+              "references": [
+                "aws_s3_bucket.root_bucket.id",
+                "aws_s3_bucket.root_bucket"
+              ]
+            },
+            "ignore_public_acls": {
+              "constant_value": true
+            },
+            "restrict_public_buckets": {
+              "constant_value": true
+            }
+          },
+          "schema_version": 0
+        }
+      ],
+      "module_calls": {
+        "s3_bucket": {
+          "source": "terraform-aws-modules/s3-bucket/aws",
+          "expressions": {
+            "acl": {
+              "constant_value": "public-read-write"
+            },
+            "bucket": {
+              "constant_value": "my-s3-bucket"
+            }
+          },
+          "module": {
+            "outputs": {
+              "s3_bucket_arn": {
+                "expression": {
+                  "references": [
+                    "aws_s3_bucket.this[0].arn",
+                    "aws_s3_bucket.this[0]",
+                    "aws_s3_bucket.this"
+                  ]
+                },
+                "description": "The ARN of the bucket. Will be of format arn:aws:s3:::bucketname."
+              },
+              "s3_bucket_bucket_domain_name": {
+                "expression": {
+                  "references": [
+                    "aws_s3_bucket.this[0].bucket_domain_name",
+                    "aws_s3_bucket.this[0]",
+                    "aws_s3_bucket.this"
+                  ]
+                },
+                "description": "The bucket domain name. Will be of format bucketname.s3.amazonaws.com."
+              },
+              "s3_bucket_bucket_regional_domain_name": {
+                "expression": {
+                  "references": [
+                    "aws_s3_bucket.this[0].bucket_regional_domain_name",
+                    "aws_s3_bucket.this[0]",
+                    "aws_s3_bucket.this"
+                  ]
+                },
+                "description": "The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL."
+              },
+              "s3_bucket_hosted_zone_id": {
+                "expression": {
+                  "references": [
+                    "aws_s3_bucket.this[0].hosted_zone_id",
+                    "aws_s3_bucket.this[0]",
+                    "aws_s3_bucket.this"
+                  ]
+                },
+                "description": "The Route 53 Hosted Zone ID for this bucket's region."
+              },
+              "s3_bucket_id": {
+                "expression": {
+                  "references": [
+                    "aws_s3_bucket_policy.this[0].id",
+                    "aws_s3_bucket_policy.this[0]",
+                    "aws_s3_bucket_policy.this",
+                    "aws_s3_bucket.this[0].id",
+                    "aws_s3_bucket.this[0]",
+                    "aws_s3_bucket.this"
+                  ]
+                },
+                "description": "The name of the bucket."
+              },
+              "s3_bucket_region": {
+                "expression": {
+                  "references": [
+                    "aws_s3_bucket.this[0].region",
+                    "aws_s3_bucket.this[0]",
+                    "aws_s3_bucket.this"
+                  ]
+                },
+                "description": "The AWS region this bucket resides in."
+              },
+              "s3_bucket_website_domain": {
+                "expression": {
+                  "references": [
+                    "aws_s3_bucket_website_configuration.this[0].website_domain",
+                    "aws_s3_bucket_website_configuration.this[0]",
+                    "aws_s3_bucket_website_configuration.this"
+                  ]
+                },
+                "description": "The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records."
+              },
+              "s3_bucket_website_endpoint": {
+                "expression": {
+                  "references": [
+                    "aws_s3_bucket_website_configuration.this[0].website_endpoint",
+                    "aws_s3_bucket_website_configuration.this[0]",
+                    "aws_s3_bucket_website_configuration.this"
+                  ]
+                },
+                "description": "The website endpoint, if the bucket is configured with a website. If not, this will be an empty string."
+              }
+            },
+            "resources": [
+              {
+                "address": "aws_s3_bucket.this",
+                "mode": "managed",
+                "type": "aws_s3_bucket",
+                "name": "this",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "bucket": {
+                    "references": [
+                      "var.bucket"
+                    ]
+                  },
+                  "bucket_prefix": {
+                    "references": [
+                      "var.bucket_prefix"
+                    ]
+                  },
+                  "force_destroy": {
+                    "references": [
+                      "var.force_destroy"
+                    ]
+                  },
+                  "object_lock_enabled": {
+                    "references": [
+                      "var.object_lock_enabled"
+                    ]
+                  },
+                  "tags": {
+                    "references": [
+                      "var.tags"
+                    ]
+                  }
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket"
+                  ]
+                }
+              },
+              {
+                "address": "aws_s3_bucket_accelerate_configuration.this",
+                "mode": "managed",
+                "type": "aws_s3_bucket_accelerate_configuration",
+                "name": "this",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "bucket": {
+                    "references": [
+                      "aws_s3_bucket.this[0].id",
+                      "aws_s3_bucket.this[0]",
+                      "aws_s3_bucket.this"
+                    ]
+                  },
+                  "expected_bucket_owner": {
+                    "references": [
+                      "var.expected_bucket_owner"
+                    ]
+                  },
+                  "status": {
+                    "references": [
+                      "var.acceleration_status"
+                    ]
+                  }
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "var.acceleration_status"
+                  ]
+                }
+              },
+              {
+                "address": "aws_s3_bucket_acl.this",
+                "mode": "managed",
+                "type": "aws_s3_bucket_acl",
+                "name": "this",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "acl": {
+                    "references": [
+                      "var.acl",
+                      "var.acl"
+                    ]
+                  },
+                  "bucket": {
+                    "references": [
+                      "aws_s3_bucket.this[0].id",
+                      "aws_s3_bucket.this[0]",
+                      "aws_s3_bucket.this"
+                    ]
+                  },
+                  "expected_bucket_owner": {
+                    "references": [
+                      "var.expected_bucket_owner"
+                    ]
+                  }
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "var.acl",
+                    "var.acl",
+                    "local.grants"
+                  ]
+                }
+              },
+              {
+                "address": "aws_s3_bucket_cors_configuration.this",
+                "mode": "managed",
+                "type": "aws_s3_bucket_cors_configuration",
+                "name": "this",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "bucket": {
+                    "references": [
+                      "aws_s3_bucket.this[0].id",
+                      "aws_s3_bucket.this[0]",
+                      "aws_s3_bucket.this"
+                    ]
+                  },
+                  "expected_bucket_owner": {
+                    "references": [
+                      "var.expected_bucket_owner"
+                    ]
+                  }
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "local.cors_rules"
+                  ]
+                }
+              },
+              {
+                "address": "aws_s3_bucket_intelligent_tiering_configuration.this",
+                "mode": "managed",
+                "type": "aws_s3_bucket_intelligent_tiering_configuration",
+                "name": "this",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "bucket": {
+                    "references": [
+                      "aws_s3_bucket.this[0].id",
+                      "aws_s3_bucket.this[0]",
+                      "aws_s3_bucket.this"
+                    ]
+                  },
+                  "name": {
+                    "references": [
+                      "each.key"
+                    ]
+                  },
+                  "status": {
+                    "references": [
+                      "each.value.status",
+                      "each.value",
+                      "each.value.status",
+                      "each.value"
+                    ]
+                  }
+                },
+                "schema_version": 0,
+                "for_each_expression": {
+                  "references": [
+                    "local.intelligent_tiering",
+                    "local.create_bucket"
+                  ]
+                }
+              },
+              {
+                "address": "aws_s3_bucket_lifecycle_configuration.this",
+                "mode": "managed",
+                "type": "aws_s3_bucket_lifecycle_configuration",
+                "name": "this",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "bucket": {
+                    "references": [
+                      "aws_s3_bucket.this[0].id",
+                      "aws_s3_bucket.this[0]",
+                      "aws_s3_bucket.this"
+                    ]
+                  },
+                  "expected_bucket_owner": {
+                    "references": [
+                      "var.expected_bucket_owner"
+                    ]
+                  }
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "local.lifecycle_rules"
+                  ]
+                },
+                "depends_on": [
+                  "aws_s3_bucket_versioning.this"
+                ]
+              },
+              {
+                "address": "aws_s3_bucket_logging.this",
+                "mode": "managed",
+                "type": "aws_s3_bucket_logging",
+                "name": "this",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "bucket": {
+                    "references": [
+                      "aws_s3_bucket.this[0].id",
+                      "aws_s3_bucket.this[0]",
+                      "aws_s3_bucket.this"
+                    ]
+                  },
+                  "target_bucket": {
+                    "references": [
+                      "var.logging[\"target_bucket\"]",
+                      "var.logging"
+                    ]
+                  },
+                  "target_prefix": {
+                    "references": [
+                      "var.logging[\"target_prefix\"]",
+                      "var.logging"
+                    ]
+                  }
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "var.logging"
+                  ]
+                }
+              },
+              {
+                "address": "aws_s3_bucket_object_lock_configuration.this",
+                "mode": "managed",
+                "type": "aws_s3_bucket_object_lock_configuration",
+                "name": "this",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "bucket": {
+                    "references": [
+                      "aws_s3_bucket.this[0].id",
+                      "aws_s3_bucket.this[0]",
+                      "aws_s3_bucket.this"
+                    ]
+                  },
+                  "expected_bucket_owner": {
+                    "references": [
+                      "var.expected_bucket_owner"
+                    ]
+                  },
+                  "rule": [
+                    {
+                      "default_retention": [
+                        {
+                          "days": {
+                            "references": [
+                              "var.object_lock_configuration.rule.default_retention.days",
+                              "var.object_lock_configuration.rule.default_retention",
+                              "var.object_lock_configuration.rule",
+                              "var.object_lock_configuration"
+                            ]
+                          },
+                          "mode": {
+                            "references": [
+                              "var.object_lock_configuration.rule.default_retention.mode",
+                              "var.object_lock_configuration.rule.default_retention",
+                              "var.object_lock_configuration.rule",
+                              "var.object_lock_configuration"
+                            ]
+                          },
+                          "years": {
+                            "references": [
+                              "var.object_lock_configuration.rule.default_retention.years",
+                              "var.object_lock_configuration.rule.default_retention",
+                              "var.object_lock_configuration.rule",
+                              "var.object_lock_configuration"
+                            ]
+                          }
+                        }
+                      ]
+                    }
+                  ],
+                  "token": {
+                    "references": [
+                      "var.object_lock_configuration.token",
+                      "var.object_lock_configuration"
+                    ]
+                  }
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "var.object_lock_enabled",
+                    "var.object_lock_configuration.rule.default_retention",
+                    "var.object_lock_configuration.rule",
+                    "var.object_lock_configuration"
+                  ]
+                }
+              },
+              {
+                "address": "aws_s3_bucket_ownership_controls.this",
+                "mode": "managed",
+                "type": "aws_s3_bucket_ownership_controls",
+                "name": "this",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "bucket": {
+                    "references": [
+                      "local.attach_policy",
+                      "aws_s3_bucket_policy.this[0].id",
+                      "aws_s3_bucket_policy.this[0]",
+                      "aws_s3_bucket_policy.this",
+                      "aws_s3_bucket.this[0].id",
+                      "aws_s3_bucket.this[0]",
+                      "aws_s3_bucket.this"
+                    ]
+                  },
+                  "rule": [
+                    {
+                      "object_ownership": {
+                        "references": [
+                          "var.object_ownership"
+                        ]
+                      }
+                    }
+                  ]
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "var.control_object_ownership"
+                  ]
+                },
+                "depends_on": [
+                  "aws_s3_bucket_policy.this",
+                  "aws_s3_bucket_public_access_block.this",
+                  "aws_s3_bucket.this"
+                ]
+              },
+              {
+                "address": "aws_s3_bucket_policy.this",
+                "mode": "managed",
+                "type": "aws_s3_bucket_policy",
+                "name": "this",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "bucket": {
+                    "references": [
+                      "aws_s3_bucket.this[0].id",
+                      "aws_s3_bucket.this[0]",
+                      "aws_s3_bucket.this"
+                    ]
+                  },
+                  "policy": {
+                    "references": [
+                      "data.aws_iam_policy_document.combined[0].json",
+                      "data.aws_iam_policy_document.combined[0]",
+                      "data.aws_iam_policy_document.combined"
+                    ]
+                  }
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "local.attach_policy"
+                  ]
+                }
+              },
+              {
+                "address": "aws_s3_bucket_public_access_block.this",
+                "mode": "managed",
+                "type": "aws_s3_bucket_public_access_block",
+                "name": "this",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "block_public_acls": {
+                    "references": [
+                      "var.block_public_acls"
+                    ]
+                  },
+                  "block_public_policy": {
+                    "references": [
+                      "var.block_public_policy"
+                    ]
+                  },
+                  "bucket": {
+                    "references": [
+                      "local.attach_policy",
+                      "aws_s3_bucket_policy.this[0].id",
+                      "aws_s3_bucket_policy.this[0]",
+                      "aws_s3_bucket_policy.this",
+                      "aws_s3_bucket.this[0].id",
+                      "aws_s3_bucket.this[0]",
+                      "aws_s3_bucket.this"
+                    ]
+                  },
+                  "ignore_public_acls": {
+                    "references": [
+                      "var.ignore_public_acls"
+                    ]
+                  },
+                  "restrict_public_buckets": {
+                    "references": [
+                      "var.restrict_public_buckets"
+                    ]
+                  }
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "var.attach_public_policy"
+                  ]
+                }
+              },
+              {
+                "address": "aws_s3_bucket_replication_configuration.this",
+                "mode": "managed",
+                "type": "aws_s3_bucket_replication_configuration",
+                "name": "this",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "bucket": {
+                    "references": [
+                      "aws_s3_bucket.this[0].id",
+                      "aws_s3_bucket.this[0]",
+                      "aws_s3_bucket.this"
+                    ]
+                  },
+                  "role": {
+                    "references": [
+                      "var.replication_configuration[\"role\"]",
+                      "var.replication_configuration"
+                    ]
+                  }
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "var.replication_configuration"
+                  ]
+                },
+                "depends_on": [
+                  "aws_s3_bucket_versioning.this"
+                ]
+              },
+              {
+                "address": "aws_s3_bucket_request_payment_configuration.this",
+                "mode": "managed",
+                "type": "aws_s3_bucket_request_payment_configuration",
+                "name": "this",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "bucket": {
+                    "references": [
+                      "aws_s3_bucket.this[0].id",
+                      "aws_s3_bucket.this[0]",
+                      "aws_s3_bucket.this"
+                    ]
+                  },
+                  "expected_bucket_owner": {
+                    "references": [
+                      "var.expected_bucket_owner"
+                    ]
+                  },
+                  "payer": {
+                    "references": [
+                      "var.request_payer"
+                    ]
+                  }
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "var.request_payer"
+                  ]
+                }
+              },
+              {
+                "address": "aws_s3_bucket_server_side_encryption_configuration.this",
+                "mode": "managed",
+                "type": "aws_s3_bucket_server_side_encryption_configuration",
+                "name": "this",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "bucket": {
+                    "references": [
+                      "aws_s3_bucket.this[0].id",
+                      "aws_s3_bucket.this[0]",
+                      "aws_s3_bucket.this"
+                    ]
+                  },
+                  "expected_bucket_owner": {
+                    "references": [
+                      "var.expected_bucket_owner"
+                    ]
+                  }
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "var.server_side_encryption_configuration"
+                  ]
+                }
+              },
+              {
+                "address": "aws_s3_bucket_versioning.this",
+                "mode": "managed",
+                "type": "aws_s3_bucket_versioning",
+                "name": "this",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "bucket": {
+                    "references": [
+                      "aws_s3_bucket.this[0].id",
+                      "aws_s3_bucket.this[0]",
+                      "aws_s3_bucket.this"
+                    ]
+                  },
+                  "expected_bucket_owner": {
+                    "references": [
+                      "var.expected_bucket_owner"
+                    ]
+                  },
+                  "mfa": {
+                    "references": [
+                      "var.versioning[\"mfa\"]",
+                      "var.versioning"
+                    ]
+                  },
+                  "versioning_configuration": [
+                    {
+                      "mfa_delete": {
+                        "references": [
+                          "var.versioning[\"mfa_delete\"]",
+                          "var.versioning",
+                          "var.versioning[\"mfa_delete\"]",
+                          "var.versioning"
+                        ]
+                      },
+                      "status": {
+                        "references": [
+                          "var.versioning[\"enabled\"]",
+                          "var.versioning",
+                          "var.versioning[\"status\"]",
+                          "var.versioning",
+                          "var.versioning[\"status\"]",
+                          "var.versioning"
+                        ]
+                      }
+                    }
+                  ]
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "var.versioning"
+                  ]
+                }
+              },
+              {
+                "address": "aws_s3_bucket_website_configuration.this",
+                "mode": "managed",
+                "type": "aws_s3_bucket_website_configuration",
+                "name": "this",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "bucket": {
+                    "references": [
+                      "aws_s3_bucket.this[0].id",
+                      "aws_s3_bucket.this[0]",
+                      "aws_s3_bucket.this"
+                    ]
+                  },
+                  "expected_bucket_owner": {
+                    "references": [
+                      "var.expected_bucket_owner"
+                    ]
+                  }
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "var.website"
+                  ]
+                }
+              },
+              {
+                "address": "data.aws_canonical_user_id.this",
+                "mode": "data",
+                "type": "aws_canonical_user_id",
+                "name": "this",
+                "provider_config_key": "aws",
+                "schema_version": 0
+              },
+              {
+                "address": "data.aws_elb_service_account.this",
+                "mode": "data",
+                "type": "aws_elb_service_account",
+                "name": "this",
+                "provider_config_key": "aws",
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "var.attach_elb_log_delivery_policy"
+                  ]
+                }
+              },
+              {
+                "address": "data.aws_iam_policy_document.combined",
+                "mode": "data",
+                "type": "aws_iam_policy_document",
+                "name": "combined",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "source_policy_documents": {
+                    "references": [
+                      "var.attach_elb_log_delivery_policy",
+                      "data.aws_iam_policy_document.elb_log_delivery[0].json",
+                      "data.aws_iam_policy_document.elb_log_delivery[0]",
+                      "data.aws_iam_policy_document.elb_log_delivery",
+                      "var.attach_lb_log_delivery_policy",
+                      "data.aws_iam_policy_document.lb_log_delivery[0].json",
+                      "data.aws_iam_policy_document.lb_log_delivery[0]",
+                      "data.aws_iam_policy_document.lb_log_delivery",
+                      "var.attach_require_latest_tls_policy",
+                      "data.aws_iam_policy_document.require_latest_tls[0].json",
+                      "data.aws_iam_policy_document.require_latest_tls[0]",
+                      "data.aws_iam_policy_document.require_latest_tls",
+                      "var.attach_deny_insecure_transport_policy",
+                      "data.aws_iam_policy_document.deny_insecure_transport[0].json",
+                      "data.aws_iam_policy_document.deny_insecure_transport[0]",
+                      "data.aws_iam_policy_document.deny_insecure_transport",
+                      "var.attach_policy",
+                      "var.policy"
+                    ]
+                  }
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "local.attach_policy"
+                  ]
+                }
+              },
+              {
+                "address": "data.aws_iam_policy_document.deny_insecure_transport",
+                "mode": "data",
+                "type": "aws_iam_policy_document",
+                "name": "deny_insecure_transport",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "statement": [
+                    {
+                      "actions": {
+                        "constant_value": [
+                          "s3:*"
+                        ]
+                      },
+                      "condition": [
+                        {
+                          "test": {
+                            "constant_value": "Bool"
+                          },
+                          "values": {
+                            "constant_value": [
+                              "false"
+                            ]
+                          },
+                          "variable": {
+                            "constant_value": "aws:SecureTransport"
+                          }
+                        }
+                      ],
+                      "effect": {
+                        "constant_value": "Deny"
+                      },
+                      "principals": [
+                        {
+                          "identifiers": {
+                            "constant_value": [
+                              "*"
+                            ]
+                          },
+                          "type": {
+                            "constant_value": "*"
+                          }
+                        }
+                      ],
+                      "resources": {
+                        "references": [
+                          "aws_s3_bucket.this[0].arn",
+                          "aws_s3_bucket.this[0]",
+                          "aws_s3_bucket.this",
+                          "aws_s3_bucket.this[0].arn",
+                          "aws_s3_bucket.this[0]",
+                          "aws_s3_bucket.this"
+                        ]
+                      },
+                      "sid": {
+                        "constant_value": "denyInsecureTransport"
+                      }
+                    }
+                  ]
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "var.attach_deny_insecure_transport_policy"
+                  ]
+                }
+              },
+              {
+                "address": "data.aws_iam_policy_document.elb_log_delivery",
+                "mode": "data",
+                "type": "aws_iam_policy_document",
+                "name": "elb_log_delivery",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "statement": [
+                    {
+                      "actions": {
+                        "constant_value": [
+                          "s3:PutObject"
+                        ]
+                      },
+                      "effect": {
+                        "constant_value": "Allow"
+                      },
+                      "principals": [
+                        {
+                          "identifiers": {
+                            "references": [
+                              "data.aws_elb_service_account.this"
+                            ]
+                          },
+                          "type": {
+                            "constant_value": "AWS"
+                          }
+                        }
+                      ],
+                      "resources": {
+                        "references": [
+                          "aws_s3_bucket.this[0].arn",
+                          "aws_s3_bucket.this[0]",
+                          "aws_s3_bucket.this"
+                        ]
+                      },
+                      "sid": {
+                        "constant_value": ""
+                      }
+                    }
+                  ]
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "var.attach_elb_log_delivery_policy"
+                  ]
+                }
+              },
+              {
+                "address": "data.aws_iam_policy_document.lb_log_delivery",
+                "mode": "data",
+                "type": "aws_iam_policy_document",
+                "name": "lb_log_delivery",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "statement": [
+                    {
+                      "actions": {
+                        "constant_value": [
+                          "s3:PutObject"
+                        ]
+                      },
+                      "condition": [
+                        {
+                          "test": {
+                            "constant_value": "StringEquals"
+                          },
+                          "values": {
+                            "constant_value": [
+                              "bucket-owner-full-control"
+                            ]
+                          },
+                          "variable": {
+                            "constant_value": "s3:x-amz-acl"
+                          }
+                        }
+                      ],
+                      "effect": {
+                        "constant_value": "Allow"
+                      },
+                      "principals": [
+                        {
+                          "identifiers": {
+                            "constant_value": [
+                              "delivery.logs.amazonaws.com"
+                            ]
+                          },
+                          "type": {
+                            "constant_value": "Service"
+                          }
+                        }
+                      ],
+                      "resources": {
+                        "references": [
+                          "aws_s3_bucket.this[0].arn",
+                          "aws_s3_bucket.this[0]",
+                          "aws_s3_bucket.this"
+                        ]
+                      },
+                      "sid": {
+                        "constant_value": "AWSLogDeliveryWrite"
+                      }
+                    },
+                    {
+                      "actions": {
+                        "constant_value": [
+                          "s3:GetBucketAcl"
+                        ]
+                      },
+                      "effect": {
+                        "constant_value": "Allow"
+                      },
+                      "principals": [
+                        {
+                          "identifiers": {
+                            "constant_value": [
+                              "delivery.logs.amazonaws.com"
+                            ]
+                          },
+                          "type": {
+                            "constant_value": "Service"
+                          }
+                        }
+                      ],
+                      "resources": {
+                        "references": [
+                          "aws_s3_bucket.this[0].arn",
+                          "aws_s3_bucket.this[0]",
+                          "aws_s3_bucket.this"
+                        ]
+                      },
+                      "sid": {
+                        "constant_value": "AWSLogDeliveryAclCheck"
+                      }
+                    }
+                  ]
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "var.attach_lb_log_delivery_policy"
+                  ]
+                }
+              },
+              {
+                "address": "data.aws_iam_policy_document.require_latest_tls",
+                "mode": "data",
+                "type": "aws_iam_policy_document",
+                "name": "require_latest_tls",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "statement": [
+                    {
+                      "actions": {
+                        "constant_value": [
+                          "s3:*"
+                        ]
+                      },
+                      "condition": [
+                        {
+                          "test": {
+                            "constant_value": "NumericLessThan"
+                          },
+                          "values": {
+                            "constant_value": [
+                              "1.2"
+                            ]
+                          },
+                          "variable": {
+                            "constant_value": "s3:TlsVersion"
+                          }
+                        }
+                      ],
+                      "effect": {
+                        "constant_value": "Deny"
+                      },
+                      "principals": [
+                        {
+                          "identifiers": {
+                            "constant_value": [
+                              "*"
+                            ]
+                          },
+                          "type": {
+                            "constant_value": "*"
+                          }
+                        }
+                      ],
+                      "resources": {
+                        "references": [
+                          "aws_s3_bucket.this[0].arn",
+                          "aws_s3_bucket.this[0]",
+                          "aws_s3_bucket.this",
+                          "aws_s3_bucket.this[0].arn",
+                          "aws_s3_bucket.this[0]",
+                          "aws_s3_bucket.this"
+                        ]
+                      },
+                      "sid": {
+                        "constant_value": "denyOutdatedTLS"
+                      }
+                    }
+                  ]
+                },
+                "schema_version": 0,
+                "count_expression": {
+                  "references": [
+                    "local.create_bucket",
+                    "var.attach_require_latest_tls_policy"
+                  ]
+                }
+              }
+            ],
+            "variables": {
+              "acceleration_status": {
+                "default": null,
+                "description": "(Optional) Sets the accelerate configuration of an existing bucket. Can be Enabled or Suspended."
+              },
+              "acl": {
+                "default": null,
+                "description": "(Optional) The canned ACL to apply. Conflicts with `grant`"
+              },
+              "attach_deny_insecure_transport_policy": {
+                "default": false,
+                "description": "Controls if S3 bucket should have deny non-SSL transport policy attached"
+              },
+              "attach_elb_log_delivery_policy": {
+                "default": false,
+                "description": "Controls if S3 bucket should have ELB log delivery policy attached"
+              },
+              "attach_lb_log_delivery_policy": {
+                "default": false,
+                "description": "Controls if S3 bucket should have ALB/NLB log delivery policy attached"
+              },
+              "attach_policy": {
+                "default": false,
+                "description": "Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy)"
+              },
+              "attach_public_policy": {
+                "default": true,
+                "description": "Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket)"
+              },
+              "attach_require_latest_tls_policy": {
+                "default": false,
+                "description": "Controls if S3 bucket should require the latest version of TLS"
+              },
+              "block_public_acls": {
+                "default": false,
+                "description": "Whether Amazon S3 should block public ACLs for this bucket."
+              },
+              "block_public_policy": {
+                "default": false,
+                "description": "Whether Amazon S3 should block public bucket policies for this bucket."
+              },
+              "bucket": {
+                "default": null,
+                "description": "(Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name."
+              },
+              "bucket_prefix": {
+                "default": null,
+                "description": "(Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket."
+              },
+              "control_object_ownership": {
+                "default": false,
+                "description": "Whether to manage S3 Bucket Ownership Controls on this bucket."
+              },
+              "cors_rule": {
+                "default": [],
+                "description": "List of maps containing rules for Cross-Origin Resource Sharing."
+              },
+              "create_bucket": {
+                "default": true,
+                "description": "Controls if S3 bucket should be created"
+              },
+              "expected_bucket_owner": {
+                "default": null,
+                "description": "The account ID of the expected bucket owner"
+              },
+              "force_destroy": {
+                "default": false,
+                "description": "(Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable."
+              },
+              "grant": {
+                "default": [],
+                "description": "An ACL policy grant. Conflicts with `acl`"
+              },
+              "ignore_public_acls": {
+                "default": false,
+                "description": "Whether Amazon S3 should ignore public ACLs for this bucket."
+              },
+              "intelligent_tiering": {
+                "default": {},
+                "description": "Map containing intelligent tiering configuration."
+              },
+              "lifecycle_rule": {
+                "default": [],
+                "description": "List of maps containing configuration of object lifecycle management."
+              },
+              "logging": {
+                "default": {},
+                "description": "Map containing access bucket logging configuration."
+              },
+              "object_lock_configuration": {
+                "default": {},
+                "description": "Map containing S3 object locking configuration."
+              },
+              "object_lock_enabled": {
+                "default": false,
+                "description": "Whether S3 bucket should have an Object Lock configuration enabled."
+              },
+              "object_ownership": {
+                "default": "ObjectWriter",
+                "description": "Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL."
+              },
+              "owner": {
+                "default": {},
+                "description": "Bucket owner's display name and ID. Conflicts with `acl`"
+              },
+              "policy": {
+                "default": null,
+                "description": "(Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide."
+              },
+              "putin_khuylo": {
+                "default": true,
+                "description": "Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!"
+              },
+              "replication_configuration": {
+                "default": {},
+                "description": "Map containing cross-region replication configuration."
+              },
+              "request_payer": {
+                "default": null,
+                "description": "(Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information."
+              },
+              "restrict_public_buckets": {
+                "default": false,
+                "description": "Whether Amazon S3 should restrict public bucket policies for this bucket."
+              },
+              "server_side_encryption_configuration": {
+                "default": {},
+                "description": "Map containing server-side encryption configuration."
+              },
+              "tags": {
+                "default": {},
+                "description": "(Optional) A mapping of tags to assign to the bucket."
+              },
+              "versioning": {
+                "default": {},
+                "description": "Map containing versioning configuration."
+              },
+              "website": {
+                "default": {},
+                "description": "Map containing static web-site hosting or redirect configuration."
+              }
+            }
+          }
+        },
+        "s3_module": {
+          "source": "./module",
+          "module": {
+            "resources": [
+              {
+                "address": "aws_s3_bucket.module_bucket",
+                "mode": "managed",
+                "type": "aws_s3_bucket",
+                "name": "module_bucket",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "bucket": {
+                    "constant_value": "testing"
+                  }
+                },
+                "schema_version": 0
+              },
+              {
+                "address": "aws_s3_bucket_public_access_block.module_bucket",
+                "mode": "managed",
+                "type": "aws_s3_bucket_public_access_block",
+                "name": "module_bucket",
+                "provider_config_key": "aws",
+                "expressions": {
+                  "block_public_acls": {
+                    "constant_value": true
+                  },
+                  "block_public_policy": {
+                    "constant_value": true
+                  },
+                  "bucket": {
+                    "references": [
+                      "aws_s3_bucket.module_bucket.id",
+                      "aws_s3_bucket.module_bucket"
+                    ]
+                  },
+                  "ignore_public_acls": {
+                    "constant_value": true
+                  },
+                  "restrict_public_buckets": {
+                    "constant_value": true
+                  }
+                },
+                "schema_version": 0
+              }
+            ],
+            "module_calls": {
+              "s3_submodule": {
+                "source": "./sub",
+                "module": {
+                  "resources": [
+                    {
+                      "address": "aws_s3_bucket.submodule_bucket",
+                      "mode": "managed",
+                      "type": "aws_s3_bucket",
+                      "name": "submodule_bucket",
+                      "provider_config_key": "aws",
+                      "expressions": {
+                        "bucket": {
+                          "constant_value": "testing"
+                        }
+                      },
+                      "schema_version": 0
+                    },
+                    {
+                      "address": "aws_s3_bucket_public_access_block.submodule_bucket",
+                      "mode": "managed",
+                      "type": "aws_s3_bucket_public_access_block",
+                      "name": "submodule_bucket",
+                      "provider_config_key": "aws",
+                      "expressions": {
+                        "block_public_acls": {
+                          "constant_value": true
+                        },
+                        "block_public_policy": {
+                          "constant_value": true
+                        },
+                        "bucket": {
+                          "references": [
+                            "aws_s3_bucket.submodule_bucket.id",
+                            "aws_s3_bucket.submodule_bucket"
+                          ]
+                        },
+                        "ignore_public_acls": {
+                          "constant_value": true
+                        },
+                        "restrict_public_buckets": {
+                          "constant_value": true
+                        }
+                      },
+                      "schema_version": 0
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "relevant_attributes": [
+    {
+      "resource": "module.s3_module.module.s3_submodule.aws_s3_bucket.submodule_bucket",
+      "attribute": [
+        "id"
+      ]
+    },
+    {
+      "resource": "module.s3_bucket.aws_s3_bucket.this[0]",
+      "attribute": [
+        "id"
+      ]
+    },
+    {
+      "resource": "module.s3_bucket.data.aws_canonical_user_id.this",
+      "attribute": [
+        "id"
+      ]
+    },
+    {
+      "resource": "module.s3_bucket.aws_s3_bucket.this[0]",
+      "attribute": [
+        "bucket_domain_name"
+      ]
+    },
+    {
+      "resource": "module.s3_bucket.aws_s3_bucket_website_configuration.this[0]",
+      "attribute": [
+        "website_endpoint"
+      ]
+    },
+    {
+      "resource": "module.s3_module.aws_s3_bucket.module_bucket",
+      "attribute": [
+        "id"
+      ]
+    },
+    {
+      "resource": "module.s3_bucket.aws_s3_bucket_policy.this[0]",
+      "attribute": [
+        "id"
+      ]
+    },
+    {
+      "resource": "module.s3_bucket.aws_s3_bucket.this[0]",
+      "attribute": [
+        "bucket_regional_domain_name"
+      ]
+    },
+    {
+      "resource": "module.s3_bucket.aws_s3_bucket.this[0]",
+      "attribute": [
+        "hosted_zone_id"
+      ]
+    },
+    {
+      "resource": "module.s3_bucket.aws_s3_bucket.this[0]",
+      "attribute": [
+        "region"
+      ]
+    },
+    {
+      "resource": "module.s3_bucket.aws_s3_bucket.this[0]",
+      "attribute": [
+        "arn"
+      ]
+    },
+    {
+      "resource": "module.s3_bucket.aws_s3_bucket_website_configuration.this[0]",
+      "attribute": [
+        "website_domain"
+      ]
+    },
+    {
+      "resource": "aws_s3_bucket.root_bucket",
+      "attribute": [
+        "id"
+      ]
+    }
+  ]
+}
diff --git a/tests/terraform/runner/test_plan_runner.py b/tests/terraform/runner/test_plan_runner.py
--- a/tests/terraform/runner/test_plan_runner.py
+++ b/tests/terraform/runner/test_plan_runner.py
@@ -606,6 +606,36 @@ def test_runner_extra_check(self):
         resource_ids = [check.resource for check in report.failed_checks]
         self.assertCountEqual(resource_ids,["aws_secretsmanager_secret.default", "aws_secretsmanager_secret.default"])
 
+    def test_runner_nested_child_modules_with_connections(self):
+        # given
+        tf_file_path = Path(__file__).parent / "resources/plan_nested_child_modules_with_connections/tfplan.json"
+
+        passing_resources = {
+            "aws_s3_bucket.submodule_bucket",
+            "aws_s3_bucket.module_bucket",
+            "aws_s3_bucket.root_bucket",
+        }
+        failing_resources = {
+            "aws_s3_bucket.this",
+        }
+
+        # when
+        report = Runner().run(
+            root_folder=None,
+            files=[str(tf_file_path)],
+            external_checks_dir=None,
+            runner_filter=RunnerFilter(framework=["terraform_plan"], checks=["CKV2_AWS_6"]),
+        )
+
+        # then
+        self.assertEqual(len(report.passed_checks), 3)
+        self.assertEqual(len(report.failed_checks), 1)
+
+        passed_check_resources = {c.resource for c in report.passed_checks}
+        failed_check_resources = {c.resource for c in report.failed_checks}
+
+        self.assertEqual(passing_resources, passed_check_resources)
+        self.assertEqual(failing_resources, failed_check_resources)
 
     def tearDown(self) -> None:
         resource_registry.checks = self.orig_checks