Repository: bridgecrewio/checkov

Issue:
CKV2_AWS_27 not working as expected
**Describe the bug**
CKV2_AWS_27 throws a failure when configuration seems to be defined properly:

```
resource "aws_rds_cluster" "aurora_cluster" {
  # checkov:skip=CKV_AWS_139:Required only in prod, set with conditional on profile
  # checkov:skip=CKV2_AWS_8:Snapshots, deletion_protection and prevent_destroy are enough
  cluster_identifier                  = "bc-aurora-cluster"
  engine                              = "aurora-postgresql"
  engine_version                      = "11.9"
  database_name                       = xxxx
  master_username                     = xxxx
  master_password                     = xxxx
  backup_retention_period             = 5
  preferred_backup_window             = "07:00-09:00"
  deletion_protection                 = var.profile == "prod" ? true : false
  db_subnet_group_name                = aws_db_subnet_group.aurora_cluster_subnet_group.name
  vpc_security_group_ids              = [aws_security_group.aurora_cluster_sg.id]
  iam_database_authentication_enabled = "true"
  db_cluster_parameter_group_name     = aws_rds_cluster_parameter_group.aurora_cluster_parameter_group.name
  kms_key_id                          = aws_kms_key.aurora_cluster-kms-key.arn
  port                                = "5432"
  preferred_maintenance_window        = "Sun:03:00-Sun:07:00"
  storage_encrypted                   = "true"
  depends_on                          = [aws_db_subnet_group.aurora_cluster_subnet_group]

  lifecycle {
    prevent_destroy = true
  }
}

resource "aws_rds_cluster_parameter_group" "aurora_cluster_parameter_group" {
  description = "Aurora PG Database Instance Parameter Group"
  family      = "aurora-postgresql11"
  name        = "bc-aurora-cluster-sg-dbparamgroup"

  parameter {
    apply_method = "immediate"
    name         = "log_connections"
    value        = "1"
  }

  parameter {
    apply_method = "immediate"
    name         = "log_disconnections"
    value        = "1"
  }

  parameter {
    apply_method = "pending-reboot"
    name         = "track_activity_query_size"
    value        = "16384"
  }

  parameter {
    apply_method = "immediate"
    name         = "search_path"
    value        = "\"$user\",public"
  }

  parameter {
    apply_method = "pending-reboot"
    name         = "shared_preload_libraries"
    value        = "auto_explain,pg_stat_statements,pg_hint_plan,pgaudit"
  }

  parameter {
    apply_method = "immediate"
    name         = "idle_in_transaction_session_timeout"
    value        = "7200000"
  }

  parameter {
    apply_method = "immediate"
    name         = "log_min_duration_statement"
    value        = "5000"
  }

  parameter {
    apply_method = "immediate"
    name         = "log_rotation_age"
    value        = "1440"
  }

  parameter {
    apply_method = "immediate"
    name         = "rds.log_retention_period"
    value        = "10080"
  }

  parameter {
    apply_method = "immediate"
    name         = "auto_explain.log_verbose"
    value        = "1"
  }

  parameter {
    apply_method = "immediate"
    name         = "log_statement"
    value        = "ddl"
  }

  parameter {
    apply_method = "immediate"
    name         = "statement_timeout"
    value        = "7200000"
  }

  parameter {
    apply_method = "immediate"
    name         = "log_lock_waits"
    value        = "1"
  }

  parameter {
    apply_method = "immediate"
    name         = "random_page_cost"
    value        = "1"
  }

  parameter {
    apply_method = "immediate"
    name         = "auto_explain.log_min_duration"
    value        = "5000"
  }

  parameter {
    apply_method = "immediate"
    name         = "log_rotation_size"
    value        = "102400"
  }
}
```


**Expected behavior**
Should not fail when `db_cluster_parameter_group_name` is defined with parameters "log_statement" "log_min_duration_statement"

**Desktop (please complete the following information):**
 - OS: macOS Big Sur 11.5.2
 - Checkov Version 2.0.468




Discussion:
Thanks for adding the example 💪 , I found the problem and will create a fix tomorrow.

Resolving patch:
diff --git a/checkov/common/checks_infra/solvers/attribute_solvers/base_attribute_solver.py b/checkov/common/checks_infra/solvers/attribute_solvers/base_attribute_solver.py
--- a/checkov/common/checks_infra/solvers/attribute_solvers/base_attribute_solver.py
+++ b/checkov/common/checks_infra/solvers/attribute_solvers/base_attribute_solver.py
@@ -24,8 +24,8 @@ def __init__(self, resource_types: List[str], attribute: Optional[str], value: A
     def run(self, graph_connector: DiGraph) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]]]:
         executer = ThreadPoolExecutor()
         jobs = []
-        passed_vertices = []
-        failed_vertices = []
+        passed_vertices: List[Dict[str, Any]] = []
+        failed_vertices: List[Dict[str, Any]] = []
         for _, data in graph_connector.nodes(data=True):
             jobs.append(executer.submit(self._process_node, data, passed_vertices, failed_vertices))
 
@@ -51,7 +51,9 @@ def get_operation(self, vertex: Dict[str, Any]) -> bool:
     def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool:
         raise NotImplementedError
 
-    def _process_node(self, data, passed_vartices, failed_vertices):
+    def _process_node(
+        self, data: Dict[str, Any], passed_vartices: List[Dict[str, Any]], failed_vertices: List[Dict[str, Any]]
+    ) -> None:
         if not self.resource_type_pred(data, self.resource_types):
             return
         if self.get_operation(vertex=data):
@@ -61,7 +63,7 @@ def _process_node(self, data, passed_vartices, failed_vertices):
 
     @staticmethod
     def get_attribute_patterns(attribute: str) -> Tuple[Pattern[str], Pattern[str]]:
-        index_pattern = r"[\d+]"
+        index_pattern = r"[\d]+"
         split_by_dots = attribute.split(".")
 
         pattern_parts = []


Test patch:
diff --git a/tests/terraform/graph/checks/resources/PostgresRDSHasQueryLoggingEnabled/expected.yaml b/tests/terraform/graph/checks/resources/PostgresRDSHasQueryLoggingEnabled/expected.yaml
--- a/tests/terraform/graph/checks/resources/PostgresRDSHasQueryLoggingEnabled/expected.yaml
+++ b/tests/terraform/graph/checks/resources/PostgresRDSHasQueryLoggingEnabled/expected.yaml
@@ -1,5 +1,6 @@
 pass:
   - "aws_rds_cluster.pass"
+  - "aws_rds_cluster.pass_many_parameters"
 
 fail:
   - "aws_rds_cluster.fail"
diff --git a/tests/terraform/graph/checks/resources/PostgresRDSHasQueryLoggingEnabled/rds.tf b/tests/terraform/graph/checks/resources/PostgresRDSHasQueryLoggingEnabled/rds.tf
--- a/tests/terraform/graph/checks/resources/PostgresRDSHasQueryLoggingEnabled/rds.tf
+++ b/tests/terraform/graph/checks/resources/PostgresRDSHasQueryLoggingEnabled/rds.tf
@@ -27,6 +27,87 @@ resource "aws_rds_cluster_parameter_group" "pass" {
   }
 }
 
+# 10+ parameters
+
+resource "aws_rds_cluster" "pass_many_parameters" {
+  cluster_identifier      = "aurora-cluster-demo"
+  engine                  = "aurora-postgresql"
+  availability_zones      = ["us-west-2a", "us-west-2b", "us-west-2c"]
+  database_name           = "mydb"
+  master_username         = "foo"
+  master_password         = "bar"
+  backup_retention_period = 5
+  preferred_backup_window = "07:00-09:00"
+
+  db_cluster_parameter_group_name = aws_rds_cluster_parameter_group.pass_many_parameters.name
+}
+
+resource "aws_rds_cluster_parameter_group" "pass_many_parameters" {
+  name        = "rds-cluster-pg-pass"
+  family      = "aurora-postgresql11"
+  description = "RDS default cluster parameter group"
+
+  parameter {
+    name  = "fake_1"
+    value = "fake_1"
+  }
+
+  parameter {
+    name  = "fake_2"
+    value = "fake_2"
+  }
+
+  parameter {
+    name  = "fake_3"
+    value = "fake_3"
+  }
+
+  parameter {
+    name  = "fake_4"
+    value = "fake_4"
+  }
+
+  parameter {
+    name  = "fake_5"
+    value = "fake_5"
+  }
+
+  parameter {
+    name  = "fake_6"
+    value = "fake_6"
+  }
+
+  parameter {
+    name  = "fake_7"
+    value = "fake_7"
+  }
+
+  parameter {
+    name  = "fake_8"
+    value = "fake_8"
+  }
+
+  parameter {
+    name  = "fake_9"
+    value = "fake_9"
+  }
+
+  parameter {
+    name  = "fake_10"
+    value = "fake_10"
+  }
+
+  parameter {
+    name  = "log_statement"
+    value = "all"
+  }
+
+  parameter {
+    name  = "log_min_duration_statement"
+    value = "250ms"
+  }
+}
+
 resource "aws_rds_cluster" "fail" {
  cluster_identifier      = "aurora-cluster-demo"
   engine                  = "aurora-postgresql"