Repository: bridgecrewio/checkov

Issue:
terraform locals not expanded for non-default provider
**Describe the issue**
We created a custom check based on `BaseProviderCheck` that checks the contents of `default_tags` block. 
It fails for every non-default provider, due to locals not being expanded. 

**Examples**
```hcl
locals {
  tags = {
    test         = "Test"
  }
}
provider "aws" {
  default_tags {
    tags = local.tags
  }
}


provider "aws" {
  alias = "test"
  default_tags {
    tags = local.tags
  }
}
```
conf is reported as: 
```
{'__end_line__': 6, '__start_line__': 1, 'default_tags': [{'tags': [{'test': 'Test'}]}], '__address__': 'aws.default'}
{'__end_line__': 19, '__start_line__': 13, 'alias': ['test'], 'default_tags': [{'tags': ['${local.tags}']}], '__address__': 'aws.test'}
```
**Desktop (please complete the following information):**
 - OS: mac os / linux
 - Checkov Version: 2.3.251

**Additional context**




Discussion:
hey @tommywo thanks for reaching out.

I can verify it is a bug on our side.

Resolving patch:
diff --git a/checkov/terraform/graph_builder/local_graph.py b/checkov/terraform/graph_builder/local_graph.py
--- a/checkov/terraform/graph_builder/local_graph.py
+++ b/checkov/terraform/graph_builder/local_graph.py
@@ -499,9 +499,13 @@ def update_vertex_config(self, vertex: TerraformBlock, changed_attributes: Union
             # skip, if there is no change
             return
 
+        vertex_name = vertex.name
         updated_config = deepcopy(vertex.config)
+        if vertex.block_type == BlockType.PROVIDER:
+            # provider blocks set the alias as a suffix to the name, ex. name: "aws.prod"
+            vertex_name = vertex_name.split(".")[0]
         if vertex.block_type != BlockType.LOCALS:
-            parts = vertex.name.split(".")
+            parts = vertex_name.split(".")
             start = 0
             end = 1
             while end <= len(parts):
@@ -510,17 +514,18 @@ def update_vertex_config(self, vertex: TerraformBlock, changed_attributes: Union
                     updated_config = updated_config[cur_key]
                     start = end
                 end += 1
+
         for changed_attribute in changed_attributes:
             new_value = vertex.attributes.get(changed_attribute, None)
             if new_value is not None:
                 if vertex.block_type == BlockType.LOCALS:
-                    changed_attribute = changed_attribute.replace(vertex.name + ".", "")
+                    changed_attribute = changed_attribute.replace(f"{vertex_name}.", "")
                 updated_config = update_dictionary_attribute(updated_config, changed_attribute, new_value, dynamic_blocks)
 
         if len(changed_attributes) > 0:
             if vertex.block_type == BlockType.LOCALS:
-                updated_config = updated_config.get(vertex.name)
-            update_dictionary_attribute(vertex.config, vertex.name, updated_config, dynamic_blocks)
+                updated_config = updated_config.get(vertex_name)
+            update_dictionary_attribute(vertex.config, vertex_name, updated_config, dynamic_blocks)
 
     def get_resources_types_in_graph(self) -> List[str]:
         return self.module.get_resources_types()


Test patch:
diff --git a/tests/terraform/graph/variable_rendering/expected_foreach_modules_tf_definitions.json b/tests/terraform/graph/variable_rendering/expected_foreach_modules_tf_definitions.json
--- a/tests/terraform/graph/variable_rendering/expected_foreach_modules_tf_definitions.json
+++ b/tests/terraform/graph/variable_rendering/expected_foreach_modules_tf_definitions.json
@@ -90,7 +90,7 @@
             "us-west-2"
           ],
           "test_provider": [
-            "${True}"
+            true
           ],
           "__address__": "aws.test_provider"
         }
diff --git a/tests/terraform/graph/variable_rendering/test_renderer.py b/tests/terraform/graph/variable_rendering/test_renderer.py
--- a/tests/terraform/graph/variable_rendering/test_renderer.py
+++ b/tests/terraform/graph/variable_rendering/test_renderer.py
@@ -457,3 +457,18 @@ def test_default_map_value(self):
             "ip_rules": [],
             "virtual_network_subnet_ids": []
         }
+
+    def test_provider_alias(self):
+        # given
+        resource_path = Path(TEST_DIRNAME) / "test_resources/provider_alias"
+
+        # when
+        graph_manager = TerraformGraphManager('m', ['m'])
+        local_graph, _ = graph_manager.build_graph_from_source_directory(str(resource_path), render_variables=True)
+
+        # then
+        provider = next(vertex for vertex in local_graph.vertices if vertex.block_type == BlockType.PROVIDER and vertex.name == "aws")
+        assert provider.config["aws"]["default_tags"] == [{"tags": [{"test": "Test"}]}]
+
+        provider_alias = next(vertex for vertex in local_graph.vertices if vertex.block_type == BlockType.PROVIDER and vertex.name == "aws.test")
+        assert provider_alias.config["aws"]["default_tags"] == [{"tags": [{"test": "Test"}]}]
diff --git a/tests/terraform/graph/variable_rendering/test_resources/provider_alias/main.tf b/tests/terraform/graph/variable_rendering/test_resources/provider_alias/main.tf
new file mode 100644
--- /dev/null
+++ b/tests/terraform/graph/variable_rendering/test_resources/provider_alias/main.tf
@@ -0,0 +1,19 @@
+locals {
+  tags = {
+    test = "Test"
+  }
+}
+
+provider "aws" {
+  default_tags {
+    tags = local.tags
+  }
+}
+
+
+provider "aws" {
+  alias = "test"
+  default_tags {
+    tags = local.tags
+  }
+}