Repository: bridgecrewio/checkov

Issue:
Skip annotations are sometimes ignored in terraform_plan mode
**Describe the bug**

The  [handle_skipped_checks loop](https://github.com/bridgecrewio/checkov/blob/2.0.324/checkov/common/output/report.py#L348) removes elements from a list it is iterating on. This can cause some skip annotations to be ignored, making Checkov report findings as failures even if there is a comment on the resource asking for the finding to be suppressed.


**To Reproduce**
Steps to reproduce the behavior:
1. Create a plan file from the following HCL:

```
provider "aws" {
  region = "us-west-2"
}

resource "aws_s3_bucket" "bucket" {
  # checkov:skip=CKV_AWS_20: skip this
  acl = "public-read"
}

resource "aws_dynamodb_table" "table" {
  # checkov:skip=CKV_AWS_28: and also this
  name     = "table"
  hash_key = "UserId"
  attribute {
    name = "UserId"
    type = "S"
  }
}
```

2. Run Checkov against the plan, with enrichment on:

```
checkov -f tf.json --repo-root-for-plan-enrichment . --check CKV_AWS_20,CKV_AWS_28
```

**Expected behavior**

Both CKV_AWS_20 and CKV_AWS_28 should be skipped, but only one (CKV_AWS_28) is. CKV_AWS_20 is still reported as a failure.

**Screenshots**
<img width="588" alt="Screen Shot 2021-08-02 at 12 37 04 AM" src="https://user-images.githubusercontent.com/4899032/127822093-861db2e6-5df5-43bd-b9a8-6eb8fbf5c88b.png">


If applicable, add screenshots to help explain your problem.

**Desktop (please complete the following information):**
 - OS: [macOS]
 - Checkov Version [2.0.225]




Discussion:

Resolving patch:
diff --git a/checkov/common/output/report.py b/checkov/common/output/report.py
--- a/checkov/common/output/report.py
+++ b/checkov/common/output/report.py
@@ -337,17 +337,23 @@ def enrich_plan_report(
     def handle_skipped_checks(
         report: "Report", enriched_resources: Dict[str, Dict[str, Any]]
     ) -> "Report":
+        skip_records = []
         for record in report.failed_checks:
             resource_skips = enriched_resources.get(record.resource, {}).get(
                 "skipped_checks", []
             )
             for skip in resource_skips:
                 if record.check_id in skip["id"]:
-                    # Remove and re-add the record to make Checkov mark it as skipped
-                    report.failed_checks.remove(record)
+                    # Mark for removal and add it as a skipped record. It is not safe to remove
+                    # the record from failed_checks immediately because we're iterating over it
+                    skip_records.append(record)
                     record.check_result["result"] = CheckResult.SKIPPED
                     record.check_result["suppress_comment"] = skip["suppress_comment"]
                     report.add_record(record)
+
+        for record in skip_records:
+            if record in report.failed_checks:
+                report.failed_checks.remove(record)
         return report
 
 


Test patch:
diff --git a/tests/common/runner_registry/test_runner_registry_plan_enrichment.py b/tests/common/runner_registry/test_runner_registry_plan_enrichment.py
--- a/tests/common/runner_registry/test_runner_registry_plan_enrichment.py
+++ b/tests/common/runner_registry/test_runner_registry_plan_enrichment.py
@@ -9,6 +9,7 @@
 
 
 class TestRunnerRegistryEnrichment(unittest.TestCase):
+
     def test_enrichment_of_plan_report(self):
         allowed_checks = ["CKV_AWS_19", "CKV_AWS_20", "CKV_AWS_28", "CKV_AWS_63", "CKV_AWS_119"]
         runner_registry = RunnerRegistry(
@@ -139,6 +140,25 @@ def test_enrichment_of_plan_report_with_modules(self):
         self.assertEqual(skipped_check_ids, expected_skipped_check_ids)
         self.assertEqual(enriched_data, expected_enriched_data)
 
+    def test_skip_check(self):
+        allowed_checks = ["CKV_AWS_20", "CKV_AWS_28"]
+        runner_registry = RunnerRegistry(
+            banner, RunnerFilter(checks=allowed_checks, framework="terraform_plan"), tf_plan_runner()
+        )
+
+        repo_root = Path(__file__).parent / "plan_with_hcl_for_enrichment"
+        valid_plan_path = repo_root / "tfplan.json"
+
+        report = runner_registry.run(repo_root_for_plan_enrichment=repo_root, files=[valid_plan_path])[0]
+
+        failed_check_ids = {c.check_id for c in report.failed_checks}
+        skipped_check_ids = {c.check_id for c in report.skipped_checks}
+        expected_skipped_check_ids = {"CKV_AWS_20", "CKV_AWS_28"}
+
+        self.assertEqual(len(failed_check_ids), 0)
+        self.assertEqual(len(skipped_check_ids), 2)
+        self.assertEqual(skipped_check_ids, expected_skipped_check_ids)
+
 
 if __name__ == "__main__":
     unittest.main()