Repository: bridgecrewio/checkov

Issue:
TypeError in SecretManagerSecret90days
**Describe the issue**
While running a scan on TF code, I'm getting a TypeError 


**Examples**
The relevant TF code is:
```
resource "aws_secretsmanager_secret_rotation" "rds_password_rotation" {
  secret_id           = aws_secretsmanager_secret.credentials.id
  rotation_lambda_arn = "arn:..."

  rotation_rules {
    automatically_after_days = var.db_password_rotation_days
  }

}

variable "db_password_rotation_days" {
  description = "Number of days in which the RDS password will be rotated"
  type = number
}

```
**Exception Trace**
```
Failed to run check CKV_AWS_304 on rds.tf:aws_secretsmanager_secret_rotation.rds_password_rotation
Traceback (most recent call last):
  File "\venv\Lib\site-packages\checkov\common\checks\base_check.py", line 73, in run
    check_result["result"] = self.scan_entity_conf(entity_configuration, entity_type)
                             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "\venv\Lib\site-packages\checkov\terraform\checks\resource\base_resource_check.py", line 43, in scan_entity_conf
    return self.scan_resource_conf(conf)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "\venv\Lib\site-packages\checkov\terraform\checks\resource\aws\SecretManagerSecret90days.py", line 20, in scan_resource_conf
    if days < 90:
       ^^^^^^^^^
TypeError: '<' not supported between instances of 'str' and 'int'     
```

**Desktop (please complete the following information):**
 - OS: Windows 10 for Workstation
 - Checkov Version 2.3.301

**Additional context**
I inspected the value of date at the line causing the error and it is the string `var.db_password_rotation_days`. 


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/SecretManagerSecret90days.py b/checkov/terraform/checks/resource/aws/SecretManagerSecret90days.py
--- a/checkov/terraform/checks/resource/aws/SecretManagerSecret90days.py
+++ b/checkov/terraform/checks/resource/aws/SecretManagerSecret90days.py
@@ -1,23 +1,27 @@
+from __future__ import annotations
 
+from typing import Any
+
+from checkov.common.util.type_forcers import force_int
 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
 from checkov.common.models.enums import CheckCategories, CheckResult
 
 
 class SecretManagerSecret90days(BaseResourceCheck):
-
-    def __init__(self):
+    def __init__(self) -> None:
         name = "Ensure Secrets Manager secrets should be rotated within 90 days"
         id = "CKV_AWS_304"
-        supported_resources = ["aws_secretsmanager_secret_rotation"]
-        categories = [CheckCategories.GENERAL_SECURITY]
+        supported_resources = ("aws_secretsmanager_secret_rotation",)
+        categories = (CheckCategories.GENERAL_SECURITY,)
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def scan_resource_conf(self, conf) -> CheckResult:
-        if conf.get("rotation_rules") and isinstance(conf.get("rotation_rules"), list):
-            rule = conf.get("rotation_rules")[0]
-            if rule.get('automatically_after_days') and isinstance(rule.get('automatically_after_days'), list):
-                days = rule.get('automatically_after_days')[0]
-                if days < 90:
+    def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:
+        rules = conf.get("rotation_rules")
+        if rules and isinstance(rules, list):
+            days = rules[0].get('automatically_after_days')
+            if days and isinstance(days, list):
+                days = force_int(days[0])
+                if days is not None and days < 90:
                     return CheckResult.PASSED
         return CheckResult.FAILED
 


Test patch:
diff --git a/tests/terraform/checks/resource/aws/example_SecretManagerSecret90days/main.tf b/tests/terraform/checks/resource/aws/example_SecretManagerSecret90days/main.tf
--- a/tests/terraform/checks/resource/aws/example_SecretManagerSecret90days/main.tf
+++ b/tests/terraform/checks/resource/aws/example_SecretManagerSecret90days/main.tf
@@ -14,4 +14,13 @@ resource "aws_secretsmanager_secret_rotation" "fail" {
   rotation_rules {
     automatically_after_days = 90
   }
-}
\ No newline at end of file
+}
+
+resource "aws_secretsmanager_secret_rotation" "fail_2" {
+  secret_id           = aws_secretsmanager_secret.example.id
+  rotation_lambda_arn = aws_lambda_function.example.arn
+
+  rotation_rules {
+    automatically_after_days = var.days
+  }
+}
diff --git a/tests/terraform/checks/resource/aws/test_SecretManagerSecret90days.py b/tests/terraform/checks/resource/aws/test_SecretManagerSecret90days.py
--- a/tests/terraform/checks/resource/aws/test_SecretManagerSecret90days.py
+++ b/tests/terraform/checks/resource/aws/test_SecretManagerSecret90days.py
@@ -20,10 +20,11 @@ def test(self):
         }
         failing_resources = {
             "aws_secretsmanager_secret_rotation.fail",
+            "aws_secretsmanager_secret_rotation.fail_2",
         }
 
-        passed_check_resources = set([c.resource for c in report.passed_checks])
-        failed_check_resources = set([c.resource for c in report.failed_checks])
+        passed_check_resources = {c.resource for c in report.passed_checks}
+        failed_check_resources = {c.resource for c in report.failed_checks}
 
         self.assertEqual(summary["passed"], len(passing_resources))
         self.assertEqual(summary["failed"], len(failing_resources))