Repository: bridgecrewio/checkov

Issue:
[CKV_AZURE_6] AKS API Server White Tests Failing with Correct Code
**Describe the issue**
[CKV_AZURE_6](https://github.com/bridgecrewio/checkov/tree/master/checkov/arm/checks/resource/AKSApiServerAuthorizedIpRanges.py)

This check should trigger when an API Server whitelist IP isn't found in the TF code. 

**Examples**
Please share an example code sample (in the IaC of your choice) + the expected outcomes.

Sample (Pre 3.39.0 Provider Version):
```
resource "azurerm_kubernetes_cluster" "aks_k2" {
  name = var.cluster_name
  location = azurerm_resource_group.rg_aks.location
  resource_group_name = azurerm_resource_group.rg_aks.name
  sku_tier = var.sku_tier
  dns_prefix = var.dns_name
  api_server_authorized_ip_ranges = [my_ip_list]
}
```
Sample (Post 3.39.0):
```
resource "azurerm_kubernetes_cluster" "aks_k2" {
  name = var.cluster_name
  location = azurerm_resource_group.rg_aks.location
  resource_group_name = azurerm_resource_group.rg_aks.name
  sku_tier = var.sku_tier
  dns_prefix = var.dns_name
  api_server_access_profile {
    authorized_ip_ranges = [my_ip_list]
  }
}
```

Both have expected outcome of passing this test, as we list 4 IP's for whitelisting.
We are failing tests
![image](https://github.com/bridgecrewio/checkov/assets/6209424/5a7a32d7-d9bb-4759-b7f1-32e206b4bd70)

**Version (please complete the following information):**
 - Checkov Version: checkov-2.3.272



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py b/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py
--- a/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py
+++ b/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py
@@ -16,7 +16,7 @@ def __init__(self) -> None:
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
     def get_inspected_key(self) -> str:
-        return "api_server_authorized_ip_ranges/[0]"
+        return "api_server_access_profile/[0]/authorized_ip_ranges/[0]"
 
     def get_expected_value(self) -> Any:
         return ANY_VALUE
@@ -26,6 +26,12 @@ def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:
         private_cluster_enabled = conf.get("private_cluster_enabled", [False])[0]
         if private_cluster_enabled:
             return CheckResult.PASSED
+
+        # provider version <=3.38.0
+        api_server = conf.get("api_server_authorized_ip_ranges")
+        if api_server and isinstance(api_server, list) and api_server[0]:
+            return CheckResult.PASSED
+
         return super().scan_resource_conf(conf)
 
 


Test patch:
diff --git a/tests/terraform/checks/resource/azure/example_AKSApiServerAuthorizedIpRanges/main.tf b/tests/terraform/checks/resource/azure/example_AKSApiServerAuthorizedIpRanges/main.tf
--- a/tests/terraform/checks/resource/azure/example_AKSApiServerAuthorizedIpRanges/main.tf
+++ b/tests/terraform/checks/resource/azure/example_AKSApiServerAuthorizedIpRanges/main.tf
@@ -38,6 +38,17 @@ resource "azurerm_kubernetes_cluster" "private" {
   private_cluster_enabled = true
 }
 
+resource "azurerm_kubernetes_cluster" "version_3_39" {
+  name                = "example"
+  location            = "azurerm_resource_group.example.location"
+  resource_group_name = "azurerm_resource_group.example.name"
+  dns_prefix          = "example"
+
+  api_server_access_profile {
+    authorized_ip_ranges = ["192.168.0.0/16"]
+  }
+}
+
 # fail
 
 resource "azurerm_kubernetes_cluster" "default" {
diff --git a/tests/terraform/checks/resource/azure/test_AKSApiServerAuthorizedIpRanges.py b/tests/terraform/checks/resource/azure/test_AKSApiServerAuthorizedIpRanges.py
--- a/tests/terraform/checks/resource/azure/test_AKSApiServerAuthorizedIpRanges.py
+++ b/tests/terraform/checks/resource/azure/test_AKSApiServerAuthorizedIpRanges.py
@@ -19,7 +19,8 @@ def test(self):
 
         passing_resources = {
             "azurerm_kubernetes_cluster.enabled",
-            "azurerm_kubernetes_cluster.private"
+            "azurerm_kubernetes_cluster.private",
+            "azurerm_kubernetes_cluster.version_3_39",
         }
 
         failing_resources = {
@@ -30,8 +31,8 @@ def test(self):
         passed_check_resources = {c.resource for c in report.passed_checks}
         failed_check_resources = {c.resource for c in report.failed_checks}
 
-        self.assertEqual(summary["passed"], 2)
-        self.assertEqual(summary["failed"], 2)
+        self.assertEqual(summary["passed"], len(passing_resources))
+        self.assertEqual(summary["failed"], len(failing_resources))
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)