Repository: bridgecrewio/checkov

Issue:
Details has not been printed
**Describe the issue**
I'm trying to add details to a custom policy, but it has not been printed.
Run: On MacOS and on Github Action checkov-action@v12.1943.0
Version: 2.2.168
**Additional context**

  MANDATORY_TAGS = [
      "Application",
	  "Env",
	  "Team",
  ]
  
  
  class MandatoryTags(BaseResourceCheck):

      def __init__(self):
          name = "Ensure all resources has madatory tags"
          id = "CUSTOM_AWS_001"
          supported_resources = ['aws_kms_key']
          categories = [CheckCategories.GENERAL_SECURITY]
          guideline = "Check page blah blah"
          super().__init__(name=name, id=id, categories=categories,
                supported_resources=supported_resources, guideline=guideline)
  
      def scan_resource_conf(self, conf):
          if 'tags_all' in conf.keys():
              resource_tags = list(conf['tags_all'][0].keys())
              if not all(tag in resource_tags for tag in MANDATORY_TAGS):
                  self.details.append("default_tags need to be set on provider level")
                  return CheckResult.FAILED
              return CheckResult.PASSED
   
  
  
  check = MandatoryTags()
  
  ** output **
  `                "check_id": "CUSTOM_AWS_001",
                "bc_check_id": null,
                "check_name": "Ensure all resources has mandatory tags",
                "check_result": {
                    "result": "FAILED",
                    "evaluated_keys": []
                },
                "code_block": [...],
                "file_path": "/plan_fmt.json",
                "file_abs_path": "/private/tmp/platform-checkov-custom-policies/plan_fmt.json",
                "repo_file_path": "/plan_fmt.json",
                "file_line_range": [...],
                "resource": "aws_kms_key.default",
                "evaluations": null,
                "check_class": "CheckMandatoryTags",
                "fixed_definition": null,
                "entity_tags": null,
                "caller_file_path": null,
                "caller_file_line_range": null,
                "resource_address": "aws_kms_key.default",
                "severity": null,
                "bc_category": null,
                "benchmarks": null,
                "description": null,
                "short_description": null,
                "vulnerability_details": null,
                "connected_node": null,
                "guideline": "",
                "details": [],
                "check_len": null
            },`

In the output, it shows the details list as empty.



Discussion:
hey @juliopedrosa thanks for reaching out. Which output format did you choose exactly, `json`? Does it show up in the normal CLI output?
Hey, @gruebel It doesn't show on both. Follow bellow the regular cli output

Check: CUSTOM_AWS_001: "Ensure all resources have mandatory tags"
        PASSED for resource: aws_kms_key.default
        File: /plan_fmt.json:4191-4216
Check: CUSTOM_AWS_001: "Ensure all resources have mandatory tags"
        FAILED for resource: aws_kms_key.default
        File: /plan_fmt.json:4191-4216

I've also printed the details in the log and the string is appended to the **details** list but checkov doesn't show:
```
  def scan_resource_conf(self, conf):
      if 'tags_all' in conf.keys():
          resource_tags = list(conf['tags_all'][0].keys())
          if not all(tag in resource_tags for tag in MANDATORY_TAGS):
              self.details.append("default_tags need to be set on provider level")
              print(self.details)
              return CheckResult.FAILED
          return CheckResult.PASSED
```

**output**
['default_tags need to be set on provider level']
terraform_plan scan results:

Passed checks: 0, Failed checks: 1, Skipped checks: 0

Check: CUSTOM_AWS_001: "Ensure all resources have mandatory tags"
        FAILED for resource: aws_kms_key.default
        File: /plan_fmt.json:4191-4216

found the issue, thanks. The details were just added for normal Terraform scans and not for Terraform plan scans.

Resolving patch:
diff --git a/checkov/terraform/plan_runner.py b/checkov/terraform/plan_runner.py
--- a/checkov/terraform/plan_runner.py
+++ b/checkov/terraform/plan_runner.py
@@ -195,18 +195,30 @@ def run_block(self, entities,
                     if check.id in TF_LIFECYCLE_CHECK_IDS:
                         # can't be evaluated in TF plan
                         continue
-                    censored_code_lines = omit_secret_value_from_checks(check=check,
-                                                                        check_result=check_result,
-                                                                        entity_code_lines=entity_code_lines,
-                                                                        entity_config=entity_config,
-                                                                        resource_attributes_to_omit=RESOURCE_ATTRIBUTES_TO_OMIT)
-                    record = Record(check_id=check.id, bc_check_id=check.bc_id, check_name=check.name,
-                                    check_result=check_result,
-                                    code_block=censored_code_lines, file_path=scanned_file,
-                                    file_line_range=entity_lines_range,
-                                    resource=entity_id, resource_address=entity_address, evaluations=None,
-                                    check_class=check.__class__.__module__, file_abs_path=full_file_path,
-                                    severity=check.severity)
+
+                    censored_code_lines = omit_secret_value_from_checks(
+                        check=check,
+                        check_result=check_result,
+                        entity_code_lines=entity_code_lines,
+                        entity_config=entity_config,
+                        resource_attributes_to_omit=RESOURCE_ATTRIBUTES_TO_OMIT
+                    )
+                    record = Record(
+                        check_id=check.id,
+                        bc_check_id=check.bc_id,
+                        check_name=check.name,
+                        check_result=check_result,
+                        code_block=censored_code_lines,
+                        file_path=scanned_file,
+                        file_line_range=entity_lines_range,
+                        resource=entity_id,
+                        resource_address=entity_address,
+                        evaluations=None,
+                        check_class=check.__class__.__module__,
+                        file_abs_path=full_file_path,
+                        severity=check.severity,
+                        details=check.details,
+                    )
                     record.set_guideline(check.guideline)
                     report.add_record(record=record)
 


Test patch:
diff --git a/tests/terraform/runner/extra_tf_plan_checks/secret_not_deleted.py b/tests/terraform/runner/extra_tf_plan_checks/secret_not_deleted.py
--- a/tests/terraform/runner/extra_tf_plan_checks/secret_not_deleted.py
+++ b/tests/terraform/runner/extra_tf_plan_checks/secret_not_deleted.py
@@ -18,6 +18,7 @@ def __init__(self) -> None:
     def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
         actions = conf.get(TF_PLAN_RESOURCE_CHANGE_ACTIONS)
         if isinstance(actions, list) and "delete" in actions:
+            self.details.append("some great details")
             return CheckResult.FAILED
         return CheckResult.PASSED
 
diff --git a/tests/terraform/runner/test_plan_runner.py b/tests/terraform/runner/test_plan_runner.py
--- a/tests/terraform/runner/test_plan_runner.py
+++ b/tests/terraform/runner/test_plan_runner.py
@@ -593,6 +593,10 @@ def test_runner_extra_check(self):
         resource_ids = [check.resource for check in report.failed_checks]
         self.assertCountEqual(resource_ids,["aws_secretsmanager_secret.default", "aws_secretsmanager_secret.default"])
 
+        # check also the details
+        failed_check = next(check for check in report.failed_checks if check.check_id == "CUSTOM_DELETE_1")
+        self.assertEqual(failed_check.details, ["some great details"])
+
     def test_runner_nested_child_modules_with_connections(self):
         # given
         tf_file_path = Path(__file__).parent / "resources/plan_nested_child_modules_with_connections/tfplan.json"