Repository: bridgecrewio/checkov

Issue:
[bicep] output token not working
**Describe the issue**
Scan bicep files with outpouts let crash checkov

**Examples**
```bicep
param applicationName string

param env string = 'tst'

@description('Kind of the Storage Account. https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview')
@allowed([
  'StorageV2'
  'BlobStorage'
  'BlockBlobStorage'
  'FileStorage'
])
param kind string = 'StorageV2'

@description('Tier of your Azure Storage Account. https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview')
@allowed([
  'Premium_LRS'
  'Premium_ZRS'
  'Standard_GRS'
  'Standard_GZRS'
  'Standard_LRS'
  'Standard_RAGRS'
  'Standard_RAGZRS'
  'Standard_ZRS'
])
param sku string = 'Standard_LRS'

@description('NFS 3.0 protocol support enabled if set to true.')
param enableNfsV3 bool = false

@description('Account HierarchicalNamespace enabled if sets to true.')
param enabledHns bool = false

@description('Required for storage accounts where kind = BlobStorage. The access tier used for billing.')
@allowed([
  'Cool'
  'Hot'
])
param accessTier string = 'Hot'

//variables
var _storageAccountName = toLower('ST${applicationName}${env}')



//create the storage account only if it is valid combination of kind and sku
resource StorageAccount 'Microsoft.Storage/storageAccounts@2021-08-01' = {
  name: _storageAccountName
  location: resourceGroup().location
  kind: kind
  sku: {
    name: sku
  }
  properties: {
    isNfsV3Enabled: (startsWith(sku, 'Premium') ? enableNfsV3 : null)
    isHnsEnabled: ((enabledHns == true) ? enabledHns : null)
    accessTier: accessTier
    allowBlobPublicAccess: false
    supportsHttpsTrafficOnly: true
    minimumTlsVersion: 'TLS1_2'
    networkAcls: {
      bypass: 'AzureServices'
      defaultAction:'Deny'
    }
  }
}


//outputs
@description('Name of the created resource')
output ResourceName string = StorageAccount.name
@description('Id of the created resource')
output ResourceId string = StorageAccount.id
output ResourceSecretNameConnectionString string = Secret.outputs.ResourceName
```

**Exception Trace**
Please share the trace for the exception and all relevant output by checkov.
To maximize the understanding, please run checkov with LOG_LEVEL set to debug
as follows:
```sh
2022-04-04 12:36:34,006 [MainThread  ] [DEBUG]  Leveraging the bundled IAM Definition.
2022-04-04 12:36:34,011 [MainThread  ] [DEBUG]  Leveraging the IAM definition at /usr/local/lib/python3.10/site-packages/policy_sentry/shared/data/iam-definition.json
2022-04-04 12:36:35,203 [MainThread  ] [DEBUG]  Loading external checks from /usr/local/lib/python3.10/site-packages/checkov/bicep/checks/graph_checks
2022-04-04 12:36:35,491 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:36,260 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:36,514 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:36,515 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:36,866 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:36,941 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:37,255 [MainThread  ] [DEBUG]  Popen(['git', 'version'], cwd=/bicep, universal_newlines=False, shell=None, istream=None)
2022-04-04 12:36:37,287 [MainThread  ] [DEBUG]  Popen(['git', 'version'], cwd=/bicep, universal_newlines=False, shell=None, istream=None)
2022-04-04 12:36:37,498 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:39,097 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:39,160 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:39,165 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:39,179 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:39,208 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:39,214 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:39,215 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:39,221 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:40,346 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:40,350 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:40,351 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:40,353 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:40,353 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:40,376 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:40,384 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:40,415 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): all
2022-04-04 12:36:40,575 [MainThread  ] [DEBUG]  Checkov version: 2.0.1030
2022-04-04 12:36:40,576 [MainThread  ] [DEBUG]  Python executable: /usr/local/bin/python
2022-04-04 12:36:40,576 [MainThread  ] [DEBUG]  Python version: 3.10.4 (main, Mar 24 2022, 23:52:56) [GCC 10.3.1 20211027]
2022-04-04 12:36:40,577 [MainThread  ] [DEBUG]  Checkov executable (argv[0]): /usr/local/bin/checkov
2022-04-04 12:36:40,578 [MainThread  ] [DEBUG]  Command Line Args:   --directory /bicep --framework bicep
Defaults:
  --branch:          master
  --download-external-modules:False
  --external-modules-download-path:.external_modules
  --evaluate-variables:True

2022-04-04 12:36:40,578 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): bicep
2022-04-04 12:36:40,579 [MainThread  ] [DEBUG]  bicep_runner declares no system dependency checks required.
2022-04-04 12:36:40,579 [MainThread  ] [DEBUG]  No API key found. Scanning locally only.
2022-04-04 12:36:40,856 [MainThread  ] [DEBUG]  Got checkov mappings and guidelines from Bridgecrew BE
2022-04-04 12:36:40,860 [MainThread  ] [DEBUG]  Loading external checks from /usr/local/lib/python3.10/site-packages/checkov/terraform/checks/graph_checks
2022-04-04 12:36:40,861 [MainThread  ] [DEBUG]  Searching through ['aws', 'gcp', 'azure', '__pycache__'] and ['__init__.py']
2022-04-04 12:36:40,863 [MainThread  ] [DEBUG]  Searching through [] and ['PostgresRDSHasQueryLoggingEnabled.yaml', 'HTTPNotSendingPasswords.yaml', 'VPCHasRestrictedSG.yaml', 'AppSyncProtectedByWAF.yaml', 'AutoScallingEnabledELB.yaml', 'RDSClusterHasBackupPlan.yaml', 'WAF2HasLogs.yaml', 'APIProtectedByWAF.yaml', 'S3BucketHasPublicAccessBlock.yaml', 'GuardDutyIsEnabled.yaml', 'IAMGroupHasAtLeastOneUser.yaml', 'VPCHasFlowLog.yaml', 'AWSNATGatewaysshouldbeutilized.yaml', 'EncryptedEBSVolumeOnlyConnectedToEC2s.yaml', 'Route53ARecordAttachedResource.yaml', 'S3KMSEncryptedByDefault.yaml', 'IAMUserHasNoConsoleAccess.yaml', 'S3BucketLogging.yaml', 'IAMUsersAreMembersAtLeastOneGroup.yaml', 'S3PublicACLRead.yaml', 'S3BucketEncryption.yaml', 'SubnetHasACL.yaml', 'ALBProtectedByWAF.yaml', 'EFSAddedBackup.yaml', 'CloudtrailHasCloudwatch.yaml', 'S3PublicACLWrite.yaml', 'S3BucketVersioning.yaml', 'AutoScalingEnableOnDynamoDBTables.yaml', 'EBSAddedBackup.yaml', 'SGAttachedToResource.yaml', 'AWSSSMParameterShouldBeEncrypted.yaml', 'ALBRedirectsHTTPToHTTPS.yaml', 'AMRClustersNotOpenToInternet.yaml', 'PostgresDBHasQueryLoggingEnabled.yaml', 'EIPAllocatedToVPCAttachedEC2.yaml', 'CloudFrontHasSecurityHeadersPolicy.yaml', 'APIGWLoggingLevelsDefinedProperly.yaml']
2022-04-04 12:36:42,356 [MainThread  ] [DEBUG]  Searching through [] and ['GCPAuditLogsConfiguredForAllServicesAndUsers.yaml', 'GCPContainerRegistryReposAreNotPubliclyAccessible.yaml', 'GKEClustersAreNotUsingDefaultServiceAccount.yaml', 'GCPLogBucketsConfiguredUsingLock.yaml', 'GCPKMSCryptoKeysAreNotPubliclyAccessible.yaml', 'GCPKMSKeyRingsAreNotPubliclyAccessible.yaml', 'GCPProjectHasNoLegacyNetworks.yaml', 'DisableAccessToSqlDBInstanceForRootUsersWithoutPassword.yaml', 'ServiceAccountHasGCPmanagedKey.yaml']
2022-04-04 12:36:42,691 [MainThread  ] [DEBUG]  Searching through [] and ['PGSQLenablesCustomerManagedKey.yaml', 'AzureMSSQLServerHasSecurityAlertPolicy.yaml', 'VAconfiguredToSendReports.yaml', 'AzureDataFactoriesEncryptedWithCustomerManagedKey.yaml', 'AccessToPostgreSQLFromAzureServicesIsDisabled.yaml', 'StorageLoggingIsEnabledForTableService.yaml', 'AzureUnattachedDisksAreEncrypted.yaml', 'AzureNetworkInterfacePublicIPAddressId.yaml', 'AzureStorageAccountsUseCustomerManagedKeyForEncryption.yaml', 'StorageContainerActivityLogsNotPublic.yaml', 'SQLServerAuditingRetention90Days.yaml', 'VirtualMachinesUtilizingManagedDisks.yaml', 'VAsetPeriodicScansOnSQL.yaml', 'AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs.yaml', 'VAisEnabledInStorageAccount.yaml', 'MSQLenablesCustomerManagedKey.yaml', 'VMHasBackUpMachine.yaml', 'CognitiveServicesCustomerManagedKey.yaml', 'SQLServerAuditingEnabled.yaml', 'DataExplorerEncryptionUsesCustomKey.yaml', 'AzureActiveDirectoryAdminIsConfigured.yaml', 'AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.yaml', 'StorageCriticalDataEncryptedCMK.yaml', 'VAconfiguredToSendReportsToAdmins.yaml', 'StorageLoggingIsEnabledForBlobService.yaml']
2022-04-04 12:36:43,377 [MainThread  ] [DEBUG]  Searching through [] and ['__init__.cpython-310.pyc']
2022-04-04 12:37:57,898 [MainThread  ] [INFO ]  [bicep] start to parse 1 files
2022-04-04 12:37:59,337 [MainThread  ] [ERROR]  [bicep] Couldn't parse /bicep/storageAccounts.bicep
Traceback (most recent call last):
  File "/usr/local/lib/python3.10/site-packages/lark/lexer.py", line 528, in lex
    yield lexer.next_token(lexer_state, parser_state)
  File "/usr/local/lib/python3.10/site-packages/lark/lexer.py", line 466, in next_token
    raise UnexpectedCharacters(lex_state.text, line_ctr.char_pos, line_ctr.line, line_ctr.column,
lark.exceptions.UnexpectedCharacters: No terminal matches 'o' in the current parser context, at line 70 col 1

output ResourceName string = StorageAcco
^
Expected one of: 
        * RESOURCE
        * PARAM
        * AT
        * MODULE

Previous tokens: Token('_CPP_COMMENT_NL', '\n')


During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.10/site-packages/checkov/bicep/parser.py", line 20, in parse
    template = self.bicep_parser.parse(text=content)
  File "/usr/local/lib/python3.10/site-packages/pycep/main.py", line 23, in parse
    tree = self._create_tree(text=text, file_path=file_path)
  File "/usr/local/lib/python3.10/site-packages/pycep/main.py", line 41, in _create_tree
    return self.lark_parser.parse(bicep_text)
  File "/usr/local/lib/python3.10/site-packages/lark/lark.py", line 625, in parse
    return self.parser.parse(text, start=start, on_error=on_error)
  File "/usr/local/lib/python3.10/site-packages/lark/parser_frontends.py", line 96, in parse
    return self.parser.parse(stream, chosen_start, **kw)
  File "/usr/local/lib/python3.10/site-packages/lark/parsers/lalr_parser.py", line 41, in parse
    return self.parser.parse(lexer, start)
  File "/usr/local/lib/python3.10/site-packages/lark/parsers/lalr_parser.py", line 171, in parse
    return self.parse_from_state(parser_state)
  File "/usr/local/lib/python3.10/site-packages/lark/parsers/lalr_parser.py", line 188, in parse_from_state
    raise e
  File "/usr/local/lib/python3.10/site-packages/lark/parsers/lalr_parser.py", line 178, in parse_from_state
    for token in state.lexer.lex(state):
  File "/usr/local/lib/python3.10/site-packages/lark/lexer.py", line 537, in lex
    raise UnexpectedToken(token, e.allowed, state=parser_state, token_history=[last_token], terminals_by_name=self.root_lexer.terminals_by_name)
lark.exceptions.UnexpectedToken: Unexpected token Token('OUTPUT', 'output') at line 70, column 1.
Expected one of: 
        * RESOURCE
        * PARAM
        * AT
        * MODULE
Previous tokens: [Token('_CPP_COMMENT_NL', '\n')]

2022-04-04 12:37:59,397 [MainThread  ] [INFO ]  [bicep] successfully parsed 0 files
2022-04-04 12:37:59,435 [MainThread  ] [INFO ]  Creating Bicep graph
2022-04-04 12:37:59,436 [MainThread  ] [INFO ]  [BicepLocalGraph] created 0 vertices
2022-04-04 12:37:59,436 [MainThread  ] [INFO ]  [BicepLocalGraph] created 0 edges
2022-04-04 12:37:59,437 [MainThread  ] [INFO ]  Successfully created Bicep graph
2022-04-04 12:37:59,438 [MainThread  ] [DEBUG]  Loading external checks from /usr/local/lib/python3.10/site-packages/checkov/bicep/checks/graph_checks

       _               _              
   ___| |__   ___  ___| | _______   __
  / __| '_ \ / _ \/ __| |/ / _ \ \ / /
 | (__| | | |  __/ (__|   < (_) \ V / 
  \___|_| |_|\___|\___|_|\_\___/ \_/  
                                      
By bridgecrew.io | version: 2.0.1030 

2022-04-04 12:37:59,443 [MainThread  ] [DEBUG]  Getting exit code for report bicep
2022-04-04 12:37:59,444 [MainThread  ] [DEBUG]  In get_exit_code; soft_fail: False, soft_fail_on: None, hard_fail_on: None
2022-04-04 12:37:59,444 [MainThread  ] [DEBUG]  No failed checks, or soft_fail is True and soft_fail_on and hard_fail_on are empty - returning 0
bicep scan results:

Passed checks: 0, Failed checks: 0, Skipped checks: 0, Parsing errors: 1

Error parsing file /bicep/storageAccounts.bicepֿ
```

**Desktop (please complete the following information):**
 - OS: [Linux Container]
 - Checkov Version [2.0.1030]

**Additional context**
Add any other context about the problem here (e.g. code snippets).



Discussion:
hi @holly79 thanks for creating the issue. I haven't seen a template using the `@description` decorator in front of an `output` element yet, but you are right, it is possible. I will fix it in the next days.
Hi @gruebel, thanks for that. The reason of the description is I'm converting bicep to arm then using [PSDocs.Azure](https://github.com/Azure/PSDocs.Azure) to automatically generate a markdown file.  And output should have a description as well in the markdown file. And as you have noticed it is supported by bicep and of course by ARM.

Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -33,7 +33,7 @@
         ]
     },
     install_requires=[
-        "bc-python-hcl2==0.3.37",
+        "bc-python-hcl2==0.3.38",
         "cloudsplaining>=0.4.1",
         "deep_merge",
         "tabulate",
@@ -66,7 +66,7 @@
         "jsonpath_ng",
         "jsonschema~=3.0",
         "prettytable>=3.0.0",
-        "pycep-parser==0.3.3",
+        "pycep-parser==0.3.4",
         "charset-normalizer",
     ],
     license="Apache License 2.0",


Test patch: