Repository: bridgecrewio/checkov

Issue:
CKV_AZURE_234 condition is incorrect
https://github.com/bridgecrewio/checkov/blob/dc6a7cd84c5e006c289f2710b960b7be96a29fae/checkov/terraform/checks/resource/azure/AzureDefenderDisabledForResManager.py#L20C110-L20C118

The condition used in this check is being triggered for all `azurerm_security_center_subscription_pricing` resources with **any** `resource_type`. For example, 

```
resource "azurerm_security_center_subscription_pricing" "mdc_srvrs" {
  tier          = "Standard"
  resource_type = "VirtualMachines"
  subplan       = "P2"
```

Would raise the `CKV_AZURE_234` finding. For any other `resource_type` we get a failure.


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/azure/AzureDefenderDisabledForResManager.py b/checkov/terraform/checks/resource/azure/AzureDefenderDisabledForResManager.py
--- a/checkov/terraform/checks/resource/azure/AzureDefenderDisabledForResManager.py
+++ b/checkov/terraform/checks/resource/azure/AzureDefenderDisabledForResManager.py
@@ -16,9 +16,9 @@ def __init__(self) -> None:
 
     def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:
         return (
-            CheckResult.PASSED
-            if conf.get("resource_type", [""])[0].lower() == "arm" and conf.get("tier", [""])[0].lower() == "standard"
-            else CheckResult.FAILED
+            CheckResult.FAILED
+            if conf.get("resource_type", [""])[0].lower() == "arm" and conf.get("tier", [""])[0].lower() != "standard"
+            else CheckResult.PASSED
         )
 
     def get_evaluated_keys(self) -> list[str]:


Test patch:
diff --git a/tests/terraform/checks/resource/azure/example_AzureDefenderDisabledForResManager/main.tf b/tests/terraform/checks/resource/azure/example_AzureDefenderDisabledForResManager/main.tf
--- a/tests/terraform/checks/resource/azure/example_AzureDefenderDisabledForResManager/main.tf
+++ b/tests/terraform/checks/resource/azure/example_AzureDefenderDisabledForResManager/main.tf
@@ -1,7 +1,7 @@
 
 # Case 1: Pass: tier is Standard and resource_type is Arm
 
-resource "azurerm_security_center_subscription_pricing" "pass" {
+resource "azurerm_security_center_subscription_pricing" "pass_1" {
   tier          = "Standard"
   resource_type = "Arm"
 }
@@ -13,10 +13,16 @@ resource "azurerm_security_center_subscription_pricing" "fail_1" {
   resource_type = "arm"
 }
 
-# Case 3: Fails as "resource_type" should be "Arm"
+# Case 3: Pass as policy should only check if the resource_type is "Arm"
 
-resource "azurerm_security_center_subscription_pricing" "fail_2" {
-  tier          = "Standard"
+resource "azurerm_security_center_subscription_pricing" "pass_2" {
+  tier          = "Free"
   resource_type = "Dns"
 }
 
+# Case 4: Pass as policy should only check if the resource_type is "Arm"
+
+resource "azurerm_security_center_subscription_pricing" "pass_3" {
+  tier          = "Free"
+  resource_type = "VirtualMachine"
+}
\ No newline at end of file
diff --git a/tests/terraform/checks/resource/azure/test_AzureDefenderDisabledForResManager.py b/tests/terraform/checks/resource/azure/test_AzureDefenderDisabledForResManager.py
--- a/tests/terraform/checks/resource/azure/test_AzureDefenderDisabledForResManager.py
+++ b/tests/terraform/checks/resource/azure/test_AzureDefenderDisabledForResManager.py
@@ -17,11 +17,12 @@ def test(self):
         summary = report.get_summary()
 
         passing_resources = {
-            'azurerm_security_center_subscription_pricing.pass',
+            'azurerm_security_center_subscription_pricing.pass_1',
+            'azurerm_security_center_subscription_pricing.pass_2',
+            'azurerm_security_center_subscription_pricing.pass_3',
         }
         failing_resources = {
             'azurerm_security_center_subscription_pricing.fail_1',
-            'azurerm_security_center_subscription_pricing.fail_2',
         }
         skipped_resources = {}