Repository: bridgecrewio/checkov

Issue:
Checkov don't work with custom checks when -f option is given
**Describe the bug**
When I work with **-d** flag and points terraform files everything works like a charm accordingly with documentation. But because we all know, that some things are being generated using modules in Terraform (a lot!) - modules hide underneath resources details - that's why we often need to provide a full plan (in JSON format) as input for Checkov (instead of static files). As soon as I'm switching for the **-f** flag, and point to my JSON plan I cannot force Checkov to trigger my custom checks.

I have been trying with local policy (--external-checks-dir) so as with remote one (--external-checks-git). Both YAML and JSON type. 
There is no error message, just a blank welcome record with Checkov

As soon as I go back to the **-d** flag it works.

**To Reproduce**
Steps to reproduce the behavior:
* checkov -f plan.json --check CUSTOM_AWS_1 --external-checks-git ....git
* checkov -f plan.json --check CUSTOM_AWS_1 --external-checks-dir my-policies/

**Expected behavior**
Run my custom checks against the plan file.

**Screenshots**
<img width="378" alt="obraz" src="https://user-images.githubusercontent.com/54705469/120992871-4eb41500-c783-11eb-9d0f-43cf25220af9.png">

**Desktop (please complete the following information):**
 - OS:  Mac 10.15.7
 - Checkov Version 2.0.181



Discussion:
Hey @michal-adamkiewicz !

Can you please add these details:
1. Are these yaml (aka graph) checks or python checks?
2. Did providing the absolute path to the checks still reproduce this issue?
Sure. First of all, thank you @nimrodkor for such a quick response!
It's crucial for me, as I would like incorporate checkov into our generic CI/CD standard

1. I have been trying with both of them, but let me paste my YAML check:

`---
metadata:
       name: "Check that all resources are tagged with the key - checkit"
       id: "CUSTOM_AWS_1"
       category: "GENERAL_SECURITY"
scope:
       provider: AWS
definition:
       cond_type: "attribute"
       resource_types: 
              - "all"
       attribute: "tags.checkit"
       operator: "exists"
`
This file is being saved in **policies/policy1.yaml**

2. How I run checkov?

`checkov -f plan-test.json --check CUSTOM_AWS_1 --external-checks-dir policies` (being one level up)

the same if I provide full absolute path:

`checkov -f plan-test.json --check CUSTOM_AWS_1 --external-checks-dir /Users/michal.adamkiewicz/git/projectABB/policies`

I have been trying also using the git protocol, but the outcome is still the same. Just welcome screen from Checkov and nothing more. Remove --check flag triggers regular checks against all default built-in policies, but unfortunately, that's not the point here.

<img width="296" alt="obraz" src="https://user-images.githubusercontent.com/54705469/121071541-59e16200-c7d0-11eb-894f-1a22a670642e.png">

3. To be fully transparent, I have been testing that against multiple plans. Also even including some generated only for testing purpose like one below:

`{
  "format_version": "0.1",
  "terraform_version": "0.13.6",
  "planned_values": {
    "root_module": {
      "resources": [
        {
          "address": "aws_autoscaling_group.my_asg",
          "mode": "managed",
          "type": "aws_autoscaling_group",
          "name": "my_asg",
          "provider_name": "aws",
          "schema_version": 0,
          "values": {
            "availability_zones": [
              "us-west-1a"
            ],
            "desired_capacity": 4,
            "enabled_metrics": null,
            "force_delete": true,
            "health_check_grace_period": 300,
            "health_check_type": "ELB",
            "initial_lifecycle_hook": [],
            "launch_configuration": "my_web_config",
            "launch_template": [],
            "max_size": 5,
            "metrics_granularity": "1Minute",
            "min_elb_capacity": null,
            "min_size": 1,
            "mixed_instances_policy": [],
            "name": "my_asg",
            "name_prefix": null,
            "placement_group": null,
            "protect_from_scale_in": false,
            "suspended_processes": null,
            "tag": [],
            "tags": null,
            "termination_policies": null,
            "timeouts": null,
            "wait_for_capacity_timeout": "10m",
            "wait_for_elb_capacity": null
          }
        },
        {
          "address": "aws_instance.web",
          "mode": "managed",
          "type": "aws_instance",
          "name": "web",
          "provider_name": "aws",
          "schema_version": 1,
          "values": {
            "ami": "ami-09b4b74c",
            "credit_specification": [],
            "disable_api_termination": null,
            "ebs_optimized": null,
            "get_password_data": false,
            "iam_instance_profile": null,
            "instance_initiated_shutdown_behavior": null,
            "instance_type": "t2.micro",
            "monitoring": null,
            "source_dest_check": true,
            "tags": null,
            "timeouts": null,
            "user_data": null,
            "user_data_base64": null
          }
        },
        {
          "address": "aws_launch_configuration.my_web_config",
          "mode": "managed",
          "type": "aws_launch_configuration",
          "name": "my_web_config",
          "provider_name": "aws",
          "schema_version": 0,
          "values": {
            "associate_public_ip_address": false,
            "enable_monitoring": true,
            "ephemeral_block_device": [],
            "iam_instance_profile": null,
            "image_id": "ami-09b4b74c",
            "instance_type": "t2.micro",
            "name": "my_web_config",
            "name_prefix": null,
            "placement_tenancy": null,
            "security_groups": null,
            "spot_price": null,
            "user_data": null,
            "user_data_base64": null,
            "vpc_classic_link_id": null,
            "vpc_classic_link_security_groups": null
          }
        }
      ]
    }
  },
  "resource_changes": [
    {
      "address": "aws_autoscaling_group.my_asg",
      "mode": "managed",
      "type": "aws_autoscaling_group",
      "name": "my_asg",
      "provider_name": "aws",
      "change": {
        "actions": [
          "create"
        ],
        "before": null,
        "after": {
          "availability_zones": [
            "us-west-1a"
          ],
          "desired_capacity": 4,
          "enabled_metrics": null,
          "force_delete": true,
          "health_check_grace_period": 300,
          "health_check_type": "ELB",
          "initial_lifecycle_hook": [],
          "launch_configuration": "my_web_config",
          "launch_template": [],
          "max_size": 5,
          "metrics_granularity": "1Minute",
          "min_elb_capacity": null,
          "min_size": 1,
          "mixed_instances_policy": [],
          "name": "my_asg",
          "name_prefix": null,
          "placement_group": null,
          "protect_from_scale_in": false,
          "suspended_processes": null,
          "tag": [],
          "tags": null,
          "termination_policies": null,
          "timeouts": null,
          "wait_for_capacity_timeout": "10m",
          "wait_for_elb_capacity": null
        },
        "after_unknown": {
          "arn": true,
          "availability_zones": [
            false
          ],
          "default_cooldown": true,
          "id": true,
          "initial_lifecycle_hook": [],
          "launch_template": [],
          "load_balancers": true,
          "mixed_instances_policy": [],
          "service_linked_role_arn": true,
          "tag": [],
          "target_group_arns": true,
          "vpc_zone_identifier": true
        }
      }
    },
    {
      "address": "aws_instance.web",
      "mode": "managed",
      "type": "aws_instance",
      "name": "web",
      "provider_name": "aws",
      "change": {
        "actions": [
          "create"
        ],
        "before": null,
        "after": {
          "ami": "ami-09b4b74c",
          "credit_specification": [],
          "disable_api_termination": null,
          "ebs_optimized": null,
          "get_password_data": false,
          "iam_instance_profile": null,
          "instance_initiated_shutdown_behavior": null,
          "instance_type": "t2.micro",
          "monitoring": null,
          "source_dest_check": true,
          "tags": null,
          "timeouts": null,
          "user_data": null,
          "user_data_base64": null
        },
        "after_unknown": {
          "arn": true,
          "associate_public_ip_address": true,
          "availability_zone": true,
          "cpu_core_count": true,
          "cpu_threads_per_core": true,
          "credit_specification": [],
          "ebs_block_device": true,
          "ephemeral_block_device": true,
          "host_id": true,
          "id": true,
          "instance_state": true,
          "ipv6_address_count": true,
          "ipv6_addresses": true,
          "key_name": true,
          "network_interface": true,
          "network_interface_id": true,
          "password_data": true,
          "placement_group": true,
          "primary_network_interface_id": true,
          "private_dns": true,
          "private_ip": true,
          "public_dns": true,
          "public_ip": true,
          "root_block_device": true,
          "security_groups": true,
          "subnet_id": true,
          "tenancy": true,
          "volume_tags": true,
          "vpc_security_group_ids": true
        }
      }
    },
    {
      "address": "aws_launch_configuration.my_web_config",
      "mode": "managed",
      "type": "aws_launch_configuration",
      "name": "my_web_config",
      "provider_name": "aws",
      "change": {
        "actions": [
          "create"
        ],
        "before": null,
        "after": {
          "associate_public_ip_address": false,
          "enable_monitoring": true,
          "ephemeral_block_device": [],
          "iam_instance_profile": null,
          "image_id": "ami-09b4b74c",
          "instance_type": "t2.micro",
          "name": "my_web_config",
          "name_prefix": null,
          "placement_tenancy": null,
          "security_groups": null,
          "spot_price": null,
          "user_data": null,
          "user_data_base64": null,
          "vpc_classic_link_id": null,
          "vpc_classic_link_security_groups": null
        },
        "after_unknown": {
          "ebs_block_device": true,
          "ebs_optimized": true,
          "ephemeral_block_device": [],
          "id": true,
          "key_name": true,
          "root_block_device": true
        }
      }
    }
  ],
  "configuration": {
    "provider_config": {
      "aws": {
        "name": "aws",
        "expressions": {
          "region": {
            "constant_value": "us-west-1"
          }
        }
      }
    },
    "root_module": {
      "resources": [
        {
          "address": "aws_autoscaling_group.my_asg",
          "mode": "managed",
          "type": "aws_autoscaling_group",
          "name": "my_asg",
          "provider_config_key": "aws",
          "expressions": {
            "availability_zones": {
              "constant_value": [
                "us-west-1a"
              ]
            },
            "desired_capacity": {
              "constant_value": 4
            },
            "force_delete": {
              "constant_value": true
            },
            "health_check_grace_period": {
              "constant_value": 300
            },
            "health_check_type": {
              "constant_value": "ELB"
            },
            "launch_configuration": {
              "constant_value": "my_web_config"
            },
            "max_size": {
              "constant_value": 5
            },
            "min_size": {
              "constant_value": 1
            },
            "name": {
              "constant_value": "my_asg"
            }
          },
          "schema_version": 0
        },
        {
          "address": "aws_instance.web",
          "mode": "managed",
          "type": "aws_instance",
          "name": "web",
          "provider_config_key": "aws",
          "expressions": {
            "ami": {
              "constant_value": "ami-09b4b74c"
            },
            "instance_type": {
              "constant_value": "t2.micro"
            }
          },
          "schema_version": 1
        },
        {
          "address": "aws_launch_configuration.my_web_config",
          "mode": "managed",
          "type": "aws_launch_configuration",
          "name": "my_web_config",
          "provider_config_key": "aws",
          "expressions": {
            "image_id": {
              "constant_value": "ami-09b4b74c"
            },
            "instance_type": {
              "constant_value": "t2.micro"
            },
            "name": {
              "constant_value": "my_web_config"
            }
          },
          "schema_version": 0
        }
      ]
    }
  }
}`
Probably I have to switch to a different tool if this functionality doesn't work :( 
hi @michal-adamkiewicz i'll work on a fix sometime next week. Stay tuned. 
@schosterbarak seriously? 🙀 Thank you so much, buddy 👍 . I have already incorporated checkov inside Atlantis Gitops tool - your tool is a life safer for people like me;). I will be very grateful for any update on this 👌  
Also having this issue, checks that aren't manually placed into the checkov default checks folder will not load. --external-checks-dir flag seems to do nothing right now (v.2.0.187)
@jkesterson Are you also running on a plan file?
@kartikp10 @schosterbarak could be related to https://github.com/bridgecrewio/checkov/issues/1257
Hmm IMHO it looks exactly the same as the "mine" issue in the console. That's right.
I'm sorry guys for focusing very much on this, but I'm only asking - do you think it's something "doable" or it will take longer than thought?
Our team is also very much awaiting this in order to use Checkov
Seems that unfortunately, I have to look for another solution, as I thought It will be easy solvable :/ 
Hi guys, any idea on when this would be fixed?

Resolving patch:
diff --git a/checkov/terraform/plan_runner.py b/checkov/terraform/plan_runner.py
--- a/checkov/terraform/plan_runner.py
+++ b/checkov/terraform/plan_runner.py
@@ -1,24 +1,24 @@
-import logging
 import json
 import logging
 import os
 
+from checkov.terraform.graph_builder.graph_components.attribute_names import CustomAttributes
+
 from checkov.common.output.record import Record
 from checkov.common.output.report import Report
-from checkov.common.runners.base_runner import BaseRunner, filter_ignored_paths
+from checkov.common.runners.base_runner import filter_ignored_paths
 from checkov.runner_filter import RunnerFilter
 from checkov.terraform.checks.resource.registry import resource_registry
 from checkov.terraform.context_parsers.registry import parser_registry
-# Allow the evaluation of empty variables
 from checkov.terraform.plan_parser import parse_tf_plan
+from checkov.terraform.runner import graph_registry, Runner as TerraformRunner, merge_reports
 
 
-class Runner(BaseRunner):
+class Runner(TerraformRunner):
     check_type = "terraform_plan"
 
     def __init__(self):
-        self.tf_definitions = {}
-        self.definitions_context = {}
+        super().__init__()
         self.template_lines = {}
 
     block_type_registries = {
@@ -33,6 +33,7 @@ def run(self, root_folder=None, external_checks_dir=None, files=None, runner_fil
         if external_checks_dir:
             for directory in external_checks_dir:
                 resource_registry.load_external_checks(directory)
+                graph_registry.load_external_checks(directory)
 
         if root_folder:
             files = [] if not files else files
@@ -67,11 +68,20 @@ def run(self, root_folder=None, external_checks_dir=None, files=None, runner_fil
 
         report.add_parsing_errors(parsing_errors.keys())
 
+        graph = self.graph_manager.build_graph_from_tf_definitions(self.tf_definitions, render_variables=False)
+        self.graph_manager.save_graph(graph)
+
+        graph_report = self.get_graph_checks_report(root_folder, runner_filter)
+        merge_reports(report, graph_report)
+
         return report
 
-    def check_tf_definition(self, report, runner_filter,
-                            ):
+    def get_entity_context_and_evaluations(self, entity):
+        raw_context = self.get_entity_context(entity[CustomAttributes.BLOCK_NAME].split("."), entity[CustomAttributes.FILE_PATH])
+        raw_context['definition_path'] = entity[CustomAttributes.BLOCK_NAME].split('.')
+        return raw_context, None
 
+    def check_tf_definition(self, report, runner_filter):
         for full_file_path, definition in self.tf_definitions.items():
             scanned_file = f"/{os.path.relpath(full_file_path)}"
             logging.debug(f"Scanning file: {scanned_file}")
@@ -80,12 +90,10 @@ def check_tf_definition(self, report, runner_filter,
                     self.run_block(definition[block_type], full_file_path, report, scanned_file,
                                    block_type, runner_filter)
 
-    def run_block(self, entities, full_file_path, report, scanned_file, block_type,
-                  runner_filter=None):
+    def run_block(self, entities, full_file_path, report, scanned_file, block_type, runner_filter=None):
         registry = self.block_type_registries[block_type]
         if registry:
             for entity in entities:
-                entity_evaluations = None
                 context_parser = parser_registry.context_parsers[block_type]
                 definition_path = context_parser.get_entity_context_path(entity)
                 entity_id = ".".join(definition_path)
@@ -98,7 +106,7 @@ def run_block(self, entities, full_file_path, report, scanned_file, block_type,
                     record = Record(check_id=check.id, check_name=check.name, check_result=check_result,
                                     code_block=entity_code_lines, file_path=scanned_file,
                                     file_line_range=entity_lines_range,
-                                    resource=entity_id, evaluations=entity_evaluations,
+                                    resource=entity_id, evaluations=None,
                                     check_class=check.__class__.__module__, file_abs_path=full_file_path)
                     report.add_record(record=record)
 
@@ -112,6 +120,7 @@ def get_entity_context(self, definition_path, full_file_path):
                     resource_defintion = resource[resource_type][resource_name]
                     entity_context['start_line'] = resource_defintion['start_line'][0]
                     entity_context['end_line'] = resource_defintion['end_line'][0]
-                    entity_context['code_lines'] = self.template_lines[entity_context['start_line']:entity_context['end_line']]
+                    entity_context['code_lines'] = self.template_lines[
+                                                   entity_context['start_line']:entity_context['end_line']]
                     return entity_context
         return entity_context
diff --git a/checkov/terraform/runner.py b/checkov/terraform/runner.py
--- a/checkov/terraform/runner.py
+++ b/checkov/terraform/runner.py
@@ -150,9 +150,10 @@ def get_graph_checks_report(self, root_folder, runner_filter: RunnerFilter):
                                     evaluations=entity_evaluations,
                                     check_class=check.__class__.__module__,
                                     file_abs_path=os.path.abspath(full_file_path))
-                    breadcrumb = self.breadcrumbs.get(record.file_path, {}).get(record.resource)
-                    if breadcrumb:
-                        record = GraphRecord(record, breadcrumb)
+                    if self.breadcrumbs:
+                        breadcrumb = self.breadcrumbs.get(record.file_path, {}).get(record.resource)
+                        if breadcrumb:
+                            record = GraphRecord(record, breadcrumb)
 
                     report.add_record(record=record)
         return report


Test patch:
diff --git a/tests/terraform/runner/extra_yaml_checks/test_tag.yaml b/tests/terraform/runner/extra_yaml_checks/test_tag.yaml
new file mode 100644
--- /dev/null
+++ b/tests/terraform/runner/extra_yaml_checks/test_tag.yaml
@@ -0,0 +1,12 @@
+metadata:
+  name: "Ensure all resources are tagged with the relevant env"
+  id: "CUSTOM_GRAPH_AWS_1"
+  category: "GENERAL_SECURITY"
+scope:
+  provider: "AWS"
+definition:
+  cond_type: "attribute"
+  resource_types:
+    - "all"
+  attribute: "tags.env"
+  operator: "exists"
\ No newline at end of file
diff --git a/tests/terraform/runner/test_plan_runner.py b/tests/terraform/runner/test_plan_runner.py
--- a/tests/terraform/runner/test_plan_runner.py
+++ b/tests/terraform/runner/test_plan_runner.py
@@ -3,6 +3,7 @@
 
 from checkov.runner_filter import RunnerFilter
 from checkov.terraform.plan_runner import Runner
+from checkov.terraform.runner import graph_registry
 
 
 class TestRunnerValid(unittest.TestCase):
@@ -53,10 +54,11 @@ def test_runner_nested_child_modules(self):
         current_dir = os.path.dirname(os.path.realpath(__file__))
         valid_plan_path = current_dir + "/resources/plan_nested_child_modules/tfplan.json"
         runner = Runner()
+        graph_registry.checks = []
         report = runner.run(
             root_folder=None,
             files=[valid_plan_path],
-            external_checks_dir=None,
+            external_checks_dir=[current_dir + "/extra_yaml_checks"],
             runner_filter=RunnerFilter(framework="all"),
         )
         report_json = report.get_json()
@@ -66,7 +68,7 @@ def test_runner_nested_child_modules(self):
         self.assertEqual(report.get_exit_code(soft_fail=False), 1)
         self.assertEqual(report.get_exit_code(soft_fail=True), 0)
 
-        self.assertEqual(report.get_summary()["failed"], 15)
+        self.assertEqual(report.get_summary()["failed"], 18)
         self.assertEqual(report.get_summary()["passed"], 0)
 
         failed_check_ids = set([c.check_id for c in report.failed_checks])
@@ -76,6 +78,7 @@ def test_runner_nested_child_modules(self):
             "CKV_AWS_39",
             "CKV_AWS_58",
             "CKV_AWS_151",
+            "CUSTOM_GRAPH_AWS_1"
         }
 
         assert failed_check_ids == expected_failed_check_ids
@@ -84,6 +87,7 @@ def test_runner_root_module_resources_no_values(self):
         current_dir = os.path.dirname(os.path.realpath(__file__))
         valid_plan_path = current_dir + "/resources/plan_root_module_resources_no_values/tfplan.json"
         runner = Runner()
+        graph_registry.checks = []
         report = runner.run(
             root_folder=None,
             files=[valid_plan_path],
diff --git a/tests/terraform/runner/test_runner.py b/tests/terraform/runner/test_runner.py
--- a/tests/terraform/runner/test_runner.py
+++ b/tests/terraform/runner/test_runner.py
@@ -83,7 +83,7 @@ def test_runner_passing_valid_tf(self):
         self.assertEqual(report.get_exit_code(False), 1)
         summary = report.get_summary()
         self.assertGreaterEqual(summary['passed'], 1)
-        self.assertEqual(5, summary['failed'])
+        self.assertEqual(7, summary['failed'])
         self.assertEqual(1, summary['skipped'])
         self.assertEqual(0, summary["parsing_errors"])
 
@@ -113,8 +113,8 @@ def test_runner_extra_check(self):
             if record.check_id == "CUSTOM_AWS_1":
                 failed_custom = failed_custom + 1
 
-        self.assertEqual(passing_custom, 1)
-        self.assertEqual(failed_custom, 2)
+        self.assertEqual(1, passing_custom)
+        self.assertEqual(2, failed_custom)
 
     def test_runner_extra_yaml_check(self):
         current_dir = os.path.dirname(os.path.realpath(__file__))
@@ -158,7 +158,7 @@ def test_runner_specific_file(self):
         # self.assertEqual(report.get_exit_code(), 0)
         summary = report.get_summary()
         self.assertGreaterEqual(summary['passed'], 1)
-        self.assertEqual(3, summary['failed'])
+        self.assertEqual(4, summary['failed'])
         self.assertEqual(0, summary["parsing_errors"])
 
     def test_check_ids_dont_collide(self):
@@ -648,29 +648,27 @@ def test_module_failure_reporting_772(self):
 
     def test_loading_external_checks_yaml(self):
         runner = Runner()
+        graph_registry.checks = []
         graph_registry.load_checks()
         base_len = len(graph_registry.checks)
         current_dir = os.path.dirname(os.path.realpath(__file__))
         extra_checks_dir_path = current_dir + "/extra_yaml_checks"
         runner.load_external_checks([extra_checks_dir_path])
-        self.assertEqual(len(graph_registry.checks), base_len + 1)
-        self.assertEqual(graph_registry.checks[base_len].id, CUSTOM_GRAPH_CHECK_ID)
-        self.assertEqual(graph_registry.checks[base_len].name, 'Ensure bucket has versioning and owner tag')
-        graph_registry.checks = list(filter(lambda c: c.id != CUSTOM_GRAPH_CHECK_ID, graph_registry.checks))
+        self.assertEqual(len(graph_registry.checks), base_len + 2)
+        graph_registry.checks = graph_registry.checks[:base_len]
 
     def test_loading_external_checks_yaml_multiple_times(self):
         runner = Runner()
-        base_len = len(graph_registry.checks)
         current_dir = os.path.dirname(os.path.realpath(__file__))
+        graph_registry.checks = []
         extra_checks_dir_path = [current_dir + "/extra_yaml_checks"]
         runner.load_external_checks(extra_checks_dir_path)
-        self.assertEqual(len(graph_registry.checks), base_len + 1)
-        self.assertEqual(graph_registry.checks[base_len].id, CUSTOM_GRAPH_CHECK_ID)
-        self.assertEqual(graph_registry.checks[base_len].name, 'Ensure bucket has versioning and owner tag')
+        self.assertEqual(len(graph_registry.checks), 2)
         runner.load_external_checks(extra_checks_dir_path)
-        self.assertEqual(len(graph_registry.checks), base_len + 1)
-        self.assertEqual(graph_registry.checks[base_len].id, CUSTOM_GRAPH_CHECK_ID)
-        graph_registry.checks = list(filter(lambda c: c.id != CUSTOM_GRAPH_CHECK_ID, graph_registry.checks))
+        self.assertEqual(len(graph_registry.checks), 2)
+        self.assertIn('CUSTOM_GRAPH_AWS_1', [x.id for x in graph_registry.checks])
+        self.assertIn('CKV2_CUSTOM_1', [x.id for x in graph_registry.checks])
+        graph_registry.checks = []
 
     def test_loading_external_checks_python(self):
         runner = Runner()
@@ -714,9 +712,6 @@ def test_loading_external_checks_python_and_yaml(self):
             found += 1
         self.assertEqual(found, len(scanner.supported_resources))
         self.assertEqual(len(list(filter(lambda c: c.id == CUSTOM_GRAPH_CHECK_ID, graph_registry.checks))), 1)
-        self.assertEqual(graph_registry.checks[-1].id, CUSTOM_GRAPH_CHECK_ID)
-        self.assertEqual(graph_registry.checks[-1].name, 'Ensure bucket has versioning and owner tag')
-        graph_registry.checks = list(filter(lambda c: c.id != CUSTOM_GRAPH_CHECK_ID, graph_registry.checks))
 
     def test_wrong_check_imports(self):
         wrong_imports = ["arm", "cloudformation", "dockerfile", "helm", "kubernetes", "serverless"]