Repository: bridgecrewio/checkov

Issue:
Checkov returns KeyError: 'suppress_comment' at the end of check
When I run checkov on my terraform code I get this stacktrace:

```
Traceback (most recent call last):
  File "/usr/local/bin/checkov", line 8, in <module>
    exit(run())
  File "/usr/local/lib/python3.8/site-packages/checkov/main.py", line 182, in run
    exit_codes.append(runner_registry.print_reports(scan_reports, config, url=url, created_baseline_path=created_baseline_path, baseline=baseline))
  File "/usr/local/lib/python3.8/site-packages/checkov/common/runners/runner_registry.py", line 93, in print_reports
    report.print_console(
  File "/usr/local/lib/python3.8/site-packages/checkov/common/output/report.py", line 161, in print_console
    print(record.to_string(compact=is_compact, use_bc_ids=use_bc_ids))
  File "/usr/local/lib/python3.8/site-packages/checkov/common/output/record.py", line 90, in to_string
    suppress_comment = "\tSuppress comment: {}\n".format(self.check_result['suppress_comment'])
KeyError: 'suppress_comment'
```

I am running 2.0.318, I tried older versions and the issue stopped in 2.0.314 (first noticed in 2.0.315)

I am running on MacOS and our build server runs ubuntu both on x86_64

The following tests were being run if it helps:

```
Check: CKV_AWS_41: "Ensure no hard coded AWS access key and secret key exists in provider"
        PASSED for resource: aws.default
        File: /common_providers.tf:87-108
        Guide: https://docs.bridgecrew.io/docs/bc_aws_secrets_5

Check: CKV_AWS_41: "Ensure no hard coded AWS access key and secret key exists in provider"
        PASSED for resource: aws.ns_assume
        File: /common_providers.tf:110-128
        Guide: https://docs.bridgecrew.io/docs/bc_aws_secrets_5

Check: CKV_AWS_108: "Ensure IAM policies does not allow data exfiltration"
        PASSED for resource: aws_iam_policy_document.ec2_assume
        File: /policies.tf:32-41
        Guide: https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-data-exfiltration

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
        PASSED for resource: aws_iam_policy_document.ec2_assume
        File: /policies.tf:32-41
        Guide: https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-write-access-without-constraint

Check: CKV_AWS_49: "Ensure no IAM policies documents allow "*" as a statement's actions"
        PASSED for resource: aws_iam_policy_document.ec2_assume
        File: /policies.tf:32-41
        Guide: https://docs.bridgecrew.io/docs/bc_aws_iam_43

Check: CKV_AWS_107: "Ensure IAM policies does not allow credentials exposure"
        PASSED for resource: aws_iam_policy_document.ec2_assume
        File: /policies.tf:32-41
        Guide: https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-credentials-exposure

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
        PASSED for resource: aws_iam_policy_document.ec2_assume
        File: /policies.tf:32-41
        Guide: https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

Check: CKV_AWS_1: "Ensure IAM policies that allow full "*-*" administrative privileges are not created"
        PASSED for resource: aws_iam_policy_document.ec2_assume
        File: /policies.tf:32-41
        Guide: https://docs.bridgecrew.io/docs/iam_23

Check: CKV_AWS_110: "Ensure IAM policies does not allow privilege escalation"
        PASSED for resource: aws_iam_policy_document.ec2_assume
        File: /policies.tf:32-41

Check: CKV_AWS_108: "Ensure IAM policies does not allow data exfiltration"
        PASSED for resource: aws_iam_policy_document.emr_assume
        File: /policies.tf:43-52
        Guide: https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-data-exfiltration

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
        PASSED for resource: aws_iam_policy_document.emr_assume
        File: /policies.tf:43-52
        Guide: https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-write-access-without-constraint

Check: CKV_AWS_49: "Ensure no IAM policies documents allow "*" as a statement's actions"
        PASSED for resource: aws_iam_policy_document.emr_assume
        File: /policies.tf:43-52
        Guide: https://docs.bridgecrew.io/docs/bc_aws_iam_43

Check: CKV_AWS_107: "Ensure IAM policies does not allow credentials exposure"
        PASSED for resource: aws_iam_policy_document.emr_assume
        File: /policies.tf:43-52
        Guide: https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-credentials-exposure

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints" 
        PASSED for resource: aws_iam_policy_document.emr_assume
        File: /policies.tf:43-52
        Guide: https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

Check: CKV_AWS_1: "Ensure IAM policies that allow full "*-*" administrative privileges are not created"
        PASSED for resource: aws_iam_policy_document.emr_assume
        File: /policies.tf:43-52
        Guide: https://docs.bridgecrew.io/docs/iam_23

Check: CKV_AWS_110: "Ensure IAM policies does not allow privilege escalation"
        PASSED for resource: aws_iam_policy_document.emr_assume
        File: /policies.tf:43-52

Check: CKV_AWS_108: "Ensure IAM policies does not allow data exfiltration"
        PASSED for resource: aws_iam_policy_document.emr_policy
        File: /policies.tf:54-66
        Guide: https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-data-exfiltration

Check: CKV_AWS_49: "Ensure no IAM policies documents allow "*" as a statement's actions"
        PASSED for resource: aws_iam_policy_document.emr_policy
        File: /policies.tf:54-66
        Guide: https://docs.bridgecrew.io/docs/bc_aws_iam_43

Check: CKV_AWS_107: "Ensure IAM policies does not allow credentials exposure"
        PASSED for resource: aws_iam_policy_document.emr_policy
        File: /policies.tf:54-66
        Guide: https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-credentials-exposure

Check: CKV_AWS_1: "Ensure IAM policies that allow full "*-*" administrative privileges are not created"
        PASSED for resource: aws_iam_policy_document.emr_policy
        File: /policies.tf:54-66
        Guide: https://docs.bridgecrew.io/docs/iam_23

Check: CKV_AWS_110: "Ensure IAM policies does not allow privilege escalation"
        PASSED for resource: aws_iam_policy_document.emr_policy
        File: /policies.tf:54-66

Check: CKV_AWS_108: "Ensure IAM policies does not allow data exfiltration"
        PASSED for resource: aws_iam_policy_document.ec2_policy
        File: /policies.tf:68-153
        Guide: https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-data-exfiltration

Check: CKV_AWS_49: "Ensure no IAM policies documents allow "*" as a statement's actions"
        PASSED for resource: aws_iam_policy_document.ec2_policy
        File: /policies.tf:68-153
        Guide: https://docs.bridgecrew.io/docs/bc_aws_iam_43

Check: CKV_AWS_107: "Ensure IAM policies does not allow credentials exposure"
        PASSED for resource: aws_iam_policy_document.ec2_policy
        File: /policies.tf:68-153
        Guide: https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-credentials-exposure

Check: CKV_AWS_1: "Ensure IAM policies that allow full "*-*" administrative privileges are not created"
        PASSED for resource: aws_iam_policy_document.ec2_policy
        File: /policies.tf:68-153
        Guide: https://docs.bridgecrew.io/docs/iam_23

Check: CKV_AWS_110: "Ensure IAM policies does not allow privilege escalation"
        PASSED for resource: aws_iam_policy_document.ec2_policy
        File: /policies.tf:68-153

Check: CKV_AWS_61: "Ensure IAM role allows only specific principals in account to assume it"
        PASSED for resource: aws_iam_role.emr
        File: /policies.tf:1-4
        Guide: https://docs.bridgecrew.io/docs/bc_aws_iam_45

Check: CKV_AWS_60: "Ensure IAM role allows only specific services or principals to assume it"
        PASSED for resource: aws_iam_role.emr
        File: /policies.tf:1-4
        Guide: https://docs.bridgecrew.io/docs/bc_aws_iam_44

Check: CKV_AWS_61: "Ensure IAM role allows only specific principals in account to assume it"
        PASSED for resource: aws_iam_role.emr_ec2
        File: /policies.tf:6-13
        Guide: https://docs.bridgecrew.io/docs/bc_aws_iam_45

Check: CKV_AWS_60: "Ensure IAM role allows only specific services or principals to assume it"
        PASSED for resource: aws_iam_role.emr_ec2
        File: /policies.tf:6-13
        Guide: https://docs.bridgecrew.io/docs/bc_aws_iam_44

Check: CKV_AWS_63: "Ensure no IAM policies documents allow "*" as a statement's actions"
        PASSED for resource: aws_iam_role_policy.emr_policy
        File: /policies.tf:15-19
        Guide: https://docs.bridgecrew.io/docs/iam_48

Check: CKV_AWS_62: "Ensure IAM policies that allow full "*-*" administrative privileges are not created"
        PASSED for resource: aws_iam_role_policy.emr_policy
        File: /policies.tf:15-19
        Guide: https://docs.bridgecrew.io/docs/iam_47

Check: CKV_AWS_63: "Ensure no IAM policies documents allow "*" as a statement's actions"
        PASSED for resource: aws_iam_role_policy.emr_ec2_policy
        File: /policies.tf:21-25
        Guide: https://docs.bridgecrew.io/docs/iam_48

Check: CKV_AWS_62: "Ensure IAM policies that allow full "*-*" administrative privileges are not created"
        PASSED for resource: aws_iam_role_policy.emr_ec2_policy
        File: /policies.tf:21-25
        Guide: https://docs.bridgecrew.io/docs/iam_47

Check: CKV_AWS_108: "Ensure IAM policies does not allow data exfiltration"
        PASSED for resource: aws_iam_policy_document.common_policy
        File: /policy_templates.tf:5-66
        Guide: https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-data-exfiltration

Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
        PASSED for resource: aws_iam_policy_document.common_policy
        File: /policy_templates.tf:5-66
        Guide: https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-write-access-without-constraint

Check: CKV_AWS_49: "Ensure no IAM policies documents allow "*" as a statement's actions"
        PASSED for resource: aws_iam_policy_document.common_policy
        File: /policy_templates.tf:5-66
        Guide: https://docs.bridgecrew.io/docs/bc_aws_iam_43

Check: CKV_AWS_107: "Ensure IAM policies does not allow credentials exposure"
        PASSED for resource: aws_iam_policy_document.common_policy
        File: /policy_templates.tf:5-66
        Guide: https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-credentials-exposure

Check: CKV_AWS_109: "Ensure IAM policies does not allow permissions management / resource exposure without constraints"
        PASSED for resource: aws_iam_policy_document.common_policy
        File: /policy_templates.tf:5-66
        Guide: https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint

Check: CKV_AWS_1: "Ensure IAM policies that allow full "*-*" administrative privileges are not created"
        PASSED for resource: aws_iam_policy_document.common_policy
        File: /policy_templates.tf:5-66
        Guide: https://docs.bridgecrew.io/docs/iam_23

Check: CKV_AWS_110: "Ensure IAM policies does not allow privilege escalation"
        PASSED for resource: aws_iam_policy_document.common_policy
        File: /policy_templates.tf:5-66

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
        PASSED for resource: aws_security_group.emr_leader
        File: /security_groups.tf:1-58
        Guide: https://docs.bridgecrew.io/docs/networking_1-port-security

Check: CKV_AWS_23: "Ensure every security groups rule has a description"
        PASSED for resource: aws_security_group.emr_leader
        File: /security_groups.tf:1-58
        Guide: https://docs.bridgecrew.io/docs/networking_31

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
        PASSED for resource: aws_security_group.emr_leader
        File: /security_groups.tf:1-58
        Guide: https://docs.bridgecrew.io/docs/networking_2

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
        PASSED for resource: aws_security_group.emr_follower
        File: /security_groups.tf:60-85
        Guide: https://docs.bridgecrew.io/docs/networking_1-port-security

Check: CKV_AWS_23: "Ensure every security groups rule has a description"
        PASSED for resource: aws_security_group.emr_follower
        File: /security_groups.tf:60-85
        Guide: https://docs.bridgecrew.io/docs/networking_31

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
        PASSED for resource: aws_security_group.emr_follower
        File: /security_groups.tf:60-85
        Guide: https://docs.bridgecrew.io/docs/networking_2

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
        PASSED for resource: aws_security_group.emr_scylla_access
        File: /security_groups.tf:87-108
        Guide: https://docs.bridgecrew.io/docs/networking_1-port-security

Check: CKV_AWS_23: "Ensure every security groups rule has a description"
        PASSED for resource: aws_security_group.emr_scylla_access
        File: /security_groups.tf:87-108
        Guide: https://docs.bridgecrew.io/docs/networking_31

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
        PASSED for resource: aws_security_group.emr_scylla_access
        File: /security_groups.tf:87-108
        Guide: https://docs.bridgecrew.io/docs/networking_2

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
        PASSED for resource: aws_security_group.emr_alb
        File: /security_groups.tf:110-135
        Guide: https://docs.bridgecrew.io/docs/networking_1-port-security

Check: CKV_AWS_23: "Ensure every security groups rule has a description"
        PASSED for resource: aws_security_group.emr_alb
        File: /security_groups.tf:110-135
        Guide: https://docs.bridgecrew.io/docs/networking_31

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
        PASSED for resource: aws_security_group.emr_alb
        File: /security_groups.tf:110-135
        Guide: https://docs.bridgecrew.io/docs/networking_2

Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22"
        PASSED for resource: aws_security_group.emr_alb_external
        File: /security_groups.tf:137-182
        Guide: https://docs.bridgecrew.io/docs/networking_1-port-security

Check: CKV_AWS_23: "Ensure every security groups rule has a description"
        PASSED for resource: aws_security_group.emr_alb_external
        File: /security_groups.tf:137-182
        Guide: https://docs.bridgecrew.io/docs/networking_31

Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389"
        PASSED for resource: aws_security_group.emr_alb_external
        File: /security_groups.tf:137-182
        Guide: https://docs.bridgecrew.io/docs/networking_2

Check: CKV_AWS_150: "Ensure that Load Balancer has deletion protection enabled"
        PASSED for resource: module.emr_load_balancer_external.aws_alb.load_balancer
        File: /../../../modules/alb/application-load-balancer.tf:56-71
        Calling File: /load_balancer.tf:20-38

Check: CKV_AWS_91: "Ensure the ELBv2 (Application/Network) has access logging enabled"
        PASSED for resource: module.emr_load_balancer_external.aws_alb.load_balancer
        File: /../../../modules/alb/application-load-balancer.tf:56-71
        Calling File: /load_balancer.tf:20-38
        Guide: https://docs.bridgecrew.io/docs/bc_aws_logging_22

Check: CKV2_AWS_7: "Ensure that Amazon EMR clusters' security groups are not open to the world"
        PASSED for resource: aws_emr_cluster.cluster
```


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/EMRClusterKerberosAttributes.py b/checkov/terraform/checks/resource/aws/EMRClusterKerberosAttributes.py
--- a/checkov/terraform/checks/resource/aws/EMRClusterKerberosAttributes.py
+++ b/checkov/terraform/checks/resource/aws/EMRClusterKerberosAttributes.py
@@ -1,23 +1,25 @@
+from typing import Dict, List, Any
+
 from checkov.common.models.enums import CheckResult, CheckCategories
 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
 
 
 class EMRClusterKerberosAttributes(BaseResourceCheck):
-    def __init__(self):
+    def __init__(self) -> None:
         name = "Ensure that EMR clusters with Kerberos have Kerberos Realm set"
         id = "CKV_AWS_114"
-        supported_resources = ['aws_emr_cluster']
+        supported_resources = ["aws_emr_cluster"]
         categories = [CheckCategories.GENERAL_SECURITY]
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def scan_resource_conf(self, conf):
-        if 'kerberos_attributes' in conf:
-            kerberos_attributes = conf['kerberos_attributes'][0]
-            if len(kerberos_attributes) > 0 and 'realm' in kerberos_attributes:
+    def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:
+        if "kerberos_attributes" in conf:
+            kerberos_attributes = conf["kerberos_attributes"][0]
+            if kerberos_attributes and "realm" in kerberos_attributes:
                 return CheckResult.PASSED
             else:
                 return CheckResult.FAILED
-        return CheckResult.SKIPPED
+        return CheckResult.UNKNOWN
 
 
 check = EMRClusterKerberosAttributes()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_EMRClusterKerberosAttributes.py b/tests/terraform/checks/resource/aws/test_EMRClusterKerberosAttributes.py
--- a/tests/terraform/checks/resource/aws/test_EMRClusterKerberosAttributes.py
+++ b/tests/terraform/checks/resource/aws/test_EMRClusterKerberosAttributes.py
@@ -27,7 +27,7 @@ def test_skipped_no_kerberos(self):
         """)
         resource_conf = hcl_res['resource'][0]['aws_emr_cluster']['test']
         scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.SKIPPED, scan_result)
+        self.assertEqual(CheckResult.UNKNOWN, scan_result)
 
     def test_success(self):
         hcl_res = hcl2.loads("""