Repository: bridgecrewio/checkov

Issue:
terraform_json not working for cdktf generated json
**Describe the issue**
terraform_json not working for cdktf generated json

**Examples**

```json
{
  "//": {
    "metadata": {
      "backend": "s3",
      "stackName": "prod-zone",
      "version": "0.17.3"
    },
    "outputs": {
      "sbc-prod-zone": {
        "certificate_arn": "certificate_arn",
        "domain": "domain",
        "global_certificate_arn": "global_certificate_arn",
        "nameservers": "nameservers",
        "zone_id": "zone_id"
      }
    }
  },
  "data": {
    "aws_caller_identity": {
      "current": {
        "//": {
          "metadata": {
            "path": "sbc-prod-zone/current",
            "uniqueId": "current"
          }
        }
      }
    }
  },
  "output": {
    "certificate_arn": {
      "value": "${aws_acm_certificate.eu_certificate.arn}"
    },
    "domain": {
      "value": "${aws_route53_zone.zone.name}"
    },
    "global_certificate_arn": {
      "value": "${aws_acm_certificate.global_certificate.arn}"
    },
    "nameservers": {
      "value": "${aws_route53_zone.zone.name_servers}"
    },
    "zone_id": {
      "value": "${aws_route53_zone.zone.zone_id}"
    }
  },
  "provider": {
    "aws": [
      {
        "region": "eu-central-1"
      },
      {
        "alias": "us",
        "region": "us-east-1"
      }
    ]
  },
  "resource": {
    "aws_acm_certificate": {
      "eu_certificate": {
        "//": {
          "metadata": {
            "path": "sbc-prod-zone/eu_certificate",
            "uniqueId": "eu_certificate"
          }
        },
        "domain_name": "${aws_route53_zone.zone.name}",
        "lifecycle": {
          "create_before_destroy": true
        },
        "subject_alternative_names": [
          "*.${aws_route53_zone.zone.name}"
        ],
        "validation_method": "DNS"
      },
      "global_certificate": {
        "//": {
          "metadata": {
            "path": "sbc-prod-zone/global_certificate",
            "uniqueId": "global_certificate"
          }
        },
        "domain_name": "${aws_route53_zone.zone.name}",
        "lifecycle": {
          "create_before_destroy": true
        },
        "provider": "aws.us",
        "subject_alternative_names": [
          "*.${aws_route53_zone.zone.name}"
        ],
        "validation_method": "DNS"
      }
    },
    "aws_route53_record": {
      "dummy": {
        "//": {
          "metadata": {
            "path": "sbc-prod-zone/dummy",
            "uniqueId": "dummy"
          }
        },
        "name": "${aws_route53_zone.zone.name}",
        "records": [
          "1.2.3.4"
        ],
        "ttl": 300,
        "type": "A",
        "zone_id": "${aws_route53_zone.zone.zone_id}"
      }
    },
    "aws_route53_zone": {
      "zone": {
        "//": {
          "metadata": {
            "path": "sbc-prod-zone/zone",
            "uniqueId": "zone"
          }
        },
        "name": "prod.stabl.cloud"
      }
    }
  },
  "terraform": {
    "backend": {
      "s3": {
        "bucket": "terraform-state-145128234233",
        "dynamodb_table": "terraform-locks",
        "encrypt": true,
        "key": "zone/terraform.tfstate",
        "region": "eu-central-1"
      }
    },
    "required_providers": {
      "aws": {
        "source": "aws",
        "version": "4.67.0"
      }
    }
  }
}
```

**Exception Trace**

```sh
LOG_LEVEL=DEBUG checkov -d t --framework terraform_json -o json
2023-08-30 07:41:20,833 [MainThread  ] [DEBUG]  Leveraging the bundled IAM Definition.
2023-08-30 07:41:20,833 [MainThread  ] [DEBUG]  Leveraging the IAM definition at /usr/local/lib/python3.9/dist-packages/policy_sentry/shared/data/iam-definition.json
2023-08-30 07:41:21,105 [MainThread  ] [DEBUG]  Adding the IntegrationFeatureRegistry <checkov.common.bridgecrew.integration_features.features.custom_policies_integration.CustomPoliciesIntegration object at 0x7f12da076730> with order 1
2023-08-30 07:41:21,105 [MainThread  ] [DEBUG]  self.features after the sort:
2023-08-30 07:41:21,105 [MainThread  ] [DEBUG]  [<checkov.common.bridgecrew.integration_features.features.custom_policies_integration.CustomPoliciesIntegration object at 0x7f12da076730>]
2023-08-30 07:41:21,106 [MainThread  ] [DEBUG]  Adding the IntegrationFeatureRegistry <checkov.common.bridgecrew.integration_features.features.policies_3d_integration.Policies3DIntegration object at 0x7f12d45f50a0> with order 11
2023-08-30 07:41:21,106 [MainThread  ] [DEBUG]  self.features after the sort:
2023-08-30 07:41:21,106 [MainThread  ] [DEBUG]  [<checkov.common.bridgecrew.integration_features.features.custom_policies_integration.CustomPoliciesIntegration object at 0x7f12da076730>, <checkov.common.bridgecrew.integration_features.features.policies_3d_integration.Policies3DIntegration object at 0x7f12d45f50a0>]
2023-08-30 07:41:21,107 [MainThread  ] [DEBUG]  Adding the IntegrationFeatureRegistry <checkov.common.bridgecrew.integration_features.features.policy_metadata_integration.PolicyMetadataIntegration object at 0x7f12d460f460> with order 0
2023-08-30 07:41:21,107 [MainThread  ] [DEBUG]  self.features after the sort:
2023-08-30 07:41:21,107 [MainThread  ] [DEBUG]  [<checkov.common.bridgecrew.integration_features.features.policy_metadata_integration.PolicyMetadataIntegration object at 0x7f12d460f460>, <checkov.common.bridgecrew.integration_features.features.custom_policies_integration.CustomPoliciesIntegration object at 0x7f12da076730>, <checkov.common.bridgecrew.integration_features.features.policies_3d_integration.Policies3DIntegration object at 0x7f12d45f50a0>]
2023-08-30 07:41:21,107 [MainThread  ] [DEBUG]  Adding the IntegrationFeatureRegistry <checkov.common.bridgecrew.integration_features.features.fixes_integration.FixesIntegration object at 0x7f12d460f9a0> with order 10
2023-08-30 07:41:21,107 [MainThread  ] [DEBUG]  self.features after the sort:
2023-08-30 07:41:21,107 [MainThread  ] [DEBUG]  [<checkov.common.bridgecrew.integration_features.features.policy_metadata_integration.PolicyMetadataIntegration object at 0x7f12d460f460>, <checkov.common.bridgecrew.integration_features.features.custom_policies_integration.CustomPoliciesIntegration object at 0x7f12da076730>, <checkov.common.bridgecrew.integration_features.features.fixes_integration.FixesIntegration object at 0x7f12d460f9a0>, <checkov.common.bridgecrew.integration_features.features.policies_3d_integration.Policies3DIntegration object at 0x7f12d45f50a0>]
2023-08-30 07:41:21,107 [MainThread  ] [DEBUG]  Adding the IntegrationFeatureRegistry <checkov.common.bridgecrew.integration_features.features.repo_config_integration.RepoConfigIntegration object at 0x7f12d460fdf0> with order 0
2023-08-30 07:41:21,107 [MainThread  ] [DEBUG]  self.features after the sort:
2023-08-30 07:41:21,107 [MainThread  ] [DEBUG]  [<checkov.common.bridgecrew.integration_features.features.policy_metadata_integration.PolicyMetadataIntegration object at 0x7f12d460f460>, <checkov.common.bridgecrew.integration_features.features.repo_config_integration.RepoConfigIntegration object at 0x7f12d460fdf0>, <checkov.common.bridgecrew.integration_features.features.custom_policies_integration.CustomPoliciesIntegration object at 0x7f12da076730>, <checkov.common.bridgecrew.integration_features.features.fixes_integration.FixesIntegration object at 0x7f12d460f9a0>, <checkov.common.bridgecrew.integration_features.features.policies_3d_integration.Policies3DIntegration object at 0x7f12d45f50a0>]
2023-08-30 07:41:21,108 [MainThread  ] [DEBUG]  Adding the IntegrationFeatureRegistry <checkov.common.bridgecrew.integration_features.features.suppressions_integration.SuppressionsIntegration object at 0x7f12d461c640> with order 2
2023-08-30 07:41:21,108 [MainThread  ] [DEBUG]  self.features after the sort:
2023-08-30 07:41:21,108 [MainThread  ] [DEBUG]  [<checkov.common.bridgecrew.integration_features.features.policy_metadata_integration.PolicyMetadataIntegration object at 0x7f12d460f460>, <checkov.common.bridgecrew.integration_features.features.repo_config_integration.RepoConfigIntegration object at 0x7f12d460fdf0>, <checkov.common.bridgecrew.integration_features.features.custom_policies_integration.CustomPoliciesIntegration object at 0x7f12da076730>, <checkov.common.bridgecrew.integration_features.features.suppressions_integration.SuppressionsIntegration object at 0x7f12d461c640>, <checkov.common.bridgecrew.integration_features.features.fixes_integration.FixesIntegration object at 0x7f12d460f9a0>, <checkov.common.bridgecrew.integration_features.features.policies_3d_integration.Policies3DIntegration object at 0x7f12d45f50a0>]
2023-08-30 07:41:21,108 [MainThread  ] [DEBUG]  Adding the IntegrationFeatureRegistry <checkov.common.bridgecrew.integration_features.features.licensing_integration.LicensingIntegration object at 0x7f12d461ca90> with order 6
2023-08-30 07:41:21,108 [MainThread  ] [DEBUG]  self.features after the sort:
2023-08-30 07:41:21,108 [MainThread  ] [DEBUG]  [<checkov.common.bridgecrew.integration_features.features.policy_metadata_integration.PolicyMetadataIntegration object at 0x7f12d460f460>, <checkov.common.bridgecrew.integration_features.features.repo_config_integration.RepoConfigIntegration object at 0x7f12d460fdf0>, <checkov.common.bridgecrew.integration_features.features.custom_policies_integration.CustomPoliciesIntegration object at 0x7f12da076730>, <checkov.common.bridgecrew.integration_features.features.suppressions_integration.SuppressionsIntegration object at 0x7f12d461c640>, <checkov.common.bridgecrew.integration_features.features.licensing_integration.LicensingIntegration object at 0x7f12d461ca90>, <checkov.common.bridgecrew.integration_features.features.fixes_integration.FixesIntegration object at 0x7f12d460f9a0>, <checkov.common.bridgecrew.integration_features.features.policies_3d_integration.Policies3DIntegration object at 0x7f12d45f50a0>]
2023-08-30 07:41:21,123 [MainThread  ] [DEBUG]  Loading external checks from /home/node/.local/lib/python3.9/site-packages/checkov/bicep/checks/graph_checks
2023-08-30 07:41:21,124 [MainThread  ] [DEBUG]  Searching through ['__pycache__'] and ['SQLServerAuditingEnabled.json', '__init__.py']
2023-08-30 07:41:21,124 [MainThread  ] [DEBUG]  Searching through [] and ['__init__.cpython-39.pyc']
2023-08-30 07:41:21,195 [MainThread  ] [DEBUG]  Popen(['git', 'version'], cwd=/workspaces/SBC-Infrastructure/src/grafana, universal_newlines=False, shell=None, istream=None)
2023-08-30 07:41:21,199 [MainThread  ] [DEBUG]  Popen(['git', 'version'], cwd=/workspaces/SBC-Infrastructure/src/grafana, universal_newlines=False, shell=None, istream=None)
2023-08-30 07:41:21,368 [MainThread  ] [DEBUG]  No API key present; setting include_all_checkov_policies to True
2023-08-30 07:41:21,371 [MainThread  ] [DEBUG]  Run metadata: {
  "checkov_version": "2.4.14",
  "python_executable": "/usr/bin/python3",
  "python_version": "3.9.2 (default, Feb 28 2021, 17:03:44) \n[GCC 10.2.1 20210110]",
  "checkov_executable": "/home/node/.local/bin/checkov",
  "args": [
    "Command Line Args:   -d t --framework terraform_json -o json",
    "Defaults:",
    "  --branch:          master",
    "  --download-external-modules:False",
    "  --external-modules-download-path:.external_modules",
    "  --evaluate-variables:True",
    "  --secrets-scan-file-type:[]",
    "  --block-list-secret-scan:[]",
    "  --summary-position:top",
    "  --mask:            []",
    "  --secrets-history-timeout:12h",
    ""
  ],
  "OS_system_info": "Linux-5.15.90.1-microsoft-standard-WSL2-x86_64-with-glibc2.31",
  "CPU_architecture": "",
  "Python_implementation": "CPython"
}
2023-08-30 07:41:21,372 [MainThread  ] [DEBUG]  Using cert_reqs None
2023-08-30 07:41:21,372 [MainThread  ] [DEBUG]  Successfully set up HTTP manager
2023-08-30 07:41:21,372 [MainThread  ] [DEBUG]  Resultant set of frameworks (removing skipped frameworks): terraform_json
2023-08-30 07:41:21,372 [MainThread  ] [DEBUG]  BC_SOURCE = cli, version = 2.4.14
2023-08-30 07:41:21,372 [MainThread  ] [DEBUG]  terraform_json_runner declares no system dependency checks required.
2023-08-30 07:41:21,372 [MainThread  ] [DEBUG]  No API key found. Scanning locally only.
2023-08-30 07:41:21,481 [MainThread  ] [DEBUG]  Got checkov mappings and guidelines from Bridgecrew platform
2023-08-30 07:41:21,482 [MainThread  ] [DEBUG]  Loading external checks from /home/node/.local/lib/python3.9/site-packages/checkov/terraform_json/checks/graph_checks
2023-08-30 07:41:21,485 [MainThread  ] [DEBUG]  Running without API key, so only open source runners will be enabled
2023-08-30 07:41:21,485 [MainThread  ] [DEBUG]  Filtered list of policies: []
2023-08-30 07:41:21,486 [MainThread  ] [DEBUG]  Received the following policy-level suppressions, that will be skipped from running: []
2023-08-30 07:41:21,486 [MainThread  ] [DEBUG]  Checking if terraform_json is valid for license
2023-08-30 07:41:21,486 [MainThread  ] [DEBUG]  Open source mode - the runner is enabled
2023-08-30 07:41:21,486 [MainThread  ] [INFO ]  Start to parse 1 files
2023-08-30 07:41:21,496 [MainThread  ] [INFO ]  Successfully parsed 1 files
2023-08-30 07:41:21,496 [MainThread  ] [INFO ]  Creating Terraform JSON graph
2023-08-30 07:41:21,496 [MainThread  ] [WARNI]  Failed to add block [{'aws_caller_identity': {'current': [{'//': {'metadata': {'path': 'sbc-prod-zone/current', 'uniqueId': 'current', '__startline__': 22, '__endline__': 25}, '__startline__': 21, '__endline__': 26}, '__startline__': 20, '__endline__': 27}], '__startline__': 19, '__endline__': 28}}]. Error:
2023-08-30 07:41:21,496 [MainThread  ] [WARNI]  'list' object has no attribute 'items'
2023-08-30 07:41:21,497 [MainThread  ] [INFO ]  Creating vertices
2023-08-30 07:41:21,497 [MainThread  ] [INFO ]  [TerraformLocalGraph] created 11 vertices
2023-08-30 07:41:21,497 [MainThread  ] [INFO ]  Creating edges
2023-08-30 07:41:21,497 [MainThread  ] [INFO ]  [TerraformLocalGraph] created 11 edges
2023-08-30 07:41:21,498 [MainThread  ] [INFO ]  Rendering variables, graph has 11 vertices and 11 edges
2023-08-30 07:41:21,498 [MainThread  ] [DEBUG]  evaluating 9 edges
2023-08-30 07:41:21,499 [MainThread  ] [DEBUG]  evaluating 2 edges
2023-08-30 07:41:21,499 [MainThread  ] [DEBUG]  done evaluating edges
2023-08-30 07:41:21,500 [MainThread  ] [DEBUG]  done evaluate_non_rendered_values
2023-08-30 07:41:21,500 [MainThread  ] [INFO ]  Building cross variable edges
2023-08-30 07:41:21,500 [MainThread  ] [INFO ]  Found 0 cross variable edges
2023-08-30 07:41:21,500 [MainThread  ] [INFO ]  Successfully created Terraform JSON graph
2023-08-30 07:41:21,501 [MainThread  ] [DEBUG]  Scanning file: /cdk.tf.json
2023-08-30 07:41:21,501 [MainThread  ] [ERROR]  Exception traceback:
Traceback (most recent call last):
  File "/home/node/.local/lib/python3.9/site-packages/checkov/main.py", line 470, in run
    self.scan_reports = runner_registry.run(
  File "/home/node/.local/lib/python3.9/site-packages/checkov/common/runners/runner_registry.py", line 120, in run
    self.runners[0].run(root_folder, external_checks_dir=external_checks_dir, files=files,
  File "/home/node/.local/lib/python3.9/site-packages/checkov/terraform_json/runner.py", line 107, in run
    self.add_python_check_results(report=report, runner_filter=runner_filter)
  File "/home/node/.local/lib/python3.9/site-packages/checkov/terraform_json/runner.py", line 124, in add_python_check_results
    self.run_block(
  File "/home/node/.local/lib/python3.9/site-packages/checkov/terraform_json/runner.py", line 202, in run_block
    start_line = entity_config[START_LINE]
TypeError: list indices must be integers or slices, not str
Traceback (most recent call last):
  File "/home/node/.local/bin/checkov", line 9, in <module>
    sys.exit(Checkov().run())
  File "/home/node/.local/lib/python3.9/site-packages/checkov/main.py", line 470, in run
    self.scan_reports = runner_registry.run(
  File "/home/node/.local/lib/python3.9/site-packages/checkov/common/runners/runner_registry.py", line 120, in run
    self.runners[0].run(root_folder, external_checks_dir=external_checks_dir, files=files,
  File "/home/node/.local/lib/python3.9/site-packages/checkov/terraform_json/runner.py", line 107, in run
    self.add_python_check_results(report=report, runner_filter=runner_filter)
  File "/home/node/.local/lib/python3.9/site-packages/checkov/terraform_json/runner.py", line 124, in add_python_check_results
    self.run_block(
  File "/home/node/.local/lib/python3.9/site-packages/checkov/terraform_json/runner.py", line 202, in run_block
    start_line = entity_config[START_LINE]
TypeError: list indices must be integers or slices, not str
```

**Desktop (please complete the following information):**
 - OS: Ubuntu
 - Checkov Version: 2.4.14



Discussion:

Resolving patch:
diff --git a/checkov/terraform_json/parser.py b/checkov/terraform_json/parser.py
--- a/checkov/terraform_json/parser.py
+++ b/checkov/terraform_json/parser.py
@@ -94,8 +94,8 @@ def prepare_definition(definition: dict[str, Any]) -> dict[str, Any]:
             if block_name == COMMENT_FIELD_NAME or block_name in LINE_FIELD_NAMES:
                 continue
 
-            if block_type == BlockType.RESOURCE:
-                # resource have an extra nested level resource_type -> resource_name -> resource_config
+            if block_type in (BlockType.RESOURCE, BlockType.DATA):
+                # data/resource have an extra nested level resource_type -> resource_name -> resource_config
                 for resource_name, resource_config in config.items():
                     if resource_name in IGNORE_FILED_NAMES:
                         continue
diff --git a/checkov/terraform_json/runner.py b/checkov/terraform_json/runner.py
--- a/checkov/terraform_json/runner.py
+++ b/checkov/terraform_json/runner.py
@@ -19,7 +19,7 @@
 from checkov.terraform.checks.resource.registry import resource_registry
 from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph
 from checkov.terraform.runner import Runner as TerraformRunner
-from checkov.terraform_json.utils import get_scannable_file_paths, TF_JSON_POSSIBLE_FILE_ENDINGS, create_definitions
+from checkov.terraform_json.utils import get_scannable_file_paths, create_definitions
 
 if TYPE_CHECKING:
     from checkov.common.graph.checks_infra.registry import BaseRegistry
@@ -48,7 +48,7 @@ def __init__(
             external_registries=external_registries,
             source=source,
         )
-        self.file_extensions = TF_JSON_POSSIBLE_FILE_ENDINGS  # override what gets set from the TF runner
+        self.file_extensions = (".json",)  # just '.json' not 'tf.json' otherwise it will be filtered out
         self.graph_registry = get_graph_checks_registry(super().check_type)
 
         self.definitions: dict[str, dict[str, Any]] = {}  # type:ignore[assignment]  # need to check, how to support subclass differences


Test patch:
diff --git a/tests/terraform_json/examples/cdk.tf.json b/tests/terraform_json/examples/cdk.tf.json
--- a/tests/terraform_json/examples/cdk.tf.json
+++ b/tests/terraform_json/examples/cdk.tf.json
@@ -16,6 +16,18 @@
       }
     }
   },
+  "data": {
+    "aws_caller_identity": {
+      "current": {
+        "//": {
+          "metadata": {
+            "path": "AppStack/current",
+            "uniqueId": "current"
+          }
+        }
+      }
+    }
+  },
   "output": {
     "bucket_arn": {
       "value": "${aws_s3_bucket.bucket.arn}"
diff --git a/tests/terraform_json/test_graph_manager.py b/tests/terraform_json/test_graph_manager.py
--- a/tests/terraform_json/test_graph_manager.py
+++ b/tests/terraform_json/test_graph_manager.py
@@ -33,7 +33,7 @@ def test_build_graph_from_definitions(graph_connector):
     )
 
     # then
-    assert len(local_graph.vertices) == 5
+    assert len(local_graph.vertices) == 6
 
     bucket_idx = local_graph.vertices_block_name_map["resource"]["aws_s3_bucket.bucket"][0]
     bucket = local_graph.vertices[bucket_idx]
@@ -42,8 +42,8 @@ def test_build_graph_from_definitions(graph_connector):
     assert bucket.id == "aws_s3_bucket.bucket"
     assert bucket.source == "Terraform"
     assert bucket.attributes[CustomAttributes.RESOURCE_TYPE] == ["aws_s3_bucket"]
-    assert bucket.attributes[START_LINE] == 34
-    assert bucket.attributes[END_LINE] == 53
+    assert bucket.attributes[START_LINE] == 46
+    assert bucket.attributes[END_LINE] == 65
     assert bucket.config == {
         "aws_s3_bucket": {
             "bucket": {
@@ -53,32 +53,25 @@ def test_build_graph_from_definitions(graph_connector):
                             {
                                 "comment": "Access logging not needed",
                                 "id": "CKV_AWS_18",
-                                "__startline__": 38,
-                                "__endline__": 41,
+                                "__startline__": 50,
+                                "__endline__": 53,
                             }
                         ],
-                        "__startline__": 36,
-                        "__endline__": 43,
+                        "__startline__": 48,
+                        "__endline__": 55,
                     },
                     "metadata": {
                         "path": "AppStack/bucket",
                         "uniqueId": "bucket",
-                        "__startline__": 44,
-                        "__endline__": 47,
+                        "__startline__": 56,
+                        "__endline__": 59,
                     },
-                    "__startline__": 35,
-                    "__endline__": 48,
+                    "__startline__": 47,
+                    "__endline__": 60,
                 },
-                "tags": [
-                    {
-                        "Name": "example",
-                        "Private": "true",
-                        "__startline__": 49,
-                        "__endline__": 52,
-                    }
-                ],
-                "__startline__": 34,
-                "__endline__": 53,
+                "tags": [{"Name": "example", "Private": "true", "__startline__": 61, "__endline__": 64}],
+                "__startline__": 46,
+                "__endline__": 65,
                 "__address__": "aws_s3_bucket.bucket",
             }
         }