Repository: bridgecrewio/checkov

Issue:
Check: CKV_GCP_19 False positive
**Describe the bug**
Checkov Will flag your code even if the `basic-auth` is already disabled on your cluster.
**To Reproduce**
Steps to reproduce the behavior:
1. Have a file as follows:
``` 
resource "google_container_cluster" "cluster-test" {
  name     = "cluster-test"
  location = "europe-west1-c"
  provider = google-beta

  remove_default_node_pool = true
  initial_node_count       = 1

  enable_shielded_nodes = true

  release_channel {
    channel = "RAPID"
  }

  pod_security_policy_config {
    enabled = true
  }

  master_auth {
    username = ""
    password = ""

    client_certificate_config {
      issue_client_certificate = false
    }
  }
}
``` 
2. Run cli command  'checkov -d path/to/your/terraform/folder.'
3. See error:
``` 
Check: CKV_GCP_19: "Ensure GKE basic auth is disabled"
	FAILED for resource: google_container_cluster.cluster-test
	File: /cluster.tf:1-27
	Guide: https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_11

		1  | resource "google_container_cluster" "cluster-test" {
		2  |   name     = "cluster-test"
		3  |   location = "europe-west1-c"
		4  |   provider = google-beta
		5  | 
		6  |   remove_default_node_pool = true
		7  |   initial_node_count       = 1
		8  | 
		9  |   enable_shielded_nodes = true
		10 | 
		11 |   release_channel {
		12 |     channel = "RAPID"
		13 |   }
		14 | 
		15 |   pod_security_policy_config {
		16 |     enabled = true
		17 |   }
		18 | 
		19 |   master_auth {
		20 |     username = ""
		21 |     password = ""
		22 | 
		23 |     client_certificate_config {
		24 |       issue_client_certificate = false
		25 |     }
		26 |   }
		27 | }
``` 

**Expected behavior**
``` 
Check: CKV_GCP_19: "Ensure GKE basic auth is disabled"
	PASSED for resource: google_container_cluster.cluster-test
	File: /cluster.tf:1-27
	Guide: https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_7
``` 

The `basic-auth` is already supposed to be disabled using this bit of code as:
```  
  master_auth {
    username = ""
    password = ""

    client_certificate_config {
      issue_client_certificate = false
    }
  }
```

**Environment:**
 - CI: Github Actions 
 - OS: Ubuntu-lastest
 - Checkov Version [latest]
 - Terraform v0.12.24

**Additional context**
Tested and installed today following documentation available here: https://www.checkov.io/1.Introduction/Getting%20Started.html

Discussion:

Patch:
diff --git a/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py b/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py
index b84c8740a..0aa7c847b 100644
--- a/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py
+++ b/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py
@@ -1,5 +1,5 @@
-from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
 from checkov.common.models.enums import CheckResult, CheckCategories
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
 
 
 class GKEBasicAuth(BaseResourceCheck):
@@ -18,7 +18,13 @@ class GKEBasicAuth(BaseResourceCheck):
         :return: <CheckResult>
         """
         if 'master_auth' in conf.keys():
-            if conf['master_auth'][0].get('username') or conf['master_auth'][0].get('password'):
+            username = conf['master_auth'][0].get('username')
+            password = conf['master_auth'][0].get('password')
+            if username or password:
+                # only if both are set to the empty string it is fine
+                # https://www.terraform.io/docs/providers/google/r/container_cluster.html
+                if len(username) == 1 and len(password) == 1 and username[0] == '' and password[0] == '':
+                    return CheckResult.PASSED
                 return CheckResult.FAILED
             return CheckResult.PASSED
         return CheckResult.FAILED


Test patch:
diff --git a/tests/terraform/checks/resource/gcp/test_GKEBasicAuth.py b/tests/terraform/checks/resource/gcp/test_GKEBasicAuth.py
index 5278ee8b4..1469e3d5b 100644
--- a/tests/terraform/checks/resource/gcp/test_GKEBasicAuth.py
+++ b/tests/terraform/checks/resource/gcp/test_GKEBasicAuth.py
@@ -1,23 +1,80 @@
 import unittest
 
-from checkov.terraform.checks.resource.gcp.GKEBasicAuth import check
 from checkov.common.models.enums import CheckResult
+from checkov.terraform.checks.resource.gcp.GKEBasicAuth import check
 
 
 class TestGKEBasicAuth(unittest.TestCase):
 
     def test_failure(self):
-        resource_conf = {'name': ['google_cluster_bad'], 'monitoring_service': ['none'], 'enable_legacy_abac': [True], 'master_authorized_networks_config': [{'cidr_blocks': [{'cidr_block': ['0.0.0.0/0'], 'display_name': ['The world']}]}], 'master_auth': [{'username': ['test'], 'password': ['password']}]}
+        resource_conf = {
+            'name': ['google_cluster_bad'],
+            'monitoring_service': ['none'],
+            'enable_legacy_abac': [True],
+            'master_authorized_networks_config': [
+                {
+                    'cidr_blocks': [
+                        {
+                            'cidr_block': ['0.0.0.0/0'],
+                            'display_name': ['The world'],
+                        }
+                    ]
+                }
+            ],
+            'master_auth': [
+                {
+                    'username': ['test'],
+                    'password': ['password'],
+                }
+            ],
+        }
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
     def test_failure2(self):
-        resource_conf = {'name': ['google_cluster'], 'monitoring_service': ['monitoring.googleapis.com'], 'master_authorized_networks_config': [{}]}
+        resource_conf = {
+            'name': ['google_cluster'],
+            'monitoring_service': ['monitoring.googleapis.com'],
+            'master_authorized_networks_config': [{}],
+        }
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
     def test_success(self):
-        resource_conf = {'name': ['google_cluster'], 'monitoring_service': ['monitoring.googleapis.com'], 'master_authorized_networks_config': [{}], 'master_auth': [{'client_certificate_config': [{'issue_client_certificate': [False]}]}]}
+        resource_conf = {
+            'name': ['google_cluster'],
+            'monitoring_service': ['monitoring.googleapis.com'],
+            'master_authorized_networks_config': [{}],
+            'master_auth': [
+                {
+                    'client_certificate_config': [
+                        {
+                            'issue_client_certificate': [False],
+                        }
+                    ],
+                }
+            ],
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_success_no_basic_out_if_username_and_password_are_present_but_empty(self):
+        resource_conf = {
+            'name': ['google_cluster'],
+            'monitoring_service': ['monitoring.googleapis.com'],
+            'master_authorized_networks_config': [{}],
+            'master_auth': [
+                {
+                    'username': [''],
+                    'password': [''],
+                    'client_certificate_config': [
+                        {
+                            'issue_client_certificate': [False],
+                        }
+                    ],
+                }
+            ]
+        }
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.PASSED, scan_result)