Repository: bridgecrewio/checkov

Issue:
Azure NSG Security rule loop error
I got the following error when I execute to scan Azure NSG terraform file.

_ERROR:checkov.terraform.checks.resource.azure.NSGRuleSSHAccessRestricted:Failed to run check: Ensure that SSH access is restricted from the internet for configuration: {'name': ['${var.nsg_name}'], 'resource_group_name': ['${azurerm_resource_group.rg.name}'], 'location': ['${var.location}'], 'security_rule': ['${[for rule in var.security_rules : {\'name\': \'${rule.name}\', \'priority\': \'${rule.priority}\', \'source_address_prefix\': \'${lookup(rule,"source_address_prefixes",[]) == [] ? lookup(rule,"source_address_prefix",var.nsg_default_source_address_prefix) : ""}\', \'source_address_prefixes\': \'${lookup(rule,"source_address_prefixes",[])}\', \'access\': \'${lookup(rule,"access",var.nsg_default_access)}\', \'destination_port_range\': \'${lookup(rule,"destination_port_ranges",[]) == [] ? lookup(rule,"destination_port_range",var.nsg_default_destination_port_range) : ""}\', \'destination_port_ranges\': \'${lookup(rule,"destination_port_ranges",[])}\', \'direction\': \'${lookup(rule,"direction",var.nsg_default_direction)}\', \'protocol\': \'${lookup(rule,"protocol",var.nsg_default_protocol)}\', \'source_port_range\': \'${lookup(rule,"source_port_range",var.nsg_default_source_port_range)}\', \'description\': \'\', \'destination_address_prefix\': \'*\', \'destination_address_prefixes\': [], \'destination_application_security_group_ids\': [], \'source_application_security_group_ids\': [], \'source_port_ranges\': []}]}'], 'tags': ['${var.tags}']} at file: /aaa.tf
2020-09-11 11:23:01,213 [MainThread  ] [ERROR]  Failed to run check: Ensure that SSH access is restricted from the internet for configuration: {'name': ['${var.nsg_name}'], 'resource_group_name': ['${azurerm_resource_group.rg.name}'], 'location': ['${var.location}'], 'security_rule': ['${[for rule in var.security_rules : {\'name\': \'${rule.name}\', \'priority\': \'${rule.priority}\', \'source_address_prefix\': \'${lookup(rule,"source_address_prefixes",[]) == [] ? lookup(rule,"source_address_prefix",var.nsg_default_source_address_prefix) : ""}\', \'source_address_prefixes\': \'${lookup(rule,"source_address_prefixes",[])}\', \'access\': \'${lookup(rule,"access",var.nsg_default_access)}\', \'destination_port_range\': \'${lookup(rule,"destination_port_ranges",[]) == [] ? lookup(rule,"destination_port_range",var.nsg_default_destination_port_range) : ""}\', \'destination_port_ranges\': \'${lookup(rule,"destination_port_ranges",[])}\', \'direction\': \'${lookup(rule,"direction",var.nsg_default_direction)}\', \'protocol\': \'${lookup(rule,"protocol",var.nsg_default_protocol)}\', \'source_port_range\': \'${lookup(rule,"source_port_range",var.nsg_default_source_port_range)}\', \'description\': \'\', \'destination_address_prefix\': \'*\', \'destination_address_prefixes\': [], \'destination_application_security_group_ids\': [], \'source_application_security_group_ids\': [], \'source_port_ranges\': []}]}'], 'tags': ['${var.tags}']} at file: /aaa.tf
Traceback (most recent call last):
  File "/usr/local/bin/checkov", line 5, in <module>
    run()
  File "/usr/local/lib/python3.8/site-packages/checkov/main.py", line 65, in run
    scan_reports = runner_registry.run(root_folder=root_folder, external_checks_dir=external_checks_dir,
  File "/usr/local/lib/python3.8/site-packages/checkov/common/runners/runner_registry.py", line 27, in run
    scan_report = runner.run(root_folder, external_checks_dir=external_checks_dir, files=files,
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 52, in run
    self.check_tf_definition(report, root_folder, runner_filter)
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 94, in check_tf_definition
    self.run_block(definition[block_type], definitions_context, full_file_path, report, scanned_file,
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 117, in run_block
    results = registry.scan(scanned_file, entity, skipped_checks, runner_filter)
  File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check_registry.py", line 104, in scan
    result = self.run_check(check, entity_configuration, entity_name, entity_type, scanned_file, skip_info)
  File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check_registry.py", line 110, in run_check
    result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,
  File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check.py", line 58, in run
    raise e
  File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check.py", line 39, in run
    check_result['result'] = self.scan_entity_conf(entity_configuration, entity_type)
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/checks/resource/base_resource_check.py", line 16, in scan_entity_conf
    return self.scan_resource_conf(conf, entity_type)
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/checks/resource/base_resource_check.py", line 28, in wrapper
    return wrapped(self, conf)
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py", line 37, in scan_resource_conf
    if 'access' in rule_conf and rule_conf['access'][0] == "Allow":
TypeError: string indices must be integers_

**Scanned NSG:**

resource "azurerm_network_security_group" "mynsg" {
  name                = var.nsg_name
  resource_group_name = azurerm_resource_group.rg.name
  location            = var.location

  security_rule = [for rule in var.security_rules : {
    name     = rule.name
    priority = rule.priority
    source_address_prefix                      = lookup(rule, "source_address_prefixes", []) == [] ? lookup(rule, "source_address_prefix", var.nsg_default_source_address_prefix) : ""
    source_address_prefixes                    = lookup(rule, "source_address_prefixes", [])
    access                                     = lookup(rule, "access", var.nsg_default_access)
    destination_port_range                     = lookup(rule, "destination_port_ranges", []) == [] ? lookup(rule, "destination_port_range", var.nsg_default_destination_port_range) : ""
    destination_port_ranges                    = lookup(rule, "destination_port_ranges", [])
    direction                                  = lookup(rule, "direction", var.nsg_default_direction)
    protocol                                   = lookup(rule, "protocol", var.nsg_default_protocol)
    source_port_range                          = lookup(rule, "source_port_range", var.nsg_default_source_port_range)
    description                                = ""
    destination_address_prefix                 = "*"
    destination_address_prefixes               = []
    destination_application_security_group_ids = []
    source_application_security_group_ids      = []
    source_port_ranges                         = []
    }
  ]
}


Discussion:

Patch:
diff --git a/HomebrewFormula/checkov.rb b/HomebrewFormula/checkov.rb
index 60e093c8f..0ba6d7d35 100644
--- a/HomebrewFormula/checkov.rb
+++ b/HomebrewFormula/checkov.rb
@@ -3,8 +3,8 @@ class Checkov < Formula
 
   desc "Shiny new formula"
   homepage "https://github.com/bridgecrewio/checkov"
-  url "https://files.pythonhosted.org/packages/02/4c/33f4ecd03a7c6366777bb4c9498afd78edc181f91864925f9b38f836059d/checkov-1.0.589.tar.gz"
-  sha256 "2442351f736ed4c1cac9063ca8a1a813c89a0cda018905c21a948eebbde88eb5"
+  url "https://files.pythonhosted.org/packages/f2/da/080fe45355b770e7b6d1ed2a6ee2000e841fd5d635011fec5f70093f8772/checkov-1.0.582.tar.gz"
+  sha256 "b839fd36e67e0566fd1dd9b43b7c7155c87fbbd3567e28716227d6f40426edc9"
 
   depends_on "python3"
 
diff --git a/checkov/cloudformation/runner.py b/checkov/cloudformation/runner.py
index 2659c551c..43cec1321 100644
--- a/checkov/cloudformation/runner.py
+++ b/checkov/cloudformation/runner.py
@@ -46,7 +46,7 @@ class Runner(BaseRunner):
                     logging.info(f'CloudFormation skipping {file} as it is not a valid CF template')
 
         # Filter out empty files that have not been parsed successfully, and filter out non-CF template files
-        definitions = {k: v for k, v in definitions.items() if v and isinstance(v, dict_node) and v.__contains__("Resources") and isinstance(v["Resources"], dict_node)}
+        definitions = {k: v for k, v in definitions.items() if v and isinstance(v, dict_node) and v.__contains__("Resources")}
         definitions_raw = {k: v for k, v in definitions_raw.items() if k in definitions.keys()}
 
         for cf_file in definitions.keys():
diff --git a/checkov/common/bridgecrew/platform_integration.py b/checkov/common/bridgecrew/platform_integration.py
index 9d4825307..3a3c1d887 100644
--- a/checkov/common/bridgecrew/platform_integration.py
+++ b/checkov/common/bridgecrew/platform_integration.py
@@ -294,8 +294,6 @@ class BcPlatformIntegration(object):
         while not valid:
             result = str(
                 input('Organization name (this will create an account with matching identifier): ')).lower().strip()  # nosec
-            # remove spaces and special characters
-            result = ''.join(e for e in result if e.isalnum())
             if result:
                 valid = True
         return result
diff --git a/checkov/common/runners/runner_registry.py b/checkov/common/runners/runner_registry.py
index a923272c3..fd814a80a 100644
--- a/checkov/common/runners/runner_registry.py
+++ b/checkov/common/runners/runner_registry.py
@@ -34,7 +34,7 @@ class RunnerRegistry(object):
         return self.scan_reports
 
     def print_reports(self, scan_reports, args):
-        if args.output == 'cli':
+        if args.output not in OUTPUT_CHOICES:
             print(f"{self.banner}\n")
         exit_codes = []
         report_jsons = []
diff --git a/checkov/main.py b/checkov/main.py
index 5a87fe84a..04daa68a5 100644
--- a/checkov/main.py
+++ b/checkov/main.py
@@ -81,8 +81,6 @@ def run(banner=checkov_banner):
             bc_integration.commit_repository(args.branch)
         runner_registry.print_reports(scan_reports, args)
     else:
-        print(f"{banner}")
-
         bc_integration.onboarding()
 
 
diff --git a/checkov/terraform/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py b/checkov/terraform/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py
index ceee9885e..9375ca2ce 100644
--- a/checkov/terraform/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py
+++ b/checkov/terraform/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py
@@ -22,10 +22,10 @@ class ElasticsearchNodeToNodeEncryption(BaseResourceCheck):
             if isinstance(cluster_config, dict):
                 if "instance_count" not in cluster_config:
                     return CheckResult.PASSED
-                instance_count = cluster_config["instance_count"]
+                instance_count = cluster_config["instance_count"][0]
                 if isinstance(instance_count, int):
                     if instance_count > 1:
-                        if "node_to_node_encryption" in conf.keys() and conf["node_to_node_encryption"][0]["enabled"]:
+                        if "node_to_node_encryption" in conf.keys() and conf["node_to_node_encryption"][0]["enabled"][0]:
                                 return CheckResult.PASSED
                         else:
                             return CheckResult.FAILED
diff --git a/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py b/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py
index 2aa3ceb7a..c05cd0fff 100644
--- a/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py
+++ b/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py
@@ -34,6 +34,8 @@ class NSGRulePortAccessRestricted(BaseResourceCheck):
             rule_confs = conf['security_rule']
 
         for rule_conf in rule_confs:
+            if not isinstance(rule_conf, dict):
+                return CheckResult.UNKNOWN
             if 'access' in rule_conf and rule_conf['access'][0] == "Allow":
                 if 'direction' in rule_conf and rule_conf['direction'][0] == "Inbound":
                     if 'protocol' in rule_conf and rule_conf['protocol'][0].upper() == 'TCP':
diff --git a/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py b/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py
index 0aa7c847b..b84c8740a 100644
--- a/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py
+++ b/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py
@@ -1,5 +1,5 @@
-from checkov.common.models.enums import CheckResult, CheckCategories
 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+from checkov.common.models.enums import CheckResult, CheckCategories
 
 
 class GKEBasicAuth(BaseResourceCheck):
@@ -18,13 +18,7 @@ class GKEBasicAuth(BaseResourceCheck):
         :return: <CheckResult>
         """
         if 'master_auth' in conf.keys():
-            username = conf['master_auth'][0].get('username')
-            password = conf['master_auth'][0].get('password')
-            if username or password:
-                # only if both are set to the empty string it is fine
-                # https://www.terraform.io/docs/providers/google/r/container_cluster.html
-                if len(username) == 1 and len(password) == 1 and username[0] == '' and password[0] == '':
-                    return CheckResult.PASSED
+            if conf['master_auth'][0].get('username') or conf['master_auth'][0].get('password'):
                 return CheckResult.FAILED
             return CheckResult.PASSED
         return CheckResult.FAILED
diff --git a/checkov/version.py b/checkov/version.py
index ba2160ac4..431cccd50 100644
--- a/checkov/version.py
+++ b/checkov/version.py
@@ -1,1 +1,1 @@
-version = '1.0.589'
+version = '1.0.582'
diff --git a/docs/3.Scans/resource-scans.md b/docs/3.Scans/resource-scans.md
index 314bb4c06..fec23c409 100644
--- a/docs/3.Scans/resource-scans.md
+++ b/docs/3.Scans/resource-scans.md
@@ -386,19 +386,19 @@ nav_order: 1
 | 375 | CKV_K8S_19   | PodSecurityPolicy | CronJob                                                                      | Containers should not share the host network namespace                                                                                                                                                   | Kubernetes     |
 | 376 | CKV_K8S_20   | PodSecurityPolicy | containers                                                                   | Containers should not run with allowPrivilegeEscalation                                                                                                                                                  | Kubernetes     |
 | 377 | CKV_K8S_20   | PodSecurityPolicy | initContainers                                                               | Containers should not run with allowPrivilegeEscalation                                                                                                                                                  | Kubernetes     |
-| 378 | CKV_K8S_21   | PodSecurityPolicy | RoleBinding                                                                  | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 379 | CKV_K8S_21   | PodSecurityPolicy | Pod                                                                          | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 380 | CKV_K8S_21   | PodSecurityPolicy | Deployment                                                                   | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 381 | CKV_K8S_21   | PodSecurityPolicy | DaemonSet                                                                    | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 382 | CKV_K8S_21   | PodSecurityPolicy | StatefulSet                                                                  | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 383 | CKV_K8S_21   | PodSecurityPolicy | ReplicaSet                                                                   | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 384 | CKV_K8S_21   | PodSecurityPolicy | ReplicationController                                                        | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 385 | CKV_K8S_21   | PodSecurityPolicy | Job                                                                          | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 386 | CKV_K8S_21   | PodSecurityPolicy | CronJob                                                                      | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 387 | CKV_K8S_21   | PodSecurityPolicy | ServiceAccount                                                               | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 388 | CKV_K8S_21   | PodSecurityPolicy | Service                                                                      | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 389 | CKV_K8S_21   | PodSecurityPolicy | Secret                                                                       | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 390 | CKV_K8S_21   | PodSecurityPolicy | Role                                                                         | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 378 | CKV_K8S_21   | PodSecurityPolicy | Pod                                                                          | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 379 | CKV_K8S_21   | PodSecurityPolicy | Deployment                                                                   | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 380 | CKV_K8S_21   | PodSecurityPolicy | DaemonSet                                                                    | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 381 | CKV_K8S_21   | PodSecurityPolicy | StatefulSet                                                                  | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 382 | CKV_K8S_21   | PodSecurityPolicy | ReplicaSet                                                                   | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 383 | CKV_K8S_21   | PodSecurityPolicy | ReplicationController                                                        | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 384 | CKV_K8S_21   | PodSecurityPolicy | Job                                                                          | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 385 | CKV_K8S_21   | PodSecurityPolicy | CronJob                                                                      | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 386 | CKV_K8S_21   | PodSecurityPolicy | Service                                                                      | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 387 | CKV_K8S_21   | PodSecurityPolicy | Secret                                                                       | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 388 | CKV_K8S_21   | PodSecurityPolicy | ServiceAccount                                                               | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 389 | CKV_K8S_21   | PodSecurityPolicy | Role                                                                         | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 390 | CKV_K8S_21   | PodSecurityPolicy | RoleBinding                                                                  | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 391 | CKV_K8S_21   | PodSecurityPolicy | ConfigMap                                                                    | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 392 | CKV_K8S_21   | PodSecurityPolicy | Ingress                                                                      | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 393 | CKV_K8S_22   | PodSecurityPolicy | containers                                                                   | Use read-only filesystem for containers where possible                                                                                                                                                   | Kubernetes     |
diff --git a/kubernetes/requirements.txt b/kubernetes/requirements.txt
index 5589b9a53..e13822712 100644
--- a/kubernetes/requirements.txt
+++ b/kubernetes/requirements.txt
@@ -1,1 +1,1 @@
-checkov==1.0.589
+checkov==1.0.582


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_ElasticsearchNodeToNodeEncryption.py b/tests/terraform/checks/resource/aws/test_ElasticsearchNodeToNodeEncryption.py
index e85774fb1..a096c9d15 100644
--- a/tests/terraform/checks/resource/aws/test_ElasticsearchNodeToNodeEncryption.py
+++ b/tests/terraform/checks/resource/aws/test_ElasticsearchNodeToNodeEncryption.py
@@ -45,14 +45,14 @@ class TestElasticsearchNodeToNodeEncryption(unittest.TestCase):
                  'volume_size': ['${var.ebs_volume_size}'], 'volume_type': ['${var.ebs_volume_type}'],
                  'iops': ['${var.ebs_iops}']}],
                          'encrypt_at_rest': [{'enabled': [False], 'kms_key_id': ['${var.encrypt_at_rest_kms_key_id}']}],
-                         'cluster_config': [{'instance_count': 3, 'instance_type': ['${var.instance_type}'],
+                         'cluster_config': [{'instance_count': [3], 'instance_type': ['${var.instance_type}'],
                                              'dedicated_master_enabled': ['${var.dedicated_master_enabled}'],
                                              'dedicated_master_count': ['${var.dedicated_master_count}'],
                                              'dedicated_master_type': ['${var.dedicated_master_type}'],
                                              'zone_awareness_enabled': ['${var.zone_awareness_enabled}'],
                                              'zone_awareness_config': [
                                                  {'availability_zone_count': ['${var.availability_zone_count}']}]}],
-                         'node_to_node_encryption': [{'enabled': False}], 'vpc_options': [
+                         'node_to_node_encryption': [{'enabled': [False]}], 'vpc_options': [
                 {'security_group_ids': [['${join("",aws_security_group.default.*.id)}']],
                  'subnet_ids': ['${var.subnet_ids}']}], 'snapshot_options': [
                 {'automated_snapshot_start_hour': ['${var.automated_snapshot_start_hour}']}],
@@ -76,7 +76,7 @@ class TestElasticsearchNodeToNodeEncryption(unittest.TestCase):
                  'volume_size': ['${var.ebs_volume_size}'], 'volume_type': ['${var.ebs_volume_type}'],
                  'iops': ['${var.ebs_iops}']}],
                          'encrypt_at_rest': [{'enabled': [False], 'kms_key_id': ['${var.encrypt_at_rest_kms_key_id}']}],
-                         'cluster_config': [{'instance_count': 3, 'instance_type': ['${var.instance_type}'],
+                         'cluster_config': [{'instance_count': [3], 'instance_type': ['${var.instance_type}'],
                                              'dedicated_master_enabled': ['${var.dedicated_master_enabled}'],
                                              'dedicated_master_count': ['${var.dedicated_master_count}'],
                                              'dedicated_master_type': ['${var.dedicated_master_type}'],
@@ -107,14 +107,14 @@ class TestElasticsearchNodeToNodeEncryption(unittest.TestCase):
                  'volume_size': ['${var.ebs_volume_size}'], 'volume_type': ['${var.ebs_volume_type}'],
                  'iops': ['${var.ebs_iops}']}],
                          'encrypt_at_rest': [{'enabled': [True], 'kms_key_id': ['${var.encrypt_at_rest_kms_key_id}']}],
-                         'cluster_config': [{'instance_count': 3, 'instance_type': ['${var.instance_type}'],
+                         'cluster_config': [{'instance_count': [3], 'instance_type': ['${var.instance_type}'],
                                              'dedicated_master_enabled': ['${var.dedicated_master_enabled}'],
                                              'dedicated_master_count': ['${var.dedicated_master_count}'],
                                              'dedicated_master_type': ['${var.dedicated_master_type}'],
                                              'zone_awareness_enabled': ['${var.zone_awareness_enabled}'],
                                              'zone_awareness_config': [
                                                  {'availability_zone_count': ['${var.availability_zone_count}']}]}],
-                         'node_to_node_encryption': [{'enabled': True}], 'vpc_options': [
+                         'node_to_node_encryption': [{'enabled': [True]}], 'vpc_options': [
                 {'security_group_ids': [['${join("",aws_security_group.default.*.id)}']],
                  'subnet_ids': ['${var.subnet_ids}']}], 'snapshot_options': [
                 {'automated_snapshot_start_hour': ['${var.automated_snapshot_start_hour}']}],
@@ -138,14 +138,14 @@ class TestElasticsearchNodeToNodeEncryption(unittest.TestCase):
                  'volume_size': ['${var.ebs_volume_size}'], 'volume_type': ['${var.ebs_volume_type}'],
                  'iops': ['${var.ebs_iops}']}],
                          'encrypt_at_rest': [{'enabled': [True], 'kms_key_id': ['${var.encrypt_at_rest_kms_key_id}']}],
-                         'cluster_config': [{'instance_count': 1, 'instance_type': ['${var.instance_type}'],
+                         'cluster_config': [{'instance_count': [1], 'instance_type': ['${var.instance_type}'],
                                              'dedicated_master_enabled': ['${var.dedicated_master_enabled}'],
                                              'dedicated_master_count': ['${var.dedicated_master_count}'],
                                              'dedicated_master_type': ['${var.dedicated_master_type}'],
                                              'zone_awareness_enabled': ['${var.zone_awareness_enabled}'],
                                              'zone_awareness_config': [
                                                  {'availability_zone_count': ['${var.availability_zone_count}']}]}],
-                         'node_to_node_encryption': [{'enabled': False}], 'vpc_options': [
+                         'node_to_node_encryption': [{'enabled': [False]}], 'vpc_options': [
                 {'security_group_ids': [['${join("",aws_security_group.default.*.id)}']],
                  'subnet_ids': ['${var.subnet_ids}']}], 'snapshot_options': [
                 {'automated_snapshot_start_hour': ['${var.automated_snapshot_start_hour}']}],
diff --git a/tests/terraform/checks/resource/azure/test_NSGRuleSSHAccessRestricted.py b/tests/terraform/checks/resource/azure/test_NSGRuleSSHAccessRestricted.py
index c73d20604..1e9d0b39d 100644
--- a/tests/terraform/checks/resource/azure/test_NSGRuleSSHAccessRestricted.py
+++ b/tests/terraform/checks/resource/azure/test_NSGRuleSSHAccessRestricted.py
@@ -48,6 +48,37 @@ class TestNSGRuleSSHAccessRestricted(unittest.TestCase):
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.PASSED, scan_result)
 
+    def test_unknown(self):
+        hcl_res = hcl2.loads("""
+resource "azurerm_network_security_group" "mynsg" {
+    name = var.nsg_name
+    resource_group_name = azurerm_resource_group.rg.name
+    location = var.location
+
+    security_rule = [for rule in var.security_rules : {
+        name = rule.name
+        priority = rule.priority
+        source_address_prefix = lookup(rule, "source_address_prefixes", []) == [] ? lookup(rule, "source_address_prefix", var.nsg_default_source_address_prefix) : ""
+        source_address_prefixes = lookup(rule, "source_address_prefixes", [])
+        access = lookup(rule, "access", var.nsg_default_access)
+        destination_port_range = lookup(rule, "destination_port_ranges", []) == [] ? lookup(rule, "destination_port_range", var.nsg_default_destination_port_range) : ""
+        destination_port_ranges = lookup(rule, "destination_port_ranges", [])
+        direction = lookup(rule, "direction", var.nsg_default_direction)
+        protocol = lookup(rule, "protocol", var.nsg_default_protocol)
+        source_port_range = lookup(rule, "source_port_range", var.nsg_default_source_port_range)
+        description = ""
+        destination_address_prefix = "*"
+        destination_address_prefixes = []
+        destination_application_security_group_ids = []
+        source_application_security_group_ids = []
+        source_port_ranges = []
+    }]
+}
+        """)
+
+        resource_conf = hcl_res['resource'][0]['azurerm_network_security_group']['mynsg']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.UNKNOWN, scan_result)
 
 
 if __name__ == '__main__':
diff --git a/tests/terraform/checks/resource/gcp/test_GKEBasicAuth.py b/tests/terraform/checks/resource/gcp/test_GKEBasicAuth.py
index 1469e3d5b..5278ee8b4 100644
--- a/tests/terraform/checks/resource/gcp/test_GKEBasicAuth.py
+++ b/tests/terraform/checks/resource/gcp/test_GKEBasicAuth.py
@@ -1,80 +1,23 @@
 import unittest
 
-from checkov.common.models.enums import CheckResult
 from checkov.terraform.checks.resource.gcp.GKEBasicAuth import check
+from checkov.common.models.enums import CheckResult
 
 
 class TestGKEBasicAuth(unittest.TestCase):
 
     def test_failure(self):
-        resource_conf = {
-            'name': ['google_cluster_bad'],
-            'monitoring_service': ['none'],
-            'enable_legacy_abac': [True],
-            'master_authorized_networks_config': [
-                {
-                    'cidr_blocks': [
-                        {
-                            'cidr_block': ['0.0.0.0/0'],
-                            'display_name': ['The world'],
-                        }
-                    ]
-                }
-            ],
-            'master_auth': [
-                {
-                    'username': ['test'],
-                    'password': ['password'],
-                }
-            ],
-        }
+        resource_conf = {'name': ['google_cluster_bad'], 'monitoring_service': ['none'], 'enable_legacy_abac': [True], 'master_authorized_networks_config': [{'cidr_blocks': [{'cidr_block': ['0.0.0.0/0'], 'display_name': ['The world']}]}], 'master_auth': [{'username': ['test'], 'password': ['password']}]}
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
     def test_failure2(self):
-        resource_conf = {
-            'name': ['google_cluster'],
-            'monitoring_service': ['monitoring.googleapis.com'],
-            'master_authorized_networks_config': [{}],
-        }
+        resource_conf = {'name': ['google_cluster'], 'monitoring_service': ['monitoring.googleapis.com'], 'master_authorized_networks_config': [{}]}
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
     def test_success(self):
-        resource_conf = {
-            'name': ['google_cluster'],
-            'monitoring_service': ['monitoring.googleapis.com'],
-            'master_authorized_networks_config': [{}],
-            'master_auth': [
-                {
-                    'client_certificate_config': [
-                        {
-                            'issue_client_certificate': [False],
-                        }
-                    ],
-                }
-            ],
-        }
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.PASSED, scan_result)
-
-    def test_success_no_basic_out_if_username_and_password_are_present_but_empty(self):
-        resource_conf = {
-            'name': ['google_cluster'],
-            'monitoring_service': ['monitoring.googleapis.com'],
-            'master_authorized_networks_config': [{}],
-            'master_auth': [
-                {
-                    'username': [''],
-                    'password': [''],
-                    'client_certificate_config': [
-                        {
-                            'issue_client_certificate': [False],
-                        }
-                    ],
-                }
-            ]
-        }
+        resource_conf = {'name': ['google_cluster'], 'monitoring_service': ['monitoring.googleapis.com'], 'master_authorized_networks_config': [{}], 'master_auth': [{'client_certificate_config': [{'issue_client_certificate': [False]}]}]}
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.PASSED, scan_result)