Repository: bridgecrewio/checkov

Issue:
Scanning IAM Role Public Access
Describe the bug
It seems when specifying more than one  json, the policy does not scan all principals, rather it looks at the first one. 

To Reproduce
Steps to reproduce the behavior:

Create policy with more than one SID
`resource "aws_iam_role" "lambdaRole" {
  name               = "test-role"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
      {
        "Action": "sts:AssumeRole",
        "Principal" : {"Service": "lambda.amazonaws.com"},
        "Effect": "Allow"
      },
      {
        "Action": "sts:AssumeRole",
        "Principal" : {"AWS": "*"},
        "Effect": "Allow"
      },
      {
        "Action": "sts:AssumeRole",
        "Principal" : {"Service": "events.amazonaws.com"},
        "Effect": "Allow"
      },
  ]
}

EOF
}`
Run Checkov against policy
Expected behavior
I would expect the scan to check each json within the policy rather than the first one

Desktop (please complete the following information):

OS: Mac
Checkov Version: 1.0.459


Discussion:

Patch:
diff --git a/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py b/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py
index 6d98eac4d..efc004b07 100644
--- a/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py
+++ b/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py
@@ -17,10 +17,10 @@ class IAMRoleAllowsPublicAssume(BaseResourceCheck):
             try:
                 assume_role_block = json.loads(conf['assume_role_policy'][0])
                 if 'Statement' in assume_role_block.keys():
-                    if 'Principal' in assume_role_block['Statement'][0]:
-                        if 'AWS' in assume_role_block['Statement'][0]['Principal']:
-                            if assume_role_block['Statement'][0]['Principal']['AWS'] == '*':
-                                    return CheckResult.FAILED
+                    for statement in assume_role_block['Statement']:
+                        if 'AWS' in statement['Principal']:
+                            if statement['Principal']['AWS'] == '*':
+                                return CheckResult.FAILED
             except: # nosec
                 pass
         return CheckResult.PASSED


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_IAMRoleAllowsPublicAssume.py b/tests/terraform/checks/resource/aws/test_IAMRoleAllowsPublicAssume.py
new file mode 100644
index 000000000..3d5316fd7
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_IAMRoleAllowsPublicAssume.py
@@ -0,0 +1,68 @@
+import unittest
+import hcl2
+
+from checkov.terraform.checks.resource.aws.IAMRoleAllowsPublicAssume import check
+from checkov.common.models.enums import CheckResult
+
+
+class TestIAMRoleAllowAssumeFromAccount(unittest.TestCase):
+
+    def test_failure(self):
+        hcl_res = hcl2.loads("""
+resource "aws_iam_role" "lambdaRole" {
+    name = "test-role"
+    assume_role_policy = <<EOF
+{
+"Version": "2012-10-17",
+"Statement": [
+{
+"Action": "sts:AssumeRole",
+"Principal" : {"Service": "lambda.amazonaws.com"},
+"Effect": "Allow"
+},
+{
+"Action": "sts:AssumeRole",
+"Principal" : {"AWS": "*"},
+"Effect": "Allow"
+},
+{
+"Action": "sts:AssumeRole",
+"Principal" : {"Service": "events.amazonaws.com"},
+"Effect": "Allow"
+}
+]
+}
+
+EOF
+}        
+        """)
+        resource_conf = hcl_res['resource'][0]['aws_iam_role']['lambdaRole']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        hcl_res = hcl2.loads("""
+resource "aws_iam_role" "lambdaRole" {
+    name = "test-role"
+    assume_role_policy = <<EOF
+{
+"Version": "2012-10-17",
+"Statement": [
+{
+"Action": "sts:AssumeRole",
+"Principal" : {"Service": "lambda.amazonaws.com"},
+"Effect": "Allow"
+}
+]
+}
+
+EOF
+}        
+        """)
+        resource_conf = hcl_res['resource'][0]['aws_iam_role']['lambdaRole']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()