Repository: bridgecrewio/checkov

Issue:
TypeError: not all arguments converted during string formatting then creates FP for  CKV_AWS_111
**Describe the bug**

Getting  TypeError: not all arguments converted during string formatting on scanning the following terraform code with d

```
$  cat main.tf 
provider "aws" {
  region = "eu-west-2"
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "2.70.0"

  name = "my-vpc"
  cidr = "10.0.0.0/16"

  azs             = ["eu-west-2a", "eu-west-2b", "eu-west-2c"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]

  enable_s3_endpoint              = false
  enable_dns_hostnames            = true
  enable_dns_support              = true
  create_database_subnet_group    = true
  create_elasticache_subnet_group = false
  enable_nat_gateway              = false
  enable_vpn_gateway              = false

  tags = {
    Terraform   = "true"
    Environment = "dev"
  }
}

```

```

checkov -d . --download-external-modules true



021-04-11 21:22:10,148 [MainThread  ] [DEBUG]  File /.external_modules/terraform-aws-modules/vpc/aws/vpc-flow-logs.tf, data  "aws_iam_policy_document.vpc_flow_log_cloudwatch" check "Ensure IAM policies does not allow data exfiltration" Result: {'result': <CheckResult.PASSED: 'PASSED'>, 'evaluated_keys': []} 
DEBUG:checkov.common.checks.base_check_registry:Running check: Ensure IAM policies does not allow write access without constraints on file /.external_modules/terraform-aws-modules/vpc/aws/vpc-flow-logs.tf
2021-04-11 21:22:10,148 [MainThread  ] [DEBUG]  Running check: Ensure IAM policies does not allow write access without constraints on file /.external_modules/terraform-aws-modules/vpc/aws/vpc-flow-logs.tf
--- Logging error ---
Traceback (most recent call last):
  File "/usr/local/Cellar/python@3.9/3.9.2_4/Frameworks/Python.framework/Versions/3.9/lib/python3.9/logging/__init__.py", line 1079, in emit
    msg = self.format(record)
  File "/usr/local/Cellar/python@3.9/3.9.2_4/Frameworks/Python.framework/Versions/3.9/lib/python3.9/logging/__init__.py", line 923, in format
    return fmt.format(record)
  File "/usr/local/Cellar/python@3.9/3.9.2_4/Frameworks/Python.framework/Versions/3.9/lib/python3.9/logging/__init__.py", line 659, in format
    record.message = record.getMessage()
  File "/usr/local/Cellar/python@3.9/3.9.2_4/Frameworks/Python.framework/Versions/3.9/lib/python3.9/logging/__init__.py", line 363, in getMessage
    msg = msg % self.args
TypeError: not all arguments converted during string formatting
Call stack:
  File "/usr/local/bin/checkov", line 5, in <module>
    run()
  File "/usr/local/lib/python3.9/site-packages/checkov/main.py", line 96, in run
    scan_reports = runner_registry.run(root_folder=root_folder, external_checks_dir=external_checks_dir,
  File "/usr/local/lib/python3.9/site-packages/checkov/common/runners/runner_registry.py", line 34, in run
    scan_report = runner.run(root_folder, external_checks_dir=external_checks_dir, files=files,
  File "/usr/local/lib/python3.9/site-packages/checkov/terraform/runner.py", line 106, in run
    self.check_tf_definition(report, root_folder, runner_filter, collect_skip_comments)
  File "/usr/local/lib/python3.9/site-packages/checkov/terraform/runner.py", line 185, in check_tf_definition
    self.run_all_blocks(definition, self.definitions_context, full_file_path, root_folder, report,
  File "/usr/local/lib/python3.9/site-packages/checkov/terraform/runner.py", line 195, in run_all_blocks
    self.run_block(definition[block_type], definitions_context,
  File "/usr/local/lib/python3.9/site-packages/checkov/terraform/runner.py", line 264, in run_block
    results = registry.scan(scanned_file, entity, skipped_checks, runner_filter)
  File "/usr/local/lib/python3.9/site-packages/checkov/common/checks/base_check_registry.py", line 110, in scan
    result = self.run_check(check, entity_configuration, entity_name, entity_type, scanned_file, skip_info)
  File "/usr/local/lib/python3.9/site-packages/checkov/common/checks/base_check_registry.py", line 116, in run_check
    result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,
  File "/usr/local/lib/python3.9/site-packages/checkov/common/checks/base_check.py", line 42, in run
    check_result['result'] = self.scan_entity_conf(entity_configuration, entity_type)
  File "/usr/local/lib/python3.9/site-packages/checkov/terraform/checks/data/base_check.py", line 16, in scan_entity_conf
    return self.scan_data_conf(conf, entity_type)
  File "/usr/local/lib/python3.9/site-packages/checkov/terraform/checks/data/base_check.py", line 28, in wrapper
    return wrapped(self, conf)
  File "/usr/local/lib/python3.9/site-packages/checkov/terraform/checks/data/BaseCloudsplainingIAMCheck.py", line 29, in scan_data_conf
    logging.debug("detailed cloudsplainging finding: {}", json.dumps(violations))
Message: 'detailed cloudsplainging finding: {}'
Arguments: ('["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]',)
--- Logging error ---
Traceback (most recent call last):
  File "/usr/local/Cellar/python@3.9/3.9.2_4/Frameworks/Python.framework/Versions/3.9/lib/python3.9/logging/__init__.py", line 1079, in emit
    msg = self.format(record)
  File "/usr/local/Cellar/python@3.9/3.9.2_4/Frameworks/Python.framework/Versions/3.9/lib/python3.9/logging/__init__.py", line 923, in format
    return fmt.format(record)
  File "/usr/local/Cellar/python@3.9/3.9.2_4/Frameworks/Python.framework/Versions/3.9/lib/python3.9/logging/__init__.py", line 659, in format
    record.message = record.getMessage()
  File "/usr/local/Cellar/python@3.9/3.9.2_4/Frameworks/Python.framework/Versions/3.9/lib/python3.9/logging/__init__.py", line 363, in getMessage
    msg = msg % self.args
TypeError: not all arguments converted during string formatting

```
And this error trigger the following false report.

```
Check: CKV_AWS_111: "Ensure IAM policies does not allow write access without constraints"
	FAILED for resource: module.vpc.aws_iam_policy_document.vpc_flow_log_cloudwatch
	File: /.external_modules/terraform-aws-modules/vpc/aws/vpc-flow-logs.tf:84-102
	Calling File: /main.tf:5-28

		84  | data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" {
		85  |   count = local.create_flow_log_cloudwatch_iam_role ? 1 : 0
		86  | 
		87  |   statement {
		88  |     sid = "AWSVPCFlowLogsPushToCloudWatch"
		89  | 
		90  |     effect = "Allow"
		91  | 
		92  |     actions = [
		93  |       "logs:CreateLogGroup",
		94  |       "logs:CreateLogStream",
		95  |       "logs:PutLogEvents",
		96  |       "logs:DescribeLogGroups",
		97  |       "logs:DescribeLogStreams",
		98  |     ]
		99  | 
		100 |     resources = ["*"]
		101 |   }
		102 | }
```
Actually  `enable_flow_log` variable is default `false` by default. so `85  |   count = local.create_flow_log_cloudwatch_iam_role ? 1 : 0`  value must be 0 in  data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" resource. But it seems due to previous errors, checkov can't get the value of count and consider that resource will be created which is not a case then trigger a failure on this check
 




**To Reproduce**
Steps to reproduce the behavior:
1.  create the  above main.tf 
2. Run 

```
export LOG_LEVEL=DEBUG
checkov -d . --download-external-modules true
```
3. See error


**Desktop (please complete the following information):**
 - OS:  MacOS
 - Checkov Version  2.0.34




Discussion:

Patch:
diff --git a/checkov/terraform/checks/data/base_check.py b/checkov/terraform/checks/data/base_check.py
index 7a33967ed..45f1281c0 100644
--- a/checkov/terraform/checks/data/base_check.py
+++ b/checkov/terraform/checks/data/base_check.py
@@ -1,29 +1,33 @@
 from abc import abstractmethod
+from typing import Dict, List, Callable, Optional
 
 from checkov.common.checks.base_check import BaseCheck
+from checkov.common.models.enums import CheckResult, CheckCategories
 from checkov.common.multi_signature import multi_signature
 from checkov.terraform.checks.data.registry import data_registry
 
 
 class BaseDataCheck(BaseCheck):
-    def __init__(self, name, id, categories, supported_data):
-        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_data,
-                         block_type="data")
+    def __init__(self, name: str, id: str, categories: List[CheckCategories], supported_data: List[str]) -> None:
+        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_data, block_type="data")
         self.supported_data = supported_data
         data_registry.register(self)
 
-    def scan_entity_conf(self, conf, entity_type):
+    def scan_entity_conf(self, conf: Dict[str, List], entity_type: str) -> CheckResult:
+        if conf.get("count") == [0]:
+            return CheckResult.UNKNOWN
+
         return self.scan_data_conf(conf, entity_type)
 
     @multi_signature()
     @abstractmethod
-    def scan_data_conf(self, conf, entity_type):
+    def scan_data_conf(self, conf: Dict[str, List], entity_type: str) -> CheckResult:
         raise NotImplementedError()
 
     @classmethod
     @scan_data_conf.add_signature(args=["self", "conf"])
-    def _scan_data_conf_self_conf(cls, wrapped):
-        def wrapper(self, conf, entity_type=None):
+    def _scan_data_conf_self_conf(cls, wrapped: Callable) -> Callable:
+        def wrapper(self: "BaseDataCheck", conf: Dict[str, List], entity_type: Optional[str] = None) -> CheckResult:
             # keep default argument for entity_type so old code, that doesn't set it, will work.
             return wrapped(self, conf)
 


Test patch:
diff --git a/tests/graph/terraform/runner/test_graph_builder.py b/tests/graph/terraform/runner/test_graph_builder.py
index 4eff05939..d94bce7b1 100644
--- a/tests/graph/terraform/runner/test_graph_builder.py
+++ b/tests/graph/terraform/runner/test_graph_builder.py
@@ -52,7 +52,7 @@ class TestGraphBuilder(TestCase):
         runner = Runner()
         report = runner.run(root_folder=resources_path)
         self.assertLessEqual(3, len(report.failed_checks))
-        self.assertLessEqual(34, len(report.passed_checks))
+        self.assertLessEqual(13, len(report.passed_checks))
         self.assertEqual(0, len(report.skipped_checks))
 
         found_versioning_failure = False
diff --git a/tests/terraform/checks/data/test_base_data_check.py b/tests/terraform/checks/data/test_base_data_check.py
new file mode 100644
index 000000000..3a9231267
--- /dev/null
+++ b/tests/terraform/checks/data/test_base_data_check.py
@@ -0,0 +1,43 @@
+import pytest
+
+from checkov.common.models.enums import CheckCategories, CheckResult
+from checkov.terraform.checks.data.base_check import BaseDataCheck
+
+
+class TestStaticCheck(BaseDataCheck):
+    # for pytest not to collect this class as tests
+    __test__ = False
+
+    def __init__(self):
+        name = "Test something"
+        id = "CKV_TEST_2"
+        supported_data = ["ckv_test"]
+        categories = [CheckCategories.CONVENTION]
+        super().__init__(name=name, id=id, categories=categories, supported_data=supported_data)
+
+    def scan_data_conf(self, conf):
+        if "check_result" in conf.keys():
+            check_result = conf["check_result"][0]
+            if check_result:
+                return CheckResult.PASSED
+
+            return CheckResult.FAILED
+
+        return CheckResult.UNKNOWN
+
+
+@pytest.mark.parametrize(
+    "conf,expected",
+    [
+        ({"check_result": [True]}, CheckResult.PASSED),
+        ({"check_result": [False]}, CheckResult.FAILED),
+        ({"foo": ["bar"]}, CheckResult.UNKNOWN),
+        ({"count": [0], "check_result": [True]}, CheckResult.UNKNOWN),
+        ({"count": [1], "check_result": [True]}, CheckResult.PASSED),
+    ],
+    ids=["pass", "fail", "unknown", "count_zero", "count_one"],
+)
+def test_scan_entity_conf(conf, expected):
+    result = TestStaticCheck().scan_entity_conf(conf, "ckv_test")
+
+    assert result == expected