Repository: bridgecrewio/checkov

Issue:
Scanning IAM policy only takes First SID in json rather than looping through
**Describe the bug**
It seems when specifying more than one SID in a json, the policies do not loop through each one rather it just looks at the first one and ends. 

**To Reproduce**
Steps to reproduce the behavior:
1. Create policy with more than one SID
`{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "SqsAllow",
      "Effect": "Allow",
      "Action": [
        "sqs:GetQueueAttributes",
        "sqs:GetQueueUrl",
        "sqs:ListDeadLetterSourceQueues",
        "sqs:ListQueues",
        "sqs:ReceiveMessage",
        "sqs:SendMessage",
        "sqs:SendMessageBatch"
      ],
      "Resource": "*"
          },
    {
      "Sid": "ALL",
      "Effect": "Allow",
      "Action": [ "*"
      ],
      "Resource": ["*"]
    },`
2. Run Checkov against policy


**Expected behavior**
I would expect the scan to check each json within the policy rather than the first one



**Desktop (please complete the following information):**
 - OS: Mac
 - Checkov Version: 1.0.442




Discussion:

Patch:
diff --git a/HomebrewFormula/checkov.rb b/HomebrewFormula/checkov.rb
index 72582b9d4..6e42909e4 100644
--- a/HomebrewFormula/checkov.rb
+++ b/HomebrewFormula/checkov.rb
@@ -3,8 +3,8 @@ class Checkov < Formula
 
   desc "Shiny new formula"
   homepage "https://github.com/bridgecrewio/checkov"
-  url "https://files.pythonhosted.org/packages/41/68/47ab4baf980eb55cdfd184039b7af8456348ffa7173b5f7f532b14afa547/checkov-1.0.456.tar.gz"
-  sha256 "4b504c7bbf3cfbfec7f71cb875a5cea36af94ca190d5174aa4a9b6293f1aad59"
+  url "https://files.pythonhosted.org/packages/67/3b/e616e79e503d4d63c691467bf7be6a402beccfeafb1e047dd717e40f28e6/checkov-1.0.454.tar.gz"
+  sha256 "cea41b4f64ec5b58d69d3de1a291aaf6152a3e97cec6507417be335bbd7413ab"
 
   depends_on "python3"
 
diff --git a/checkov/kubernetes/base_registry.py b/checkov/kubernetes/base_registry.py
index 75e862b58..7e25187a5 100644
--- a/checkov/kubernetes/base_registry.py
+++ b/checkov/kubernetes/base_registry.py
@@ -23,55 +23,14 @@ class Registry(BaseCheckRegistry):
                 if check.id in [x['id'] for x in skipped_checks]:
                     skip_info = [x for x in skipped_checks if x['id'] == check.id][0]
             if check_id_allowlist:
-                # Allow list provides namespace-only allows, check-only allows, or both
-                # If namespaces not specified, all namespaces are scanned
-                # If checks not specified, all checks are scanned
-                run_check = False
-                allowed_namespaces = [string for string in check_id_allowlist if "CKV_" not in string]
-                if not any("CKV_" in check for check in check_id_allowlist):
-                    if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]:
-                        if entity_configuration["metadata"]["namespace"] in allowed_namespaces:
-                            run_check = True
-                    elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]:
-                        if entity_configuration["parent_metadata"]["namespace"] in allowed_namespaces:
-                            run_check = True
-                    else:
-                        if "default" in allowed_namespaces:
-                            run_check = True
-                else:
-                    if check.id in check_id_allowlist:
-                        if allowed_namespaces:
-                            # Check if namespace in allowed namespaces
-                            if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]:
-                                if entity_configuration["metadata"]["namespace"] in allowed_namespaces:
-                                    run_check = True
-                            elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]:
-                                if entity_configuration["parent_metadata"]["namespace"] in allowed_namespaces:
-                                    run_check = True
-                            else:
-                                if "default" in allowed_namespaces:
-                                    run_check = True
-                        else:
-                            # No namespaces to filter
-                            run_check = True
-                if run_check:
+                if check.id in check_id_allowlist:
                     self.logger.debug("Running check: {} on file {}".format(check.name, scanned_file))
 
                     result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,
                                        entity_name=entity_type, entity_type=entity_type, skip_info=skip_info)
                     results[check] = result
             elif check_id_denylist:
-                namespace_skip = False
-                if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]:
-                    if entity_configuration["metadata"]["namespace"] in check_id_denylist:
-                        namespace_skip = True
-                elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]:
-                    if entity_configuration["parent_metadata"]["namespace"] in check_id_denylist:
-                        namespace_skip = True
-                else:
-                    if "default" in check_id_denylist:
-                        namespace_skip = True
-                if check.id not in check_id_denylist and namespace_skip == False:
+                if check.id not in check_id_denylist:
                     result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,
                                        entity_name=entity_type, entity_type=entity_type, skip_info=skip_info)
                     results[check] = result
diff --git a/checkov/kubernetes/runner.py b/checkov/kubernetes/runner.py
index 69aba5a6e..736da9545 100644
--- a/checkov/kubernetes/runner.py
+++ b/checkov/kubernetes/runner.py
@@ -81,12 +81,6 @@ class Runner(BaseRunner):
                     else:
                         continue
 
-                    # Skip entity with parent (metadata["ownerReferences"]) in runtime
-                    # We will alert in runtime only
-                    if "ownerReferences" in entity_conf["metadata"] and \
-                            entity_conf["metadata"]["ownerReferences"] is not None:
-                        continue
-
                     # Append containers and initContainers to definitions list
                     for type in ["containers", "initContainers"]:
                         containers = []
@@ -133,13 +127,6 @@ class Runner(BaseRunner):
                         else:
                             continue
 
-                    # Skip entity with parent (metadata["ownerReferences"]) in runtime
-                    # We will alert in runtime only
-                    if "metadata" in entity_conf:
-                        if "ownerReferences" in entity_conf["metadata"] and \
-                                entity_conf["metadata"]["ownerReferences"] is not None:
-                            continue
-
                     # Skip Kustomization Templates (for now)
                     if entity_conf["kind"] == "Kustomization":
                         continue
@@ -213,7 +200,7 @@ def get_skipped_checks(entity_conf):
     else:
         if "metadata" in entity_conf.keys():
             metadata = entity_conf["metadata"]
-    if "annotations" in metadata.keys() and metadata["annotations"] is not None:
+    if "annotations" in metadata.keys():
         for key in metadata["annotations"].keys():
             skipped_item = {}
             if "checkov.io/skip" in key or "bridgecrew.io/skip" in key:
diff --git a/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py b/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
index 113b818f9..b964758f3 100644
--- a/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
+++ b/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
@@ -19,7 +19,7 @@ class StarActionPolicyDocument(BaseDataCheck):
         """
         key = 'statement'
         if key in conf.keys():
-            for statement in conf['statement']:
+            for statement in conf[key]:
                 if 'actions' in statement and '*' in statement['actions'][0] and statement.get('effect', ['Allow'])[0] == 'Allow':
                     return CheckResult.FAILED
         return CheckResult.PASSED
diff --git a/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py b/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py
index 75ded03ff..2f0b07734 100644
--- a/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py
+++ b/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py
@@ -17,13 +17,13 @@ class IAMAdminPolicyDocument(BaseResourceCheck):
             try:
                 policy_block = json.loads(conf['policy'][0])
                 if 'Statement' in policy_block.keys():
-                        if 'Action' in policy_block['Statement'][0] and \
-                                policy_block['Statement'][0].get('Effect', ['Allow']) == 'Allow' and \
-                                policy_block['Statement'][0]['Action'][0] == "*" and \
-                                'Resource' in policy_block['Statement'][0] and \
-                                policy_block['Statement'][0]['Resource'] == '*':
+                    for statement in policy_block['Statement']:
+                        if 'Action' in statement and \
+                                statement.get('Effect', ['Allow']) == 'Allow' and \
+                                '*' in statement.get('Action', ['']) and \
+                                '*' in statement.get('Resource', ['']):
                             return CheckResult.FAILED
-            except: # nosec
+            except:  # nosec
                 pass
         return CheckResult.PASSED
 
diff --git a/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py b/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py
index 7707d6729..7c88da617 100644
--- a/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py
+++ b/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py
@@ -17,9 +17,10 @@ class IAMStarActionPolicyDocument(BaseResourceCheck):
             try:
                 policy_block = json.loads(conf['policy'][0])
                 if 'Statement' in policy_block.keys():
-                        if 'Action' in policy_block['Statement'][0] and \
-                                policy_block['Statement'][0].get('Effect', ['Allow']) == 'Allow' and \
-                                policy_block['Statement'][0]['Action'][0] == "*":
+                    for statement in policy_block['Statement']:
+                        if 'Action' in statement and \
+                                statement.get('Effect', ['Allow']) == 'Allow' and \
+                                '*' in statement.get('Action', ['']):
                             return CheckResult.FAILED
             except: # nosec
                 pass
diff --git a/checkov/version.py b/checkov/version.py
index ed831beff..03577afd2 100644
--- a/checkov/version.py
+++ b/checkov/version.py
@@ -1,1 +1,1 @@
-version = '1.0.456'
+version = '1.0.454'
diff --git a/docs/3.Scans/resource-scans.md b/docs/3.Scans/resource-scans.md
index 91dfcf819..3c371d332 100644
--- a/docs/3.Scans/resource-scans.md
+++ b/docs/3.Scans/resource-scans.md
@@ -75,8 +75,8 @@ nav_order: 1
 |  64 | CKV_AWS_37   | resource          | aws_eks_cluster                                                              | Ensure Amazon EKS control plane logging enabled for all log types                                                                                                                                        | Terraform      |
 |  65 | CKV_AWS_38   | resource          | aws_eks_cluster                                                              | Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0                                                                                                                                            | Terraform      |
 |  66 | CKV_AWS_39   | resource          | aws_eks_cluster                                                              | Ensure Amazon EKS public endpoint disabled                                                                                                                                                               | Terraform      |
-|  67 | CKV_AWS_40   | resource          | aws_iam_user_policy_attachment                                               | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform      |
-|  68 | CKV_AWS_40   | resource          | aws_iam_user_policy                                                          | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform      |
+|  67 | CKV_AWS_40   | resource          | aws_iam_user_policy                                                          | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform      |
+|  68 | CKV_AWS_40   | resource          | aws_iam_user_policy_attachment                                               | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform      |
 |  69 | CKV_AWS_40   | resource          | aws_iam_policy_attachment                                                    | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform      |
 |  70 | CKV_AWS_40   | resource          | AWS::IAM::Policy                                                             | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Cloudformation |
 |  71 | CKV_AWS_41   | provider          | aws                                                                          | Ensure no hard coded AWS access key and and secret key exists in provider                                                                                                                                | Terraform      |
@@ -116,12 +116,12 @@ nav_order: 1
 | 105 | CKV_AWS_6    | resource          | AWS::Elasticsearch::Domain                                                   | Ensure all Elasticsearch has node-to-node encryption enabled                                                                                                                                             | Cloudformation |
 | 106 | CKV_AWS_60   | resource          | aws_iam_role                                                                 | Ensure IAM role allows only specific services or principals to assume it                                                                                                                                 | Terraform      |
 | 107 | CKV_AWS_61   | resource          | aws_iam_role                                                                 | Ensure IAM role allows only specific principals in account to assume it                                                                                                                                  | Terraform      |
-| 108 | CKV_AWS_62   | resource          | aws_iam_user_policy                                                          | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
-| 109 | CKV_AWS_62   | resource          | aws_iam_role_policy                                                          | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
+| 108 | CKV_AWS_62   | resource          | aws_iam_role_policy                                                          | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
+| 109 | CKV_AWS_62   | resource          | aws_iam_user_policy                                                          | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
 | 110 | CKV_AWS_62   | resource          | aws_iam_group_policy                                                         | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
 | 111 | CKV_AWS_62   | resource          | aws_iam_policy                                                               | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
-| 112 | CKV_AWS_63   | resource          | aws_iam_user_policy                                                          | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
-| 113 | CKV_AWS_63   | resource          | aws_iam_role_policy                                                          | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
+| 112 | CKV_AWS_63   | resource          | aws_iam_role_policy                                                          | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
+| 113 | CKV_AWS_63   | resource          | aws_iam_user_policy                                                          | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
 | 114 | CKV_AWS_63   | resource          | aws_iam_group_policy                                                         | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
 | 115 | CKV_AWS_63   | resource          | aws_iam_policy                                                               | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
 | 116 | CKV_AWS_64   | resource          | aws_redshift_cluster                                                         | Ensure all data stored in the Redshift cluster is securely encrypted at rest                                                                                                                             | Terraform      |
@@ -280,8 +280,8 @@ nav_order: 1
 | 269 | CKV_GCP_39   | resource          | google_compute_instance                                                      | Ensure Compute instances are launched with Shielded VM enabled                                                                                                                                           | Terraform      |
 | 270 | CKV_GCP_4    | resource          | google_compute_ssl_policy                                                    | Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites                                                                                                                  | Terraform      |
 | 271 | CKV_GCP_40   | resource          | google_compute_instance                                                      | Ensure that Compute instances do not have public IP addresses                                                                                                                                            | Terraform      |
-| 272 | CKV_GCP_41   | resource          | google_project_iam_member                                                    | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level                                                                                  | Terraform      |
-| 273 | CKV_GCP_41   | resource          | google_project_iam_binding                                                   | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level                                                                                  | Terraform      |
+| 272 | CKV_GCP_41   | resource          | google_project_iam_binding                                                   | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level                                                                                  | Terraform      |
+| 273 | CKV_GCP_41   | resource          | google_project_iam_member                                                    | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level                                                                                  | Terraform      |
 | 274 | CKV_GCP_42   | resource          | google_project_iam_member                                                    | Ensure that Service Account has no Admin privileges                                                                                                                                                      | Terraform      |
 | 275 | CKV_GCP_43   | resource          | google_kms_crypto_key                                                        | Ensure KMS encryption keys are rotated within a period of 90 days                                                                                                                                        | Terraform      |
 | 276 | CKV_GCP_5    | resource          | google_storage_bucket                                                        | Ensure Google storage bucket have encryption enabled                                                                                                                                                     | Terraform      |
@@ -332,7 +332,7 @@ nav_order: 1
 | 321 | CKV_K8S_2    | PodSecurityPolicy | PodSecurityPolicy                                                            | Do not admit privileged containers                                                                                                                                                                       | Kubernetes     |
 | 322 | CKV_K8S_20   | PodSecurityPolicy | containers                                                                   | Containers should not run with allowPrivilegeEscalation                                                                                                                                                  | Kubernetes     |
 | 323 | CKV_K8S_20   | PodSecurityPolicy | initContainers                                                               | Containers should not run with allowPrivilegeEscalation                                                                                                                                                  | Kubernetes     |
-| 324 | CKV_K8S_21   | PodSecurityPolicy | RoleBinding                                                                  | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 324 | CKV_K8S_21   | PodSecurityPolicy | ServiceAccount                                                               | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 325 | CKV_K8S_21   | PodSecurityPolicy | Pod                                                                          | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 326 | CKV_K8S_21   | PodSecurityPolicy | Deployment                                                                   | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 327 | CKV_K8S_21   | PodSecurityPolicy | DaemonSet                                                                    | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
@@ -343,8 +343,8 @@ nav_order: 1
 | 332 | CKV_K8S_21   | PodSecurityPolicy | CronJob                                                                      | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 333 | CKV_K8S_21   | PodSecurityPolicy | Service                                                                      | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 334 | CKV_K8S_21   | PodSecurityPolicy | Secret                                                                       | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 335 | CKV_K8S_21   | PodSecurityPolicy | ServiceAccount                                                               | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 336 | CKV_K8S_21   | PodSecurityPolicy | Role                                                                         | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 335 | CKV_K8S_21   | PodSecurityPolicy | Role                                                                         | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 336 | CKV_K8S_21   | PodSecurityPolicy | RoleBinding                                                                  | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 337 | CKV_K8S_21   | PodSecurityPolicy | ConfigMap                                                                    | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 338 | CKV_K8S_21   | PodSecurityPolicy | Ingress                                                                      | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 339 | CKV_K8S_22   | PodSecurityPolicy | containers                                                                   | Use read-only filesystem for containers where possible                                                                                                                                                   | Kubernetes     |
diff --git a/kubernetes/requirements.txt b/kubernetes/requirements.txt
index 3051ae690..17d8961c2 100644
--- a/kubernetes/requirements.txt
+++ b/kubernetes/requirements.txt
@@ -1,1 +1,1 @@
-checkov==1.0.456
+checkov==1.0.454


Test patch:
diff --git a/tests/kubernetes/checks/test_AllowPrivilegeEscalationPSP.py b/tests/kubernetes/checks/test_AllowPrivilegeEscalationPSP.py
index 2f497253b..df76aef83 100644
--- a/tests/kubernetes/checks/test_AllowPrivilegeEscalationPSP.py
+++ b/tests/kubernetes/checks/test_AllowPrivilegeEscalationPSP.py
@@ -28,7 +28,7 @@ class TestAllowPrivilegeEscalationPSP(unittest.TestCase):
         test_files_dir = current_dir + "/example_PSP"
         report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(skip_checks=[check.id]))
         for record in report.failed_checks:
-            self.assertNotEqual(record.check_id,check.id,"check should be skipped")
+            self.assertNotEquals(record.check_id,check.id,"check should be skipped")
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/tests/kubernetes/checks/test_LivenessProbe.py b/tests/kubernetes/checks/test_LivenessProbe.py
index 8d71343be..71015ff42 100644
--- a/tests/kubernetes/checks/test_LivenessProbe.py
+++ b/tests/kubernetes/checks/test_LivenessProbe.py
@@ -17,7 +17,7 @@ class TestLivenessProbe(unittest.TestCase):
         summary = report.get_summary()
 
         self.assertEqual(summary['passed'], 1)
-        self.assertEqual(summary['failed'], 1)
+        self.assertEqual(summary['failed'], 2)
         self.assertEqual(summary['skipped'], 0)
         self.assertEqual(summary['parsing_errors'], 0)
 
diff --git a/tests/kubernetes/checks/test_ReadinessProbe.py b/tests/kubernetes/checks/test_ReadinessProbe.py
index 5344b1421..0b0098fea 100644
--- a/tests/kubernetes/checks/test_ReadinessProbe.py
+++ b/tests/kubernetes/checks/test_ReadinessProbe.py
@@ -16,7 +16,7 @@ class TestReadinessProbe(unittest.TestCase):
         report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id]))
         summary = report.get_summary()
 
-        self.assertEqual(summary['passed'], 1)
+        self.assertEqual(summary['passed'], 2)
         self.assertEqual(summary['failed'], 1)
         self.assertEqual(summary['skipped'], 0)
         self.assertEqual(summary['parsing_errors'], 0)
diff --git a/tests/terraform/checks/resource/aws/test_IAMAdminPolicyDocument.py b/tests/terraform/checks/resource/aws/test_IAMAdminPolicyDocument.py
index 26d0e1e84..f130d0259 100644
--- a/tests/terraform/checks/resource/aws/test_IAMAdminPolicyDocument.py
+++ b/tests/terraform/checks/resource/aws/test_IAMAdminPolicyDocument.py
@@ -26,6 +26,17 @@ class TestAdminPolicyDocument(unittest.TestCase):
         scan_result = check.scan_entity_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
+    def test_failure_multiple_statements(self):
+        resource_conf = {'name': ['test'], 'user': ['${aws_iam_user.lb.name}'],
+                         'policy': [
+                             '{"Version":"2012-10-17","Statement":[{"Sid":"SqsAllow","Effect":"Allow","Action":['
+                             '"sqs:GetQueueAttributes","sqs:GetQueueUrl","sqs:ListDeadLetterSourceQueues",'
+                             '"sqs:ListQueues","sqs:ReceiveMessage","sqs:SendMessage","sqs:SendMessageBatch"],'
+                             '"Resource":"*"},{"Sid":"ALL","Effect":"Allow","Action":["*"],"Resource":["*"]}]} '
+                             ]}
+        scan_result = check.scan_entity_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
 
 if __name__ == '__main__':
-    unittest.main()
+    unittest.main()
\ No newline at end of file
diff --git a/tests/terraform/checks/resource/aws/test_IAMStarActionPolicyDocument.py b/tests/terraform/checks/resource/aws/test_IAMStarActionPolicyDocument.py
index 925e03f96..a8bb11419 100644
--- a/tests/terraform/checks/resource/aws/test_IAMStarActionPolicyDocument.py
+++ b/tests/terraform/checks/resource/aws/test_IAMStarActionPolicyDocument.py
@@ -26,6 +26,16 @@ class TestAdminPolicyDocument(unittest.TestCase):
         scan_result = check.scan_entity_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
+    def test_failure_multiple_statements(self):
+        resource_conf = {'name': ['test'], 'user': ['${aws_iam_user.lb.name}'],
+                         'policy': [
+                             '{"Version":"2012-10-17","Statement":[{"Sid":"SqsAllow","Effect":"Allow","Action":['
+                             '"sqs:GetQueueAttributes","sqs:GetQueueUrl","sqs:ListDeadLetterSourceQueues",'
+                             '"sqs:ListQueues","sqs:ReceiveMessage","sqs:SendMessage","sqs:SendMessageBatch"],'
+                             '"Resource":"*"},{"Sid":"ALL","Effect":"Allow","Action":["*"],"Resource":["${var.my_resource_arn}"]}]}'
+                         ]}
+        scan_result = check.scan_entity_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
 
 if __name__ == '__main__':
     unittest.main()