Repository: bridgecrewio/checkov

Issue:
GCP: crash running CKV_GCP_2 and CKV_GCP_3 (unrestricted ingress)
**Describe the bug**

Checkov crashes while scanning a firewall rule block such as the one generated by [terraform-google-lb-http](https://github.com/terraform-google-modules/terraform-google-lb-http/blob/ca8a56700f0b03f8bf4353fde182ff72673a2a5d/main.tf#L197-L216).

 - Checkov Version 1.0.369

```console
cadams@Ganymede ~/Project/myproject (master)> docker run --rm --volume "$PWD":/tf bridgecrew/checkov -d /tf
ERROR:checkov.terraform.checks.resource.gcp.GoogleComputeFirewallUnrestrictedIngress22:Failed to run check: Ensure Google compute firewall ingress does not allow unrestricted ssh access for configuration: {'count': ['${length(var.firewall_networks)}'], 'project': ['${length(var.firewall_networks) == 1 && var.firewall_projects[0] == "default" ? var.project : var.firewall_projects[count.index]}'], 'name': ['${var.name}-hc-${count.index}'], 'network': ['${var.firewall_networks[count.index]}'], 'source_ranges': [['130.211.0.0/22', '35.191.0.0/16']], 'target_tags': ['${length(var.target_tags) > 0 ? var.target_tags : None}'], 'target_service_accounts': ['${length(var.target_service_accounts) > 0 ? var.target_service_accounts : None}'], 'dynamic': [{'allow': {'for_each': ['${var.backends}'], 'content': [{'protocol': ['tcp'], 'ports': [['${allow.value.port}']]}]}}], 'allow': ['${var.backends}']} at file: /.terraform/modules/gce-lb-http/terraform-google-lb-http-4.0.0/main.tf
Traceback (most recent call last):
  File "/usr/local/bin/checkov", line 5, in <module>
    2020-06-12 18:36:49,936 [MainThread  ] [ERROR]  Failed to run check: Ensure Google compute firewall ingress does not allow unrestricted ssh access for configuration: {'count': ['${length(var.firewall_networks)}'], 'project': ['${length(var.firewall_networks) == 1 && var.firewall_projects[0] == "default" ? var.project : var.firewall_projects[count.index]}'], 'name': ['${var.name}-hc-${count.index}'], 'network': ['${var.firewall_networks[count.index]}'], 'source_ranges': [['130.211.0.0/22', '35.191.0.0/16']], 'target_tags': ['${length(var.target_tags) > 0 ? var.target_tags : None}'], 'target_service_accounts': ['${length(var.target_service_accounts) > 0 ? var.target_service_accounts : None}'], 'dynamic': [{'allow': {'for_each': ['${var.backends}'], 'content': [{'protocol': ['tcp'], 'ports': [['${allow.value.port}']]}]}}], 'allow': ['${var.backends}']} at file: /.terraform/modules/gce-lb-http/terraform-google-lb-http-4.0.0/main.tf
run()
  File "/usr/local/lib/python3.8/site-packages/checkov/main.py", line 75, in run
    scan_reports = runner_registry.run(root_folder=root_folder, external_checks_dir=args.external_checks_dir,
  File "/usr/local/lib/python3.8/site-packages/checkov/common/runners/runner_registry.py", line 25, in run
    scan_report = runner.run(root_folder, external_checks_dir=external_checks_dir, files=files,
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 50, in run
    self.check_tf_definition(report, root_folder, runner_filter)
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 90, in check_tf_definition
    self.run_block(definition[block_type], definitions_context, full_file_path, report, scanned_file,
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 113, in run_block
    results = registry.scan(scanned_file, entity, skipped_checks, runner_filter)
  File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check_registry.py", line 64, in scan
    result = self.run_check(check, entity_configuration, entity_name, entity_type, scanned_file, skip_info)
  File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check_registry.py", line 70, in run_check
    result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,
  File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check.py", line 44, in run
    raise e
  File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check.py", line 33, in run
    check_result['result'] = self.scan_entity_conf(entity_configuration)
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/checks/resource/base_resource_check.py", line 20, in scan_entity_conf
    return self.scan_resource_conf(conf)
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress22.py", line 25, in scan_resource_conf
    if 'ports' in block.keys():
AttributeError: 'str' object has no attribute 'keys'
```


Discussion:

Patch:
diff --git a/HomebrewFormula/checkov.rb b/HomebrewFormula/checkov.rb
index 166358c47..b325eb7e1 100644
--- a/HomebrewFormula/checkov.rb
+++ b/HomebrewFormula/checkov.rb
@@ -3,8 +3,8 @@ class Checkov < Formula
 
   desc "Shiny new formula"
   homepage "https://github.com/bridgecrewio/checkov"
-  url "https://files.pythonhosted.org/packages/45/8d/54931ef75f8fbf62c924e71c9ab26832659e2fa870b8a3c9a71e80774503/checkov-1.0.370.tar.gz"
-  sha256 "b76665c45b210386a03f3c0c531d1e644930dc5d6dd4f6fb4f291ce9e2eef5fe"
+  url "https://files.pythonhosted.org/packages/41/2e/bcfc153be1ffa465ae203e6a0b625e8a2c090930053b6128aef44493ab41/checkov-1.0.369.tar.gz"
+  sha256 "164abd4211557a6d768d00c4435c6074d3c80839f515e4bca5130366af063f89"
 
   depends_on "python3"
 
diff --git a/checkov/terraform/checks/resource/gcp/AbsGoogleComputeFirewallUnrestrictedIngress.py b/checkov/terraform/checks/resource/gcp/AbsGoogleComputeFirewallUnrestrictedIngress.py
new file mode 100644
index 000000000..fe0498f39
--- /dev/null
+++ b/checkov/terraform/checks/resource/gcp/AbsGoogleComputeFirewallUnrestrictedIngress.py
@@ -0,0 +1,22 @@
+from checkov.common.models.enums import CheckResult
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+
+
+class AbsGoogleComputeFirewallUnrestrictedIngress(BaseResourceCheck):
+    def __init__(self, name, id, categories, supported_resources, port):
+        super().__init__(name, id, categories, supported_resources)
+        self.port = port
+
+    def scan_resource_conf(self, conf):
+        if 'allow' in conf:
+            allow_blocks = conf['allow']
+            for block in allow_blocks:
+                if isinstance(block, str):
+                    return CheckResult.UNKNOWN
+                if 'ports' in block.keys():
+                    if self.port in block['ports'][0]:
+                        if 'source_ranges' in conf.keys():
+                            source_ranges = conf['source_ranges'][0]
+                            if "0.0.0.0/0" in source_ranges:
+                                return CheckResult.FAILED
+        return CheckResult.PASSED
diff --git a/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress22.py b/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress22.py
index 51cda7cb9..9e2408af6 100644
--- a/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress22.py
+++ b/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress22.py
@@ -1,34 +1,16 @@
-from checkov.common.models.enums import CheckResult, CheckCategories
-from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.gcp.AbsGoogleComputeFirewallUnrestrictedIngress import AbsGoogleComputeFirewallUnrestrictedIngress
 
 PORT = '22'
 
 
-class GoogleComputeFirewallUnrestrictedIngress22(BaseResourceCheck):
+class GoogleComputeFirewallUnrestrictedIngress22(AbsGoogleComputeFirewallUnrestrictedIngress):
     def __init__(self):
         name = "Ensure Google compute firewall ingress does not allow unrestricted ssh access"
         id = "CKV_GCP_2"
         supported_resources = ['google_compute_firewall']
         categories = [CheckCategories.NETWORKING]
-        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
-
-    def scan_resource_conf(self, conf):
-        """
-            Looks for password configuration at google_compute_firewall:
-            https://www.terraform.io/docs/providers/google/r/compute_firewall.html
-        :param conf: azure_instance configuration
-        :return: <CheckResult>
-        """
-        if 'allow' in conf:
-            allow_blocks = conf['allow']
-            for block in allow_blocks:
-                if 'ports' in block.keys():
-                    if PORT in block['ports'][0]:
-                        if 'source_ranges' in conf.keys():
-                            source_ranges = conf['source_ranges'][0]
-                            if "0.0.0.0/0" in source_ranges:
-                                return CheckResult.FAILED
-        return CheckResult.PASSED
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, port=PORT)
 
 
 check = GoogleComputeFirewallUnrestrictedIngress22()
diff --git a/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3389.py b/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3389.py
index 64f4cee46..21ef39db4 100644
--- a/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3389.py
+++ b/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3389.py
@@ -1,34 +1,16 @@
-from checkov.common.models.enums import CheckResult, CheckCategories
-from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.gcp.AbsGoogleComputeFirewallUnrestrictedIngress import AbsGoogleComputeFirewallUnrestrictedIngress
 
 PORT = '3389'
 
 
-class GoogleComputeFirewallUnrestrictedIngress3389(BaseResourceCheck):
+class GoogleComputeFirewallUnrestrictedIngress3389(AbsGoogleComputeFirewallUnrestrictedIngress):
     def __init__(self):
         name = "Ensure Google compute firewall ingress does not allow unrestricted rdp access"
         id = "CKV_GCP_3"
         supported_resources = ['google_compute_firewall']
         categories = [CheckCategories.NETWORKING]
-        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
-
-    def scan_resource_conf(self, conf):
-        """
-            Looks for password configuration at google_compute_firewall:
-            https://www.terraform.io/docs/providers/google/r/compute_firewall.html
-        :param conf: azure_instance configuration
-        :return: <CheckResult>
-        """
-        if 'allow' in conf:
-            allow_blocks = conf['allow']
-            for block in allow_blocks:
-                if 'ports' in block.keys():
-                    if PORT in block['ports'][0]:
-                        if 'source_ranges' in conf.keys():
-                            source_ranges = conf['source_ranges'][0]
-                            if "0.0.0.0/0" in source_ranges:
-                                return CheckResult.FAILED
-        return CheckResult.PASSED
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, port=PORT)
 
 
 check = GoogleComputeFirewallUnrestrictedIngress3389()
diff --git a/checkov/version.py b/checkov/version.py
index 678fc9f37..6f7811eaa 100644
--- a/checkov/version.py
+++ b/checkov/version.py
@@ -1,1 +1,1 @@
-version = '1.0.370'
+version = '1.0.369'
diff --git a/docs/3.Scans/resource-scans.md b/docs/3.Scans/resource-scans.md
index fe95d404b..601895e39 100644
--- a/docs/3.Scans/resource-scans.md
+++ b/docs/3.Scans/resource-scans.md
@@ -135,13 +135,13 @@ nav_order: 1
 | 124 | CKV_AZURE_20 | resource          | azurerm_security_center_contact"             | Ensure that security contact 'Phone number' is set                                                                                                                                                       | Terraform      |
 | 125 | CKV_AZURE_21 | resource          | azurerm_security_center_contact"             | Ensure that 'Send email notification for high severity alerts' is set to 'On'                                                                                                                            | Terraform      |
 | 126 | CKV_AZURE_22 | resource          | azurerm_security_center_contact"             | Ensure that 'Send email notification for high severity alerts' is set to 'On'                                                                                                                            | Terraform      |
-| 127 | CKV_AZURE_23 | resource          | azurerm_sql_server                           | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                                                                    | Terraform      |
-| 128 | CKV_AZURE_23 | resource          | azurerm_mssql_server                         | Ensure that 'Auditing' is set to 'On' for SQL servers                                                                                                                                                    | Terraform      |
-| 129 | CKV_AZURE_24 | resource          | azurerm_sql_server                           | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers                                                                                                                               | Terraform      |
-| 130 | CKV_AZURE_24 | resource          | azurerm_mssql_server                         | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers                                                                                                                               | Terraform      |
+| 127 | CKV_AZURE_23 | resource          | azurerm_sql_server                           | Ensure that 'Auditing' is set to 'On'                                                                                                                                                                    | Terraform      |
+| 128 | CKV_AZURE_23 | resource          | azurerm_mssql_server                         | Ensure that 'Auditing' is set to 'On'                                                                                                                                                                    | Terraform      |
+| 129 | CKV_AZURE_24 | resource          | azurerm_sql_server                           | Ensure that 'Auditing' Retention is 'greater than 90 days'                                                                                                                                               | Terraform      |
+| 130 | CKV_AZURE_24 | resource          | azurerm_mssql_server                         | Ensure that 'Auditing' Retention is 'greater than 90 days'                                                                                                                                               | Terraform      |
 | 131 | CKV_AZURE_25 | resource          | azurerm_mssql_server_security_alert_policy   | Ensure that 'Threat Detection types' is set to 'All'                                                                                                                                                     | Terraform      |
-| 132 | CKV_AZURE_26 | resource          | azurerm_mssql_server_security_alert_policy   | Ensure that 'Send Alerts To' is enabled for MSSQL servers                                                                                                                                                | Terraform      |
-| 133 | CKV_AZURE_27 | resource          | azurerm_mssql_server_security_alert_policy   | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers                                                                                                                         | Terraform      |
+| 132 | CKV_AZURE_26 | resource          | azurerm_mssql_server_security_alert_policy   | Ensure that 'Send alerts to' is set                                                                                                                                                                      | Terraform      |
+| 133 | CKV_AZURE_27 | resource          | azurerm_mssql_server_security_alert_policy   | Ensure that 'Email service and co-administrators' is 'Enabled'                                                                                                                                           | Terraform      |
 | 134 | CKV_AZURE_28 | resource          | azurerm_mysql_server                         | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server                                                                                                                            | Terraform      |
 | 135 | CKV_AZURE_29 | resource          | azurerm_postgre_server                       | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server                                                                                                                       | Terraform      |
 | 136 | CKV_AZURE_3  | resource          | azurerm_storage_account                      | Ensure that 'Secure transfer required' is set to 'Enabled'                                                                                                                                               | Terraform      |
diff --git a/kubernetes/requirements.txt b/kubernetes/requirements.txt
index 48c915e7a..d61e08ffd 100644
--- a/kubernetes/requirements.txt
+++ b/kubernetes/requirements.txt
@@ -1,1 +1,1 @@
-checkov==1.0.370
+checkov==1.0.369


Test patch:
diff --git a/tests/terraform/checks/resource/gcp/test_TestGoogleComputeFirewallUnrestrictedIngress22.py b/tests/terraform/checks/resource/gcp/test_TestGoogleComputeFirewallUnrestrictedIngress22.py
index 8fc8fbc2c..db890ea85 100644
--- a/tests/terraform/checks/resource/gcp/test_TestGoogleComputeFirewallUnrestrictedIngress22.py
+++ b/tests/terraform/checks/resource/gcp/test_TestGoogleComputeFirewallUnrestrictedIngress22.py
@@ -23,6 +23,11 @@ class TestGoogleComputeFirewallUnrestrictedIngress22(unittest.TestCase):
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.PASSED, scan_result)
 
+    def test_unknown(self):
+        conf = {'count': ['${length(var.firewall_networks)}'], 'project': ['${length(var.firewall_networks) == 1 && var.firewall_projects[0] == "default" ? var.project : var.firewall_projects[count.index]}'], 'name': ['${var.name}-hc-${count.index}'], 'network': ['${var.firewall_networks[count.index]}'], 'source_ranges': [['130.211.0.0/22', '35.191.0.0/16']], 'target_tags': ['${length(var.target_tags) > 0 ? var.target_tags : None}'], 'target_service_accounts': ['${length(var.target_service_accounts) > 0 ? var.target_service_accounts : None}'], 'dynamic': [{'allow': {'for_each': ['${var.backends}'], 'content': [{'protocol': ['tcp'], 'ports': [['${allow.value.port}']]}]}}], 'allow': ['${var.backends}']}
+        scan_result = check.scan_resource_conf(conf)
+        self.assertEqual(scan_result, CheckResult.UNKNOWN)
+
 
 if __name__ == '__main__':
     unittest.main()