Repository: bridgecrewio/checkov

Issue:
Supression skip comments for CloudFormation templates
Suppression does not appear to work for CloudFormation templates. For example with the following group, adding skip commitfor `CKV_AWS_24` to not get a warning from SSH port open.  

```
  #checkov:skip=CKV_AWS_24:
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Folding@home spot instance security group
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: !Ref SSHLocation
      SecurityGroupEgress:
        - IpProtocol: udp
          FromPort: 53
          ToPort: 53
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: 123
          ToPort: 123
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 8080
          ToPort: 8080
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
```
Please implement supression for CloudFormation templates also.

Discussion:

Patch:
diff --git a/checkov/cloudformation/runner.py b/checkov/cloudformation/runner.py
index db33c11eb..83e2f2432 100644
--- a/checkov/cloudformation/runner.py
+++ b/checkov/cloudformation/runner.py
@@ -1,6 +1,7 @@
 import logging
 import operator
 import os
+import re
 from functools import reduce
 
 from checkov.cloudformation.checks.resource.registry import resource_registry
@@ -11,6 +12,7 @@ from checkov.common.runners.base_runner import BaseRunner
 from checkov.runner_filter import RunnerFilter
 
 CF_POSSIBLE_ENDINGS = [".yml", ".yaml", ".json", ".template"]
+COMMENT_REGEX = re.compile(r'(checkov:skip=) *([A-Z_\d]+)(:[^\n]+)?')
 
 
 class Runner(BaseRunner):
@@ -81,10 +83,6 @@ class Runner(BaseRunner):
                     continue
                 resource_id = f"{resource['Type']}.{resource_name}"
 
-                ## TODO - Evaluate skipped_checks
-                skipped_checks = {}
-
-                results = resource_registry.scan(cf_file, {resource_name: resource}, skipped_checks,runner_filter)
                 # TODO refactor into context parsing
                 find_lines_result_list = list(find_lines(resource, '__startline__'))
                 if len(find_lines_result_list) >= 1:
@@ -98,6 +96,18 @@ class Runner(BaseRunner):
                     # TODO - Variable Eval Message!
                     variable_evaluations = {}
 
+                    skipped_checks = []
+                    for line in entity_code_lines:
+                        skip_search = re.search(COMMENT_REGEX, str(line))
+                        if skip_search:
+                            skipped_checks.append(
+                                {
+                                    'id': skip_search.group(2),
+                                    'suppress_comment': skip_search.group(3)[1:] if skip_search.group(3) else "No comment provided"
+                                }
+                            )
+
+                    results = resource_registry.scan(cf_file, {resource_name: resource}, skipped_checks, runner_filter)
                     for check, check_result in results.items():
                         ### TODO - Need to get entity_code_lines and entity_lines_range
                         record = Record(check_id=check.id, check_name=check.name, check_result=check_result,


Test patch:
diff --git a/tests/cloudformation/parser/skip.yaml b/tests/cloudformation/parser/skip.yaml
new file mode 100644
index 000000000..4922c7927
--- /dev/null
+++ b/tests/cloudformation/parser/skip.yaml
@@ -0,0 +1,11 @@
+Resources:
+  MyDB:
+    Type: 'AWS::RDS::DBInstance'
+    # Test case for check skip via comment
+    # checkov:skip=CKV_AWS_16:Ensure all data stored in the RDS is securely encrypted at rest
+    Properties:
+      DBName: 'mydb'
+      DBInstanceClass: 'db.t3.micro'
+      Engine: 'mysql'
+      MasterUsername: 'master'
+      MasterUserPassword: 'password'
diff --git a/tests/cloudformation/parser/test_cfn_yaml.py b/tests/cloudformation/parser/test_cfn_yaml.py
new file mode 100644
index 000000000..ad56651e3
--- /dev/null
+++ b/tests/cloudformation/parser/test_cfn_yaml.py
@@ -0,0 +1,23 @@
+import os
+import unittest
+
+from checkov.cloudformation.runner import Runner
+from checkov.runner_filter import RunnerFilter
+
+
+class TestCfnYaml(unittest.TestCase):
+
+    def test_skip_parsing(self):
+        current_dir = os.path.dirname(os.path.realpath(__file__))
+
+        test_files = f'{current_dir}/skip.yaml'
+        report = Runner().run(None, files=[test_files], runner_filter=RunnerFilter())
+        summary = report.get_summary()
+
+        self.assertEqual(summary['passed'], 1)
+        self.assertEqual(summary['failed'], 0)
+        self.assertEqual(summary['skipped'], 1)
+        self.assertEqual(summary['parsing_errors'], 0)
+
+if __name__ == '__main__':
+    unittest.main()