Repository: bridgecrewio/checkov

Issue:
CKV_AZURE_12: Retention policy of 0 is not supported
**Describe the bug**
When setting the `retention_period.days` value on `azurerm_network_watcher_flow_log` to `0`, `CKV_AZURE_12` still fails. `0` is the value to signify indefinite/forever retention.

**To Reproduce**
Steps to reproduce the behavior:
1. Create an `azurerm_network_watcher_flow_log` resource
2. Set
```
  retention_policy {
    enabled = true
    days    = 0
  }
```
3. Run `checkov`
4. Receive failure for `CKV_AZURE_12`

**Expected behavior**
`0` is an accepted value as documented at https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview#how-logging-works

**Desktop (please complete the following information):**
 - OS: Linux
 - Checkov Version: 2.0.26


**Additional context**
At https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/azure/NetworkWatcherFlowLogPeriod.py#L17 likely need to adjust the innermost `if` statement to something like:

```python
if retention_in_days is not None and (retention_days == 0 or retention_days >= 90):
```

Happy to open a pull request if this is an acceptable solution.

Discussion:

Patch:
diff --git a/checkov/main.py b/checkov/main.py
index 7d991aee5..21957bd30 100644
--- a/checkov/main.py
+++ b/checkov/main.py
@@ -173,7 +173,7 @@ def add_parser_args(parser):
                         action='store_true')
     parser.add_argument('--download-external-modules',
                         help="download external terraform modules from public git repositories and terraform registry",
-                        default=os.environ.get('DOWNLOAD_EXTERNAL_MODULES', False))
+                        default=False)
     parser.add_argument('--external-modules-download-path',
                         help="set the path for the download external terraform modules",
                         default=DEFAULT_EXTERNAL_MODULES_DIR)
diff --git a/checkov/terraform/checks/resource/azure/AKSUsesAzurePoliciesAddon.py b/checkov/terraform/checks/resource/azure/AKSUsesAzurePoliciesAddon.py
index 5132754c7..1f35fc670 100644
--- a/checkov/terraform/checks/resource/azure/AKSUsesAzurePoliciesAddon.py
+++ b/checkov/terraform/checks/resource/azure/AKSUsesAzurePoliciesAddon.py
@@ -11,7 +11,7 @@ class AKSUsesAzurePoliciesAddon(BaseResourceValueCheck):
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
     def get_inspected_key(self):
-        return "addon_profile/[0]/azure_policy/[0]/enabled"
+        return "azure_policy/[0]/enabled"
 
 
 check = AKSUsesAzurePoliciesAddon()
diff --git a/checkov/terraform/checks/resource/azure/NetworkWatcherFlowLogPeriod.py b/checkov/terraform/checks/resource/azure/NetworkWatcherFlowLogPeriod.py
index 7ee6f6d06..ea6b13581 100644
--- a/checkov/terraform/checks/resource/azure/NetworkWatcherFlowLogPeriod.py
+++ b/checkov/terraform/checks/resource/azure/NetworkWatcherFlowLogPeriod.py
@@ -16,7 +16,7 @@ class NetworkWatcherFlowLogPeriod(BaseResourceCheck):
             retention_block = conf['retention_policy'][0]
             if retention_block['enabled'][0]:
                 retention_in_days = force_int(retention_block['days'][0])
-                if retention_in_days and retention_in_days >= 90:
+                if retention_in_days is not None and (retention_in_days == 0 or retention_in_days >= 90):
                     return CheckResult.PASSED
         return CheckResult.FAILED
 
diff --git a/checkov/terraform/graph_manager.py b/checkov/terraform/graph_manager.py
index 1a1bb638e..84468ae0f 100644
--- a/checkov/terraform/graph_manager.py
+++ b/checkov/terraform/graph_manager.py
@@ -8,10 +8,10 @@ class GraphManager:
         self.source = source
 
     def build_graph_from_source_directory(self, source_dir, render_variables=True, local_graph_class=LocalGraph,
-                                          parsing_errors=None, download_external_modules=False):
+                                          parsing_errors=None):
         parser = Parser()
         module, module_dependency_map, tf_definitions = \
-            parser.parse_hcl_module(source_dir, self.source, download_external_modules, parsing_errors)
+            parser.parse_hcl_module(source_dir, self.source, parsing_errors)
 
         local_graph = local_graph_class(module, module_dependency_map)
         local_graph.build_graph(render_variables=render_variables)
diff --git a/checkov/terraform/module_loading/loaders/git_loader.py b/checkov/terraform/module_loading/loaders/git_loader.py
index 9365f97a4..c6e775cc5 100644
--- a/checkov/terraform/module_loading/loaders/git_loader.py
+++ b/checkov/terraform/module_loading/loaders/git_loader.py
@@ -13,7 +13,7 @@ class GenericGitLoader(ModuleLoader):
 
     def _load_module(self) -> ModuleContent:
         try:
-            module_source = self.module_source.replace('git::', '')
+            module_source = self.module_source.lstrip('git::')
             if module_source.startswith('ssh:'):
                 return ModuleContent(dir=None, failed_url=self.module_source)
             git_getter = GitGetter(module_source, create_clone_and_result_dirs=False)
diff --git a/checkov/terraform/parser.py b/checkov/terraform/parser.py
index 851d91d40..dd126aed2 100644
--- a/checkov/terraform/parser.py
+++ b/checkov/terraform/parser.py
@@ -416,8 +416,9 @@ class Parser:
             deep_merge.merge(self.out_evaluations_context, all_module_evaluations_context)
         return skipped_a_module
 
-    def parse_hcl_module(self, source_dir, source, download_external_modules=False, parsing_errors=None):
+    def parse_hcl_module(self, source_dir, source, parsing_errors=None):
         tf_definitions = {}
+        download_external_modules = os.environ.get('DOWNLOAD_EXTERNAL_MODULES', 'false').lower() == 'true'
         self.parse_directory(directory=source_dir, out_definitions=tf_definitions, out_evaluations_context={},
                              out_parsing_errors=parsing_errors if parsing_errors is not None else {},
                              download_external_modules=download_external_modules,
diff --git a/checkov/terraform/runner.py b/checkov/terraform/runner.py
index afb1d95a9..fd9474e5c 100644
--- a/checkov/terraform/runner.py
+++ b/checkov/terraform/runner.py
@@ -79,7 +79,6 @@ class Runner(BaseRunner):
                 local_graph, tf_definitions = \
                     self.graph_manager.build_graph_from_source_directory(root_folder,
                                                                          local_graph_class=self.graph_class,
-                                                                         download_external_modules=runner_filter.download_external_modules,
                                                                          parsing_errors=parsing_errors)
             elif files:
                 files = [os.path.abspath(file) for file in files]
diff --git a/checkov/version.py b/checkov/version.py
index 2be33f00f..952b91193 100644
--- a/checkov/version.py
+++ b/checkov/version.py
@@ -1,1 +1,1 @@
-version = '2.0.28'
+version = '2.0.26'
diff --git a/kubernetes/requirements.txt b/kubernetes/requirements.txt
index 5b0a9d1df..dfafb74fe 100644
--- a/kubernetes/requirements.txt
+++ b/kubernetes/requirements.txt
@@ -1,1 +1,1 @@
-checkov==2.0.28
+checkov==2.0.26


Test patch:
diff --git a/tests/graph/terraform/graph_builder/test_graph_builder.py b/tests/graph/terraform/graph_builder/test_graph_builder.py
index d80ed161d..993fc8f88 100644
--- a/tests/graph/terraform/graph_builder/test_graph_builder.py
+++ b/tests/graph/terraform/graph_builder/test_graph_builder.py
@@ -123,13 +123,13 @@ class TestGraphBuilder(TestCase):
                         expected_label='value')
 
     def test_build_graph_with_linked_registry_modules(self):
+        os.environ['DOWNLOAD_EXTERNAL_MODULES'] = 'true'
         resources_dir = os.path.realpath(
             os.path.join(TEST_DIRNAME, '../resources/modules/registry_security_group_inner_module'))
 
         graph_manager = GraphManager(NetworkxConnector())
         local_graph, tf_definitions = graph_manager.build_graph_from_source_directory(resources_dir,
-                                                                                      render_variables=True,
-                                                                                      download_external_modules=True)
+                                                                                      render_variables=True)
 
         outputs_vpcs = self.get_vertex_by_name_and_type(local_graph, BlockType.OUTPUT, 'this_security_group_vpc_id',
                                                         multiple=True)
diff --git a/tests/graph/terraform/runner/test_graph_builder.py b/tests/graph/terraform/runner/test_graph_builder.py
index fb138238f..bf7fad36b 100644
--- a/tests/graph/terraform/runner/test_graph_builder.py
+++ b/tests/graph/terraform/runner/test_graph_builder.py
@@ -52,7 +52,7 @@ class TestGraphBuilder(TestCase):
         runner = Runner()
         report = runner.run(root_folder=resources_path)
         self.assertLessEqual(3, len(report.failed_checks))
-        self.assertLessEqual(40, len(report.passed_checks))
+        self.assertLessEqual(41, len(report.passed_checks))
         self.assertEqual(0, len(report.skipped_checks))
 
         found_versioning_failure = False
diff --git a/tests/terraform/checks/resource/azure/test_AKSUsesAzurePoliciesAddon.py b/tests/terraform/checks/resource/azure/test_AKSUsesAzurePoliciesAddon.py
index 33a84bc4f..dce7c78ba 100644
--- a/tests/terraform/checks/resource/azure/test_AKSUsesAzurePoliciesAddon.py
+++ b/tests/terraform/checks/resource/azure/test_AKSUsesAzurePoliciesAddon.py
@@ -42,42 +42,8 @@ class TestAKSUsesAzurePoliciesAddon(unittest.TestCase):
                   location            = azurerm_resource_group.example.location
                   resource_group_name = azurerm_resource_group.example.name
                   dns_prefix          = "exampleaks1"
-
-                  addon_profile {
-                    azure_policy {
-                      enabled = false
-                    }
-                  }
-                  
-                  default_node_pool {
-                    name       = "default"
-                    node_count = 1
-                    vm_size    = "Standard_D2_v2"
-                  }
-                
-                  identity {
-                    type = "SystemAssigned"
-                  }
-                
-                  tags = {
-                    Environment = "Production"
-                  }
-                }
-        """)
-        resource_conf = hcl_res['resource'][0]['azurerm_kubernetes_cluster']['example']
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.FAILED, scan_result)
-
-    def test_failure3(self):
-        hcl_res = hcl2.loads("""
-                resource "azurerm_kubernetes_cluster" "example" {
-                  name                = "example-aks1"
-                  location            = azurerm_resource_group.example.location
-                  resource_group_name = azurerm_resource_group.example.name
-                  dns_prefix          = "exampleaks1"
-
                   azure_policy {
-                    enabled = true
+                    enabled = false
                   }
                   
                   default_node_pool {
@@ -99,7 +65,6 @@ class TestAKSUsesAzurePoliciesAddon(unittest.TestCase):
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
-
     def test_success(self):
         hcl_res = hcl2.loads("""
                 resource "azurerm_kubernetes_cluster" "example" {
@@ -107,10 +72,8 @@ class TestAKSUsesAzurePoliciesAddon(unittest.TestCase):
                   location            = azurerm_resource_group.example.location
                   resource_group_name = azurerm_resource_group.example.name
                   dns_prefix          = "exampleaks1"
-                  addon_profile {
-                    azure_policy {
-                      enabled = true
-                    }
+                  azure_policy {
+                    enabled = true
                   }
 
                   default_node_pool {
diff --git a/tests/terraform/checks/resource/azure/test_NetworkWatcherFlowLogPeriod.py b/tests/terraform/checks/resource/azure/test_NetworkWatcherFlowLogPeriod.py
index b1c4baf94..0f8f52033 100644
--- a/tests/terraform/checks/resource/azure/test_NetworkWatcherFlowLogPeriod.py
+++ b/tests/terraform/checks/resource/azure/test_NetworkWatcherFlowLogPeriod.py
@@ -28,6 +28,26 @@ class TestNetworkWatcherFlowLogPeriod(unittest.TestCase):
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
+    def test_failure_invalid_days_string(self):
+        hcl_res = hcl2.loads("""
+            resource "azurerm_network_watcher_flow_log" "test" {
+              network_watcher_name = azurerm_network_watcher.test.name
+              resource_group_name  = azurerm_resource_group.test.name
+              network_security_group_id = azurerm_network_security_group.test.id
+              storage_account_id        = azurerm_storage_account.test.id
+              enabled                   = true
+            
+              retention_policy {
+                enabled = true
+                days = var.watcher_flow_logs.days
+              }
+              }
+
+                """)
+        resource_conf = hcl_res['resource'][0]['azurerm_network_watcher_flow_log']['test']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
     def test_success(self):
         hcl_res = hcl2.loads("""
             resource "azurerm_network_watcher_flow_log" "test" {
@@ -48,6 +68,46 @@ class TestNetworkWatcherFlowLogPeriod(unittest.TestCase):
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.PASSED, scan_result)
 
+    def test_success_with_0_days(self):
+        hcl_res = hcl2.loads("""
+            resource "azurerm_network_watcher_flow_log" "test" {
+              network_watcher_name = azurerm_network_watcher.test.name
+              resource_group_name  = azurerm_resource_group.test.name
+              network_security_group_id = azurerm_network_security_group.test.id
+              storage_account_id        = azurerm_storage_account.test.id
+              enabled                   = true
+            
+              retention_policy {
+                enabled = true
+                days    = 0
+              }
+              }
+
+                """)
+        resource_conf = hcl_res['resource'][0]['azurerm_network_watcher_flow_log']['test']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_success_with_valid_day_string(self):
+        hcl_res = hcl2.loads("""
+            resource "azurerm_network_watcher_flow_log" "test" {
+              network_watcher_name = azurerm_network_watcher.test.name
+              resource_group_name  = azurerm_resource_group.test.name
+              network_security_group_id = azurerm_network_security_group.test.id
+              storage_account_id        = azurerm_storage_account.test.id
+              enabled                   = true
+            
+              retention_policy {
+                enabled = true
+                days    = "100"
+              }
+              }
+
+                """)
+        resource_conf = hcl_res['resource'][0]['azurerm_network_watcher_flow_log']['test']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
 
 if __name__ == '__main__':
     unittest.main()