fix(terraform): stop CKV_GCP_43 crashing when not a string (#5561)

bridgecrewio · Oct 4, 2023 · 1ef5b91 · 1ef5b91
1 parent 37743fa
commit 1ef5b91
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 4 deletions.
diff --git a/checkov/terraform/checks/resource/gcp/GoogleKMSRotationPeriod.py b/checkov/terraform/checks/resource/gcp/GoogleKMSRotationPeriod.py
@@ -28,7 +28,7 @@ def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:
 
         self.evaluated_keys = ["rotation_period"]
         rotation = conf.get("rotation_period")
-        if rotation and rotation[0]:
+        if rotation and rotation[0] and isinstance(rotation[0], str):
             time = force_int(rotation[0][:-1])
             if time and ONE_DAY <= time <= NINETY_DAYS:
                 return CheckResult.PASSED

diff --git a/tests/terraform/checks/resource/gcp/example_GoogleKMSRotationPeriod/main.tf b/tests/terraform/checks/resource/gcp/example_GoogleKMSRotationPeriod/main.tf
@@ -32,3 +32,9 @@ resource "google_kms_crypto_key" "asymmetric" {
   key_ring = "google_kms_key_ring.keyring.id"
   purpose  = "ASYMMETRIC_SIGN"
 }
+
+resource "google_kms_crypto_key" "fail" {
+  name            = "crypto-key-example"
+  key_ring        = "google_kms_key_ring.keyring.id"
+  rotation_period = 90
+}
diff --git a/tests/terraform/checks/resource/gcp/test_GoogleKMSKeyRotationPeriod.py b/tests/terraform/checks/resource/gcp/test_GoogleKMSKeyRotationPeriod.py
@@ -25,16 +25,17 @@ def test(self):
         failing_resources = {
             "google_kms_crypto_key.default",
             "google_kms_crypto_key.half_year",
+            "google_kms_crypto_key.fail",
         }
 
         passed_check_resources = {c.resource for c in report.passed_checks}
         failed_check_resources = {c.resource for c in report.failed_checks}
 
-        self.assertEqual(summary["passed"], 2)
-        self.assertEqual(summary["failed"], 2)
+        self.assertEqual(summary["passed"], len(passing_resources))
+        self.assertEqual(summary["failed"], len(failing_resources))
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)
-        self.assertEqual(summary["resource_count"], 5)  # 1 unknown
+        self.assertEqual(summary["resource_count"], 6)  # 1 unknown
 
         self.assertEqual(passing_resources, passed_check_resources)
         self.assertEqual(failing_resources, failed_check_resources)