diff --git a/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py b/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py index 6032be6b7f7..7c18609dbc4 100644 --- a/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py +++ b/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py @@ -1,9 +1,11 @@ +from __future__ import annotations + from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class WAFRuleHasAnyActions(BaseResourceCheck): - def __init__(self): + def __init__(self) -> None: name = "Ensure WAF rule has any actions" id = "CKV_AWS_342" supported_resources = ('aws_waf_web_acl', 'aws_wafregional_web_acl', 'aws_wafv2_web_acl', @@ -11,7 +13,7 @@ def __init__(self): categories = (CheckCategories.APPLICATION_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) - def scan_resource_conf(self, conf): + def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: rules = None if conf.get("rule") and isinstance(conf["rule"], list): rules = conf["rule"] @@ -34,9 +36,10 @@ def scan_resource_conf(self, conf): for statement in statements: if statement.get('managed_rule_group_statement'): passing = True - if passing: - continue - return CheckResult.FAILED + + if not passing: + return CheckResult.FAILED + return CheckResult.PASSED return CheckResult.UNKNOWN