CKV_AZURE_36 fails when dynamic content is in place

[tberreis]

Describe the issue
CKV_AZURE_36 (Ensure ‘Trusted Microsoft Services’ is enabled for Storage Account access) results in a false positive when dynamic content is used in hcl.
It's not yet clear to me why the check is failing, even if bypass = ["AzureServices"] is defined.

Examples
Minimal code example which is not working as expected:

# cat main.tf
resource "azurerm_storage_account" "this" {
  network_rules {
    default_action             = "Deny"
    bypass                     = ["Logging", "Metrics", "AzureServices"]
  }

  dynamic "blob_properties" {
    for_each = foo != bar ? [1] : []
    content {
      foo = bar
    }
  }
}

Result:

# checkov -f main.tf --check CKV_AZURE_36 --quiet
terraform scan results:

Passed checks: 0, Failed checks: 1, Skipped checks: 0

Check: CKV_AZURE_36: "Ensure 'Trusted Microsoft Services' is enabled for Storage Account access"
        FAILED for resource: azurerm_storage_account.this
        File: /main.tf:1-13
        Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/azure-policies/azure-networking-policies/enable-trusted-microsoft-services-for-storage-account-access

                1  | resource "azurerm_storage_account" "this" {
                2  |   network_rules {
                3  |     default_action             = "Deny"
                4  |     bypass                     = ["Logging", "Metrics", "AzureServices"]
                5  |   }
                6  |
                7  |   dynamic "blob_properties" {
                8  |     for_each = foo != bar ? [1] : []
                9  |     content {
                10 |       foo = bar
                11 |     }
                12 |   }
                13 | }

Result when just removing line 10:

# cat main2.tf
resource "azurerm_storage_account" "this" {
  network_rules {
    default_action             = "Deny"
    bypass                     = ["Logging", "Metrics", "AzureServices"]
  }

  dynamic "blob_properties" {
    for_each = foo != bar ? [1] : []
    content {
    }
  }
}

# checkov -f main2.tf --check CKV_AZURE_36 --quiet
terraform scan results:

Passed checks: 1, Failed checks: 0, Skipped checks: 0

Expectation: Passing the check in both cases.

Version (please complete the following information):

• 3.2.254

Additional context
May be related to #6528.

[itai1357]

Hi @tberreis.
first of all, thanks a lot for reaching out for us and for the well-detailed example!
It seems that indeed there is some issue here that should be handled.

letting you know that we will open a dedicated ticket in our engineering-team and we will prioritize it
@tsmithv11 FYI