fix(terraform): remove CKV2_AZURE_18 check and improve CKV2_AZURE_1

checkov/terraform/checks/graph_checks/azure/StorageCriticalDataEncryptedCMK.yaml

@@ -3,15 +3,21 @@ metadata:
   id: "CKV2_AZURE_1"
   category: "ENCRYPTION"
 definition:
-  and:
-    - cond_type: filter
-      attribute: resource_type
-      value:
+  or:
+    - and:
+        - cond_type: filter
+          attribute: resource_type
+          value:
+            - azurerm_storage_account
+          operator: within
+        - cond_type: connection
+          resource_types:
+            - azurerm_storage_account
+          connected_resource_types:
+            - azurerm_storage_account_customer_managed_key
+          operator: exists
+    - resource_types:
         - azurerm_storage_account
-      operator: within
-    - cond_type: connection
-      resource_types:
-        - azurerm_storage_account
-      connected_resource_types:
-        - azurerm_storage_account_customer_managed_key
-      operator: exists
+      operator:  exists
+      cond_type: attribute
+      attribute: customer_managed_key.key_vault_key_id

tests/terraform/graph/checks/resources/StorageCriticalDataEncryptedCMK/expected.yaml

@@ -1,4 +1,5 @@
 pass:
   - "azurerm_storage_account.ok_storage_account"
+  - "azurerm_storage_account.ok_inline"
 fail:
   - "azurerm_storage_account.not_ok_storage_account"

tests/terraform/graph/checks/resources/StorageCriticalDataEncryptedCMK/main.tf

@@ -49,6 +49,23 @@ resource "azurerm_storage_account" "ok_storage_account" {
   }
 }
 
+resource "azurerm_storage_account" "ok_inline" {
+  name                     = "examplestor"
+  resource_group_name      = azurerm_resource_group.example.name
+  location                 = azurerm_resource_group.example.location
+  account_tier             = "Standard"
+  account_replication_type = "GRS"
+
+  identity {
+    type = "SystemAssigned"
+  }
+
+  customer_managed_key {
+    key_vault_key_id          = "azurerm_key_vault.example.id"
+    user_assigned_identity_id = "identity_id"
+  }
+}
+
 resource "azurerm_storage_account" "not_ok_storage_account" {
   name                     = "examplestor"
   resource_group_name      = azurerm_resource_group.example.name

tests/terraform/graph/checks/test_yaml_policies.py

@@ -232,9 +232,6 @@ def test_SubnetHasACL(self):
     def test_GKEClustersAreNotUsingDefaultServiceAccount(self):
         self.go("GKEClustersAreNotUsingDefaultServiceAccount")
 
-    def test_AzureStorageAccountsUseCustomerManagedKeyForEncryption(self):
-        self.go("AzureStorageAccountsUseCustomerManagedKeyForEncryption")
-
     def test_AzureMSSQLServerHasSecurityAlertPolicy(self):
         self.go("AzureMSSQLServerHasSecurityAlertPolicy")
 

tests/terraform/runner/test_runner.py

@@ -418,7 +418,10 @@ def test_no_missing_ids(self):
         for i in range(1, len(gcp_checks) + 1):
             self.assertIn(f'CKV2_GCP_{i}', gcp_checks,
                           msg=f'The new GCP violation should have the ID "CKV2_GCP_{i}"')
-        for i in range(1, len(azure_checks) + 1):
+        for i in range(1, len(azure_checks) + 2):
+            if f'CKV2_AZURE_{i}' == 'CKV2_AZURE_18':
+                # duplicate of CKV2_AZURE_1
+                continue
             self.assertIn(f'CKV2_AZURE_{i}', azure_checks,
                           msg=f'The new Azure violation should have the ID "CKV2_AZURE_{i}"')