feat(terraform): add expanded actions to Terraform AWS IAM resources

checkov/cloudformation/runner.py

@@ -221,9 +221,10 @@ def get_graph_checks_report(self, root_folder: str | None, runner_filter: Runner
                 entity_file_abs_path = entity[CustomAttributes.FILE_PATH]
                 entity_file_path = f"/{os.path.relpath(entity_file_abs_path, root_folder)}"
                 entity_name = entity[CustomAttributes.BLOCK_NAME].split(".")[-1]
-                entity_context = self.context[entity_file_abs_path][TemplateSections.RESOURCES][
-                    entity_name
-                ]
+                if entity_file_abs_path in self.context:
+                    entity_context = self.context[entity_file_abs_path][TemplateSections.RESOURCES][entity_name]
+                else:
+                    entity_context = {}
 
                 skipped_check = next(
                     (
@@ -243,7 +244,7 @@ def get_graph_checks_report(self, root_folder: str | None, runner_filter: Runner
                     check_result=check_result,
                     code_block=entity_context.get("code_lines"),
                     file_path=entity_file_path,
-                    file_line_range=[entity_context.get("start_line"), entity_context.get("end_line")],
+                    file_line_range=[entity_context.get("start_line", 1), entity_context.get("end_line", 1)],
                     resource=entity[CustomAttributes.ID],
                     evaluations={},
                     check_class=check.__class__.__module__,

checkov/common/checks_infra/checks_parser.py

@@ -194,6 +194,9 @@ def parse_raw_check(self, raw_check: Dict[str, Dict[str, Any]], **kwargs: Any) -
         check.frameworks = raw_check.get("metadata", {}).get("frameworks", [])
         check.guideline = raw_check.get("metadata", {}).get("guideline")
         check.check_path = kwargs.get("check_path", "")
+        extensions = raw_check.get("metadata", {}).get("extensions", None)
+        if extensions is not None:
+            check.extensions = extensions
         solver = self.get_check_solver(check)
         check.set_solver(solver)
 
@@ -282,9 +285,11 @@ def get_check_solver(self, check: BaseGraphCheck) -> BaseSolver:
         if check.sub_checks:
             sub_solvers = []
             for sub_solver in check.sub_checks:
+                # set extensions
+                sub_solver.extensions = check.extensions
                 sub_solvers.append(self.get_check_solver(sub_solver))
 
-        type_to_solver = {
+        type_to_solver: dict[SolverType | None, BaseSolver | None] = {
             SolverType.COMPLEX_CONNECTION: operator_to_complex_connection_solver_classes.get(
                 check.operator, lambda *args: None
             )(sub_solvers, check.operator),
@@ -300,9 +305,13 @@ def get_check_solver(self, check: BaseGraphCheck) -> BaseSolver:
             ),
         }
 
-        solver = type_to_solver.get(check.type)  # type:ignore[arg-type]  # if not str will return None
+        solver = type_to_solver.get(check.type)
         if not solver:
             raise NotImplementedError(f"solver type {check.type} with operator {check.operator} is not supported")
+
+        # set extensions
+        solver.extensions = check.extensions
+
         return solver