feat(terraform): Update ckv-aws-8 policy - support unknown statement

checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py

@@ -35,16 +35,31 @@ def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:
         self.evaluated_keys.append("ebs_block_device")
         blocks = conf.get("ebs_block_device") or []
 
-        allblocks = root + blocks
+        all_blocks = root + blocks
 
-        if not allblocks:
+        if not all_blocks:
             return CheckResult.UNKNOWN
+        all_blocks_results = []
 
-        for block in allblocks:
-            if isinstance(block, dict) and not block.get("encrypted") == [True]:
-                if not block.get("snapshot_id"):
-                    return CheckResult.FAILED
-        return CheckResult.PASSED
+        for block in all_blocks:
+            all_blocks_results.append(_is_block_encrypted(block))
+        if CheckResult.FAILED in all_blocks_results:
+            return CheckResult.FAILED
+        elif CheckResult.UNKNOWN in all_blocks_results:
+            return CheckResult.UNKNOWN
+        else:
+            return CheckResult.PASSED
 
 
 check = LaunchConfigurationEBSEncryption()
+
+
+def _is_block_encrypted(block) -> CheckResult:
+    if isinstance(block, dict):
+        if block.get("encrypted") in ([False], False) and not block.get("snapshot_id"):
+            return CheckResult.FAILED
+        elif block.get("encrypted") in ([True], True):
+            return CheckResult.PASSED
+        elif not block.get("encrypted") in ([True], True) and block.get("snapshot_id"):
+            return CheckResult.PASSED
+    return CheckResult.UNKNOWN

tests/terraform/checks/resource/aws/example_LaunchConfigurationEBSEncryption/main.tf

@@ -64,7 +64,7 @@ resource "aws_instance" "fail_empty_root_list" {
   root_block_device = var.empty_list
 }
 
-resource "aws_instance" "fail_empty_ebs_list" {
+resource "aws_instance" "unknown_empty_ebs_list" {
   image_id      = "ami-123"
   instance_type = "t2.micro"
 

tests/terraform/checks/resource/aws/test_LaunchConfigurationEBSEncryption.py

@@ -31,15 +31,14 @@ def test(self):
             "aws_instance.fail4",
             "aws_instance.fail5",
             "aws_instance.fail_empty_root_list",
-            "aws_instance.fail_empty_ebs_list",
             "aws_launch_configuration.fail",
         }
 
         passed_check_resources = {c.resource for c in report.passed_checks}
         failed_check_resources = {c.resource for c in report.failed_checks}
 
         self.assertEqual(summary["passed"], 5)
-        self.assertEqual(summary["failed"], 8)
+        self.assertEqual(summary["failed"], 7)
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)