fix(terraform): catch unknowns with WAF configs

checkov/terraform/checks/resource/aws/WAFACLCVE202144228.py

@@ -21,7 +21,7 @@ def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult:
             statement = rule.get("statement")
             if statement:
                 self.evaluated_keys = [f"rule/[{idx_rule}]/statement/[0]/managed_rule_group_statement"]
-                if not isinstance(statement, list):
+                if not isinstance(statement, list) or not isinstance(statement[0], dict):
                     return CheckResult.UNKNOWN
                 managed_group = statement[0].get("managed_rule_group_statement")
                 if managed_group:

checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py

@@ -36,6 +36,8 @@ def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:
                 statements = rule.get('statement')
                 if statements and isinstance(statements, list):
                     for statement in statements:
+                        if not isinstance(statement, dict):
+                            continue
                         if statement.get('managed_rule_group_statement'):
                             passing = True
 

tests/terraform/checks/resource/aws/example_WAFACLCVE202144228/main.tf

@@ -265,3 +265,139 @@ resource "aws_wafv2_web_acl" "rule_group_count" {
     sampled_requests_enabled   = false
   }
 }
+
+
+#unknown
+resource "aws_wafv2_web_acl" "pass_dynamic" {
+  name  = "default-${var.scope}-web-acl"
+  scope = var.scope
+
+
+  default_action {
+    block {}
+  }
+
+
+  rule {
+    name     = "rule-${var.scope}-AWSManagedRulesCommonRuleSet"
+    priority = 1
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "rule-${var.scope}-AWSManagedRulesCommonRuleSet"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  rule {
+    name     = "AWS-AWSManagedRulesKnownBadInputsRuleSet"
+    priority = 2
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesKnownBadInputsRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "rule-${var.scope}-AWSManagedRulesKnownBadInputsRuleSet"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  dynamic "rule" {
+    for_each = var.dynamic_ip_set == "" ? [] : [1]
+
+    content {
+      name     = "rule-${var.scope}-ip-allowlist"
+      priority = 8
+
+      action {
+        allow {}
+      }
+
+      statement {
+        or_statement {
+          statement {
+            ip_set_reference_statement {
+              arn = aws_wafv2_ip_set.allow.arn
+            }
+          }
+          statement {
+            ip_set_reference_statement {
+              arn = data.aws_wafv2_ip_set.github-actions[0].arn
+            }
+          }
+        }
+      }
+
+      visibility_config {
+        cloudwatch_metrics_enabled = true
+        metric_name                = "rule-${var.scope}-ip-allowlist"
+        sampled_requests_enabled   = true
+      }
+    }
+  }
+
+
+  dynamic "rule" {
+    for_each = nonsensitive(var.review_token) == "" ? [] : [1]
+
+    content {
+      name     = "rule-${var.scope}-review-token-check"
+      priority = 30
+
+      action {
+        allow {}
+      }
+
+      statement {
+        byte_match_statement {
+          positional_constraint = "EXACTLY"
+          search_string         = var.review_token
+
+          field_to_match {
+            single_header {
+              name = "review-token"
+            }
+          }
+
+          text_transformation {
+            priority = 1
+            type     = "NONE"
+          }
+        }
+      }
+
+      visibility_config {
+        cloudwatch_metrics_enabled = true
+        metric_name                = "rule-${var.scope}-review-token-check"
+        sampled_requests_enabled   = true
+      }
+    }
+  }
+
+
+  visibility_config {
+    cloudwatch_metrics_enabled = true
+    metric_name                = "${var.scope}-web-acl"
+    sampled_requests_enabled   = true
+  }
+}

tests/terraform/checks/resource/aws/example_WAFRuleHasAnyActions/main.tf

@@ -326,4 +326,144 @@ resource "aws_waf_rule_group" "pass" {
     priority = 50
     rule_id  = aws_waf_rule.example.id
   }
+}
+
+variable "scope" {
+  type    = string # REGIONAL or CLOUDFRONT
+  default = "CLOUDFRONT"
+}
+
+
+resource "aws_wafv2_web_acl" "pass_dynamic" {
+  name  = "default-${var.scope}-web-acl"
+  scope = var.scope
+
+
+  default_action {
+    block {}
+  }
+
+
+  rule {
+    name     = "rule-${var.scope}-AWSManagedRulesCommonRuleSet"
+    priority = 1
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "rule-${var.scope}-AWSManagedRulesCommonRuleSet"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  rule {
+    name     = "AWS-AWSManagedRulesKnownBadInputsRuleSet"
+    priority = 2
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesKnownBadInputsRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "rule-${var.scope}-AWSManagedRulesKnownBadInputsRuleSet"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  dynamic "rule" {
+    for_each = var.dynamic_ip_set == "" ? [] : [1]
+
+    content {
+      name     = "rule-${var.scope}-ip-allowlist"
+      priority = 8
+
+      action {
+        allow {}
+      }
+
+      statement {
+        or_statement {
+          statement {
+            ip_set_reference_statement {
+              arn = aws_wafv2_ip_set.allow.arn
+            }
+          }
+          statement {
+            ip_set_reference_statement {
+              arn = data.aws_wafv2_ip_set.github-actions[0].arn
+            }
+          }
+        }
+      }
+
+      visibility_config {
+        cloudwatch_metrics_enabled = true
+        metric_name                = "rule-${var.scope}-ip-allowlist"
+        sampled_requests_enabled   = true
+      }
+    }
+  }
+
+
+  dynamic "rule" {
+    for_each = nonsensitive(var.review_token) == "" ? [] : [1]
+
+    content {
+      name     = "rule-${var.scope}-review-token-check"
+      priority = 30
+
+      action {
+        allow {}
+      }
+
+      statement {
+        byte_match_statement {
+          positional_constraint = "EXACTLY"
+          search_string         = var.review_token
+
+          field_to_match {
+            single_header {
+              name = "review-token"
+            }
+          }
+
+          text_transformation {
+            priority = 1
+            type     = "NONE"
+          }
+        }
+      }
+
+      visibility_config {
+        cloudwatch_metrics_enabled = true
+        metric_name                = "rule-${var.scope}-review-token-check"
+        sampled_requests_enabled   = true
+      }
+    }
+  }
+
+
+  visibility_config {
+    cloudwatch_metrics_enabled = true
+    metric_name                = "${var.scope}-web-acl"
+    sampled_requests_enabled   = true
+  }
 }

tests/terraform/checks/resource/aws/test_WAFRuleHasAnyActions.py

@@ -26,7 +26,8 @@ def test(self):
             'aws_wafv2_rule_group.pass',
             'aws_wafregional_rule_group.pass',
             'aws_waf_rule_group.pass',
-            'aws_wafv2_web_acl.pass_managed'
+            'aws_wafv2_web_acl.pass_managed',
+            'aws_wafv2_web_acl.pass_dynamic'
         }
 
         failing_resources = {