False positive for CKV_AZURE_120

[rafaelhsg]

Describe the issue

The check CKV_AZURE_120 returns an error when using the:

  dynamic "policy_settings" {
    for_each = var.policy_settings != null ? { config = var.policy_settings } : {}
    content {
      enabled            = policy_settings.value.enabled
    }
  }

inside the resource azurerm_web_application_firewall_policy instead of direct policy_settings { enabled = true } configuration.

Examples

The check should return successful if any of the following are true:

• policy_settings { enabled = true }
• dynamic policy_settings { enabled = policy_settings.value.enabled }

Desktop (please complete the following information):

• Checkov Version 2.1.82

[gruebel]

hi @rafaelhsg thanks for reaching out. We currently don't support dynamic blocks with reference to object values.

[ChanochShayner]

Hey @rafaelhsg we are now working on supporting dynamic blocks rendering, and we have already implemented a lot in this area. Could you please try again to scan this resource?

[gruebel]

feel free to reach out again after testing the latest version 🙂