diff --git a/checkov/terraform/checks/resource/azure/APIManagementBackendHTTPS.py b/checkov/terraform/checks/resource/azure/APIManagementBackendHTTPS.py index 61d1368eac..952a8e6411 100644 --- a/checkov/terraform/checks/resource/azure/APIManagementBackendHTTPS.py +++ b/checkov/terraform/checks/resource/azure/APIManagementBackendHTTPS.py @@ -18,11 +18,14 @@ def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: self.evaluated_keys = ["url"] url = conf.get("url") if url and isinstance(url, list): - if "https" in url[0]: + url_value = url[0] + if not isinstance(url_value, str): + return CheckResult.UNKNOWN + if url_value.startswith("https://"): return CheckResult.PASSED - - return CheckResult.FAILED - + if url_value.startswith("http://"): + return CheckResult.FAILED + return CheckResult.UNKNOWN return CheckResult.UNKNOWN diff --git a/tests/terraform/checks/resource/azure/example_APIManagementBackendHTTPS/main.tf b/tests/terraform/checks/resource/azure/example_APIManagementBackendHTTPS/main.tf index 9db2ad4dde..a92974eefd 100644 --- a/tests/terraform/checks/resource/azure/example_APIManagementBackendHTTPS/main.tf +++ b/tests/terraform/checks/resource/azure/example_APIManagementBackendHTTPS/main.tf @@ -12,4 +12,23 @@ resource "azurerm_api_management_backend" "fail" { api_management_name = azurerm_api_management.example.name protocol = "http" url = "http://backend" -} \ No newline at end of file +} + +resource "azurerm_api_management_backend" "unknown_var" { + protocol = "http" + url = var.backend_url +} + +resource "azurerm_api_management_backend" "unknown_each" { + protocol = "http" + url = each.value.backend_url +} + +resource "azurerm_api_management_backend" "unknown_local" { + protocol = "http" + url = local.backend_url +} + +resource "azurerm_api_management_backend" "unknown_missing_url" { + protocol = "http" +} diff --git a/tests/terraform/checks/resource/azure/test_APIManagementBackendHTTPS.py b/tests/terraform/checks/resource/azure/test_APIManagementBackendHTTPS.py index 1d32029fbb..8ca69d064b 100644 --- a/tests/terraform/checks/resource/azure/test_APIManagementBackendHTTPS.py +++ b/tests/terraform/checks/resource/azure/test_APIManagementBackendHTTPS.py @@ -7,6 +7,7 @@ class TestAPIManagementBackendHTTPS(unittest.TestCase): + def test(self): # given test_files_dir = Path(__file__).parent / "example_APIManagementBackendHTTPS" @@ -20,7 +21,6 @@ def test(self): passing_resources = { "azurerm_api_management_backend.pass", } - failing_resources = { "azurerm_api_management_backend.fail", } @@ -32,7 +32,7 @@ def test(self): self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) - + self.assertEqual(summary["resource_count"], 6) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources)