fix(terraform): CKV_AZURE_215 - fix false positive on azurerm_api_management_backend for unresolvable url references

checkov/terraform/checks/resource/azure/APIManagementBackendHTTPS.py

@@ -18,11 +18,14 @@ def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:
         self.evaluated_keys = ["url"]
         url = conf.get("url")
         if url and isinstance(url, list):
-            if "https" in url[0]:
+            url_value = url[0]
+            if not isinstance(url_value, str):
+                return CheckResult.UNKNOWN
+            if url_value.startswith("https://"):
                 return CheckResult.PASSED
-
-            return CheckResult.FAILED
-
+            if url_value.startswith("http://"):
+                return CheckResult.FAILED
+            return CheckResult.UNKNOWN
         return CheckResult.UNKNOWN
 
 

tests/terraform/checks/resource/azure/example_APIManagementBackendHTTPS/main.tf

@@ -12,4 +12,23 @@ resource "azurerm_api_management_backend" "fail" {
   api_management_name = azurerm_api_management.example.name
   protocol            = "http"
   url                 = "http://backend"
-}
+}
+
+resource "azurerm_api_management_backend" "unknown_var" {
+  protocol = "http"
+  url      = var.backend_url
+}
+
+resource "azurerm_api_management_backend" "unknown_each" {
+  protocol = "http"
+  url      = each.value.backend_url
+}
+
+resource "azurerm_api_management_backend" "unknown_local" {
+  protocol = "http"
+  url      = local.backend_url
+}
+
+resource "azurerm_api_management_backend" "unknown_missing_url" {
+  protocol = "http"
+}

tests/terraform/checks/resource/azure/test_APIManagementBackendHTTPS.py

@@ -7,6 +7,7 @@
 
 
 class TestAPIManagementBackendHTTPS(unittest.TestCase):
+
     def test(self):
         # given
         test_files_dir = Path(__file__).parent / "example_APIManagementBackendHTTPS"
@@ -20,7 +21,6 @@ def test(self):
         passing_resources = {
             "azurerm_api_management_backend.pass",
         }
-
         failing_resources = {
             "azurerm_api_management_backend.fail",
         }
@@ -32,7 +32,7 @@ def test(self):
         self.assertEqual(summary["failed"], len(failing_resources))
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)
-
+        self.assertEqual(summary["resource_count"], 6)
         self.assertEqual(passing_resources, passed_check_resources)
         self.assertEqual(failing_resources, failed_check_resources)