Skip to content

fix(terraform): handle null values and alternative blocks in plan parser for aws_batch_job_definition#7586

Open
AtlasWarden wants to merge 2 commits into
bridgecrewio:mainfrom
AtlasWarden:fix/batch-job-definition-plan-crash
Open

fix(terraform): handle null values and alternative blocks in plan parser for aws_batch_job_definition#7586
AtlasWarden wants to merge 2 commits into
bridgecrewio:mainfrom
AtlasWarden:fix/batch-job-definition-plan-crash

Conversation

@AtlasWarden

@AtlasWarden AtlasWarden commented Jun 24, 2026

Copy link
Copy Markdown

Description

This PR resolves an unhandled TypeError crash in the Terraform plan parser and expands policy scanning coverage for aws_batch_job_definition configurations.

The Problem

Currently, RESOURCE_TYPES_JSONIFY maps "aws_batch_job_definition" strictly to a single string attribute: "container_properties".

  1. If a user deploys a batch job utilizing alternative configuration blocks (such as ecs_properties, eks_properties, or node_properties), Terraform sets the unused "container_properties" key to null inside the generated plan JSON.
  2. Checkov's jsonify() function evaluates if jsonify_key in obj, which returns True because the key physically exists in the dictionary with a null value.
  3. Checkov passes null (Python None) directly into json.loads(), causing an immediate framework crash: TypeError: the JSON object must be str, bytes or bytearray, not NoneType.
  4. Downstream check engines completely miss evaluating the configurations present in the active alternative block.

The Solution

  1. Refactored RESOURCE_TYPES_JSONIFY to allow a tuple of valid strings for a resource type to support multi-variant configurations.
  2. Updated jsonify() to dynamically evaluate single string mappings or iterate through tuples seamlessly.
  3. Implemented safe value validation (if jsonify_key in obj and obj[jsonify_key]) to gracefully filter out null, None, or empty arrays before parsing.
  4. The loop successfully extracts the active alternative configuration block and passes it smoothly to downstream policies without dropping execution.

Fixes # 7587

Checklist:

  • I have performed a self-review of my own code
  • New and existing tests pass locally with my changes

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant