feat(terraform): add aws_vpc_endpoint to RESOURCE_TYPES_JSONIFY #7281
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Description
This change adds support for JSON-parsing the
policy
attribute ofaws_vpc_endpoint
resources in Terraform plan files. This allows Checkov to correctly evaluate policies that use thejsonpath_exists
operator on the policy attribute of these resources.Fixed Issue
This change fixes an issue where policies using the
jsonpath_exists
operator on thepolicy
attribute ofaws_vpc_endpoint
resources would fail during Terraform plan scans.Motivation and Context
Currently, the Terraform plan parser in Checkov does not recognize the
policy
attribute ofaws_vpc_endpoint
resources as a JSON object. As a result, the attribute is treated as a string, which causes thejsonpath_exists
operator to fail. This change adds theaws_vpc_endpoint
resource type to theRESOURCE_TYPES_JSONIFY
dictionary incheckov/terraform/plan_parser.py
, which instructs the parser to treat thepolicy
attribute as a JSON object. This allows policies to correctly check for the existence of specific attributes within the policy, such asStatement
.Dependencies
There are no new dependencies required for this change.
Checklist: