diff --git a/checkov/bicep/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py b/checkov/bicep/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py index 48d6fcc77d3..04ad919f4a4 100644 --- a/checkov/bicep/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py +++ b/checkov/bicep/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py @@ -18,6 +18,9 @@ def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: self.evaluated_keys = ["properties/networkAcls/defaultAction"] properties = conf.get("properties") if properties: + if not isinstance(properties, dict): + return CheckResult.UNKNOWN + nacls = properties.get("networkAcls") if nacls: default_action = nacls.get("defaultAction") diff --git a/checkov/bicep/checks/resource/azure/StorageAccountsTransportEncryption.py b/checkov/bicep/checks/resource/azure/StorageAccountsTransportEncryption.py index 323cd7ff9ee..79e9739e2fe 100644 --- a/checkov/bicep/checks/resource/azure/StorageAccountsTransportEncryption.py +++ b/checkov/bicep/checks/resource/azure/StorageAccountsTransportEncryption.py @@ -19,6 +19,9 @@ def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: self.evaluated_keys = ["properties/supportsHttpsTrafficOnly"] properties = conf.get("properties") if properties: + if not isinstance(properties, dict): + return CheckResult.UNKNOWN + https_only = properties.get("supportsHttpsTrafficOnly") if https_only is True: return CheckResult.PASSED diff --git a/tests/bicep/checks/resource/azure/example_StorageAccountAzureServicesAccessEnabled/main.bicep b/tests/bicep/checks/resource/azure/example_StorageAccountAzureServicesAccessEnabled/main.bicep index e6d53d73f4e..49893a656c7 100644 --- a/tests/bicep/checks/resource/azure/example_StorageAccountAzureServicesAccessEnabled/main.bicep +++ b/tests/bicep/checks/resource/azure/example_StorageAccountAzureServicesAccessEnabled/main.bicep @@ -72,3 +72,16 @@ resource denyAndBypassNone 'Microsoft.Storage/storageAccounts@2019-06-01' = { } } } + +// unknown + +resource unknown 'Microsoft.Storage/storageAccounts@2019-06-01' = { + name: diagStorageAccountName + location: location + sku: { + name: storageAccountType + } + kind: 'StorageV2' + + properties: storageAccountProperties +} diff --git a/tests/bicep/checks/resource/azure/example_StorageAccountsTransportEncryption/main.bicep b/tests/bicep/checks/resource/azure/example_StorageAccountsTransportEncryption/main.bicep index 9e97b750ef5..c31612b4c2a 100644 --- a/tests/bicep/checks/resource/azure/example_StorageAccountsTransportEncryption/main.bicep +++ b/tests/bicep/checks/resource/azure/example_StorageAccountsTransportEncryption/main.bicep @@ -45,3 +45,17 @@ resource disabled 'Microsoft.Storage/storageAccounts@2019-06-01' = { supportsHttpsTrafficOnly: false } } + +// unknown + +resource unknown 'Microsoft.Storage/storageAccounts@2019-06-01' = { + name: diagStorageAccountName + location: location + sku: { + name: storageAccountType + } + kind: 'StorageV2' + + properties: storageAccountProperties +} + diff --git a/tests/bicep/checks/resource/azure/test_StorageAccountAzureServicesAccessEnabled.py b/tests/bicep/checks/resource/azure/test_StorageAccountAzureServicesAccessEnabled.py index 1c9d2784345..239f2e900a0 100644 --- a/tests/bicep/checks/resource/azure/test_StorageAccountAzureServicesAccessEnabled.py +++ b/tests/bicep/checks/resource/azure/test_StorageAccountAzureServicesAccessEnabled.py @@ -29,10 +29,11 @@ def test_examples(): passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} - assert summary["passed"] == 3 - assert summary["failed"] == 2 + assert summary["passed"] == len(passing_resources) + assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 + assert summary["resource_count"] == len(passing_resources) + len(failing_resources) + 1 # unknown assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources diff --git a/tests/bicep/checks/resource/azure/test_StorageAccountsTransportEncryption.py b/tests/bicep/checks/resource/azure/test_StorageAccountsTransportEncryption.py index 3edacc903a9..486a447ebea 100644 --- a/tests/bicep/checks/resource/azure/test_StorageAccountsTransportEncryption.py +++ b/tests/bicep/checks/resource/azure/test_StorageAccountsTransportEncryption.py @@ -28,10 +28,11 @@ def test_examples(): passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} - assert summary["passed"] == 2 - assert summary["failed"] == 2 + assert summary["passed"] == len(passing_resources) + assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 + assert summary["resource_count"] == len(passing_resources) + len(failing_resources) + 1 # unknown assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources