We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Checkov crashes when evaluating a Terraform dynamic block in NSGRulePortAccessRestricted.py
**Describe the bug**
When checking azure_security_group_rule, azurerm_network_security_rule or azurerm_network_security_group Terraform resource types, NSGRulePortAccessRestricted.py throws a "TypeError: string indices must be integers" error whenever there's a dynamic block.

**To Reproduce**
Steps to reproduce the behavior:
1. Create a resource in terraform, containing a dynamic security rule -
```
resource "azurerm_network_security_group" "snet_nsgs" {
  count               = "${length(local.subnets)}"
  name                = "${local.root}-snet-${lookup(local.subnets[count.index], "name")}-nsg"
  location            = "${azurerm_resource_group.net_rg.location}"
  resource_group_name = "${azurerm_resource_group.net_rg.name}"
  tags                = "${local.tags}"


  dynamic "security_rule" {
    for_each = [for s in local.subnets[count.index].nsg_rules : {
      name                       = s.name
      priority                   = s.priority
      direction                  = s.direction
      access                     = s.access
      protocol                   = s.protocol
      source_port_range          = s.source_port_range
      destination_port_range     = s.destination_port_range
      source_address_prefix      = s.source_address_prefix
      destination_address_prefix = s.destination_address_prefix
      description                = s.description
    }]
    content {
      name                       = security_rule.value.name
      priority                   = security_rule.value.priority
      direction                  = security_rule.value.direction
      access                     = security_rule.value.access
      protocol                   = security_rule.value.protocol
      source_port_range          = security_rule.value.source_port_range
      destination_port_range     = security_rule.value.destination_port_range
      source_address_prefix      = security_rule.value.source_address_prefix
      destination_address_prefix = security_rule.value.destination_address_prefix
      description                = security_rule.value.description
    }
  }
}
```
2. Run checkov
3. Error!

**Expected behavior**
As checkov cannot evaluate the dynamic block, I expect the check to be skipped without throwing an error.

**Desktop (please complete the following information):**
 - OS: Ubuntu
 - Checkov Version 1.0.479


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py`
Content:
```
1 from checkov.common.models.enums import CheckResult, CheckCategories
2 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck
3 from checkov.common.util.type_forcers import force_list
4 import re
5 
6 INTERNET_ADDRESSES = ["*", "0.0.0.0", "<nw>/0", "/0", "internet", "any"]
7 PORT_RANGE = re.compile('\d+-\d+')
8 
9 
10 class NSGRulePortAccessRestricted(BaseResourceCheck):
11     def __init__(self, name, check_id, port):
12         supported_resources = ['azure_security_group_rule', 'azurerm_network_security_rule', 'azurerm_network_security_group']
13         categories = [CheckCategories.NETWORKING]
14         super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources)
15         self.port = port
16 
17     def is_port_in_range(self, conf):
18         ports = force_list(conf['destination_port_range'][0])
19         for range in ports:
20             if re.match(PORT_RANGE, range):
21                 start, end = int(range.split('-')[0]), int(range.split('-')[1])
22                 if start <= self.port <= end:
23                     return True
24             if range in [str(self.port), '*']:
25                 return True
26         return False
27 
28     def scan_resource_conf(self, conf):
29         rule_confs = [conf]
30         if 'security_rule' in conf:
31             rule_confs = conf['security_rule']
32 
33         for rule_conf in rule_confs:
34             if 'access' in rule_conf and rule_conf['access'][0] == "Allow":
35                 if 'direction' in rule_conf and rule_conf['direction'][0] == "Inbound":
36                     if 'protocol' in rule_conf and rule_conf['protocol'][0] == 'TCP':
37                         if 'destination_port_range' in rule_conf and self.is_port_in_range(rule_conf):
38                             if 'source_address_prefix' in rule_conf and rule_conf['source_address_prefix'][0] in INTERNET_ADDRESSES:
39                                 return CheckResult.FAILED
40         return CheckResult.PASSED
41 
42
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py b/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py
--- a/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py
+++ b/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py
@@ -26,6 +26,9 @@
         return False
 
     def scan_resource_conf(self, conf):
+        if "dynamic" in conf:
+            return CheckResult.UNKNOWN
+            
         rule_confs = [conf]
         if 'security_rule' in conf:
             rule_confs = conf['security_rule']

{"golden_diff": "diff --git a/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py b/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py\n--- a/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py\n+++ b/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py\n@@ -26,6 +26,9 @@\n         return False\n \n     def scan_resource_conf(self, conf):\n+        if \"dynamic\" in conf:\n+            return CheckResult.UNKNOWN\n+            \n         rule_confs = [conf]\n         if 'security_rule' in conf:\n             rule_confs = conf['security_rule']\n", "issue": "Checkov crashes when evaluating a Terraform dynamic block in NSGRulePortAccessRestricted.py\n**Describe the bug**\r\nWhen checking azure_security_group_rule, azurerm_network_security_rule or azurerm_network_security_group Terraform resource types, NSGRulePortAccessRestricted.py throws a \"TypeError: string indices must be integers\" error whenever there's a dynamic block.\r\n\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\n1. Create a resource in terraform, containing a dynamic security rule -\r\n```\r\nresource \"azurerm_network_security_group\" \"snet_nsgs\" {\r\n  count               = \"${length(local.subnets)}\"\r\n  name                = \"${local.root}-snet-${lookup(local.subnets[count.index], \"name\")}-nsg\"\r\n  location            = \"${azurerm_resource_group.net_rg.location}\"\r\n  resource_group_name = \"${azurerm_resource_group.net_rg.name}\"\r\n  tags                = \"${local.tags}\"\r\n\r\n\r\n  dynamic \"security_rule\" {\r\n    for_each = [for s in local.subnets[count.index].nsg_rules : {\r\n      name                       = s.name\r\n      priority                   = s.priority\r\n      direction                  = s.direction\r\n      access                     = s.access\r\n      protocol                   = s.protocol\r\n      source_port_range          = s.source_port_range\r\n      destination_port_range     = s.destination_port_range\r\n      source_address_prefix      = s.source_address_prefix\r\n      destination_address_prefix = s.destination_address_prefix\r\n      description                = s.description\r\n    }]\r\n    content {\r\n      name                       = security_rule.value.name\r\n      priority                   = security_rule.value.priority\r\n      direction                  = security_rule.value.direction\r\n      access                     = security_rule.value.access\r\n      protocol                   = security_rule.value.protocol\r\n      source_port_range          = security_rule.value.source_port_range\r\n      destination_port_range     = security_rule.value.destination_port_range\r\n      source_address_prefix      = security_rule.value.source_address_prefix\r\n      destination_address_prefix = security_rule.value.destination_address_prefix\r\n      description                = security_rule.value.description\r\n    }\r\n  }\r\n}\r\n```\r\n2. Run checkov\r\n3. Error!\r\n\r\n**Expected behavior**\r\nAs checkov cannot evaluate the dynamic block, I expect the check to be skipped without throwing an error.\r\n\r\n**Desktop (please complete the following information):**\r\n - OS: Ubuntu\r\n - Checkov Version 1.0.479\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck\nfrom checkov.common.util.type_forcers import force_list\nimport re\n\nINTERNET_ADDRESSES = [\"*\", \"0.0.0.0\", \"<nw>/0\", \"/0\", \"internet\", \"any\"]\nPORT_RANGE = re.compile('\\d+-\\d+')\n\n\nclass NSGRulePortAccessRestricted(BaseResourceCheck):\n    def __init__(self, name, check_id, port):\n        supported_resources = ['azure_security_group_rule', 'azurerm_network_security_rule', 'azurerm_network_security_group']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources)\n        self.port = port\n\n    def is_port_in_range(self, conf):\n        ports = force_list(conf['destination_port_range'][0])\n        for range in ports:\n            if re.match(PORT_RANGE, range):\n                start, end = int(range.split('-')[0]), int(range.split('-')[1])\n                if start <= self.port <= end:\n                    return True\n            if range in [str(self.port), '*']:\n                return True\n        return False\n\n    def scan_resource_conf(self, conf):\n        rule_confs = [conf]\n        if 'security_rule' in conf:\n            rule_confs = conf['security_rule']\n\n        for rule_conf in rule_confs:\n            if 'access' in rule_conf and rule_conf['access'][0] == \"Allow\":\n                if 'direction' in rule_conf and rule_conf['direction'][0] == \"Inbound\":\n                    if 'protocol' in rule_conf and rule_conf['protocol'][0] == 'TCP':\n                        if 'destination_port_range' in rule_conf and self.is_port_in_range(rule_conf):\n                            if 'source_address_prefix' in rule_conf and rule_conf['source_address_prefix'][0] in INTERNET_ADDRESSES:\n                                return CheckResult.FAILED\n        return CheckResult.PASSED\n\n", "path": "checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck\nfrom checkov.common.util.type_forcers import force_list\nimport re\n\nINTERNET_ADDRESSES = [\"*\", \"0.0.0.0\", \"<nw>/0\", \"/0\", \"internet\", \"any\"]\nPORT_RANGE = re.compile('\\d+-\\d+')\n\n\nclass NSGRulePortAccessRestricted(BaseResourceCheck):\n    def __init__(self, name, check_id, port):\n        supported_resources = ['azure_security_group_rule', 'azurerm_network_security_rule', 'azurerm_network_security_group']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources)\n        self.port = port\n\n    def is_port_in_range(self, conf):\n        ports = force_list(conf['destination_port_range'][0])\n        for range in ports:\n            if re.match(PORT_RANGE, range):\n                start, end = int(range.split('-')[0]), int(range.split('-')[1])\n                if start <= self.port <= end:\n                    return True\n            if range in [str(self.port), '*']:\n                return True\n        return False\n\n    def scan_resource_conf(self, conf):\n        if \"dynamic\" in conf:\n            return CheckResult.UNKNOWN\n            \n        rule_confs = [conf]\n        if 'security_rule' in conf:\n            rule_confs = conf['security_rule']\n\n        for rule_conf in rule_confs:\n            if 'access' in rule_conf and rule_conf['access'][0] == \"Allow\":\n                if 'direction' in rule_conf and rule_conf['direction'][0] == \"Inbound\":\n                    if 'protocol' in rule_conf and rule_conf['protocol'][0] == 'TCP':\n                        if 'destination_port_range' in rule_conf and self.is_port_in_range(rule_conf):\n                            if 'source_address_prefix' in rule_conf and rule_conf['source_address_prefix'][0] in INTERNET_ADDRESSES:\n                                return CheckResult.FAILED\n        return CheckResult.PASSED\n\n", "path": "checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py"}]}