We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Checkov v2.3.261 fails with CKV_AWS_356 for KMS actions which must specify 'all resources'
**Describe the issue**
Checkov v2.3.261 fails with CKV_AWS_356 highlights IAM policies which are overly permissive but is incorrectly identifying actions for KMS policies which need to be for all resources potentially scoped with conditional access per https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-services.html

Similar issue for https://github.com/bridgecrewio/checkov/issues/5134 where certain actions like 'list' require all resources.

**Examples**
```
data "aws_iam_policy_document" "myKmsKey" {
    actions = [
      "kms:GenerateDataKey",
      "kms:Decrypt"
    ]
    resources = [
      "*"
    ]

    condition {
      test     = "ArnEquals"
      variable = "aws:SourceArn"
      values = [
        <SOME OTHER RESOURCE>.arn
      ]
    }
  }
}
```
**Version (please complete the following information):**
 - Checkov Version 2.3.261


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/terraform/checks/utils/iam_terraform_document_to_policy_converter.py`
Content:
```
1 from typing import Dict, List, Any
2 
3 from checkov.common.util.data_structures_utils import pickle_deepcopy
4 
5 
6 def convert_terraform_conf_to_iam_policy(conf: Dict[str, List[Dict[str, Any]]]) -> Dict[str, List[Dict[str, Any]]]:
7     """
8         converts terraform parsed configuration to iam policy document
9     """
10     result = pickle_deepcopy(conf)
11     if "statement" in result.keys():
12         result["Statement"] = result.pop("statement")
13         for statement in result["Statement"]:
14             if "actions" in statement:
15                 statement["Action"] = statement.pop("actions")[0]
16             if "resources" in statement:
17                 statement["Resource"] = statement.pop("resources")[0]
18             if "not_actions" in statement:
19                 statement["NotAction"] = statement.pop("not_actions")[0]
20             if "not_resources" in statement:
21                 statement["NotResource"] = statement.pop("not_resources")[0]
22             if "effect" in statement:
23                 statement["Effect"] = statement.pop("effect")[0]
24             if "effect" not in statement and "Effect" not in statement:
25                 statement["Effect"] = "Allow"
26     return result
27
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/terraform/checks/utils/iam_terraform_document_to_policy_converter.py b/checkov/terraform/checks/utils/iam_terraform_document_to_policy_converter.py
--- a/checkov/terraform/checks/utils/iam_terraform_document_to_policy_converter.py
+++ b/checkov/terraform/checks/utils/iam_terraform_document_to_policy_converter.py
@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 from typing import Dict, List, Any
 
 from checkov.common.util.data_structures_utils import pickle_deepcopy
@@ -23,4 +25,13 @@
                 statement["Effect"] = statement.pop("effect")[0]
             if "effect" not in statement and "Effect" not in statement:
                 statement["Effect"] = "Allow"
+            if "condition" in statement:
+                conditions = statement.pop("condition")
+                if conditions and isinstance(conditions, list):
+                    statement["Condition"] = {}
+                    for condition in conditions:
+                        cond_operator = condition["test"][0]
+                        cond_key = condition["variable"][0]
+                        cond_value = condition["values"][0]
+                        statement["Condition"].setdefault(cond_operator, {})[cond_key] = cond_value
     return result

{"golden_diff": "diff --git a/checkov/terraform/checks/utils/iam_terraform_document_to_policy_converter.py b/checkov/terraform/checks/utils/iam_terraform_document_to_policy_converter.py\n--- a/checkov/terraform/checks/utils/iam_terraform_document_to_policy_converter.py\n+++ b/checkov/terraform/checks/utils/iam_terraform_document_to_policy_converter.py\n@@ -1,3 +1,5 @@\n+from __future__ import annotations\n+\n from typing import Dict, List, Any\n \n from checkov.common.util.data_structures_utils import pickle_deepcopy\n@@ -23,4 +25,13 @@\n                 statement[\"Effect\"] = statement.pop(\"effect\")[0]\n             if \"effect\" not in statement and \"Effect\" not in statement:\n                 statement[\"Effect\"] = \"Allow\"\n+            if \"condition\" in statement:\n+                conditions = statement.pop(\"condition\")\n+                if conditions and isinstance(conditions, list):\n+                    statement[\"Condition\"] = {}\n+                    for condition in conditions:\n+                        cond_operator = condition[\"test\"][0]\n+                        cond_key = condition[\"variable\"][0]\n+                        cond_value = condition[\"values\"][0]\n+                        statement[\"Condition\"].setdefault(cond_operator, {})[cond_key] = cond_value\n     return result\n", "issue": "Checkov v2.3.261 fails with CKV_AWS_356 for KMS actions which must specify 'all resources'\n**Describe the issue**\r\nCheckov v2.3.261 fails with CKV_AWS_356 highlights IAM policies which are overly permissive but is incorrectly identifying actions for KMS policies which need to be for all resources potentially scoped with conditional access per https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-services.html\r\n\r\nSimilar issue for https://github.com/bridgecrewio/checkov/issues/5134 where certain actions like 'list' require all resources.\r\n\r\n**Examples**\r\n```\r\ndata \"aws_iam_policy_document\" \"myKmsKey\" {\r\n    actions = [\r\n      \"kms:GenerateDataKey\",\r\n      \"kms:Decrypt\"\r\n    ]\r\n    resources = [\r\n      \"*\"\r\n    ]\r\n\r\n    condition {\r\n      test     = \"ArnEquals\"\r\n      variable = \"aws:SourceArn\"\r\n      values = [\r\n        <SOME OTHER RESOURCE>.arn\r\n      ]\r\n    }\r\n  }\r\n}\r\n```\r\n**Version (please complete the following information):**\r\n - Checkov Version 2.3.261\r\n\n", "before_files": [{"content": "from typing import Dict, List, Any\n\nfrom checkov.common.util.data_structures_utils import pickle_deepcopy\n\n\ndef convert_terraform_conf_to_iam_policy(conf: Dict[str, List[Dict[str, Any]]]) -> Dict[str, List[Dict[str, Any]]]:\n    \"\"\"\n        converts terraform parsed configuration to iam policy document\n    \"\"\"\n    result = pickle_deepcopy(conf)\n    if \"statement\" in result.keys():\n        result[\"Statement\"] = result.pop(\"statement\")\n        for statement in result[\"Statement\"]:\n            if \"actions\" in statement:\n                statement[\"Action\"] = statement.pop(\"actions\")[0]\n            if \"resources\" in statement:\n                statement[\"Resource\"] = statement.pop(\"resources\")[0]\n            if \"not_actions\" in statement:\n                statement[\"NotAction\"] = statement.pop(\"not_actions\")[0]\n            if \"not_resources\" in statement:\n                statement[\"NotResource\"] = statement.pop(\"not_resources\")[0]\n            if \"effect\" in statement:\n                statement[\"Effect\"] = statement.pop(\"effect\")[0]\n            if \"effect\" not in statement and \"Effect\" not in statement:\n                statement[\"Effect\"] = \"Allow\"\n    return result\n", "path": "checkov/terraform/checks/utils/iam_terraform_document_to_policy_converter.py"}], "after_files": [{"content": "from __future__ import annotations\n\nfrom typing import Dict, List, Any\n\nfrom checkov.common.util.data_structures_utils import pickle_deepcopy\n\n\ndef convert_terraform_conf_to_iam_policy(conf: Dict[str, List[Dict[str, Any]]]) -> Dict[str, List[Dict[str, Any]]]:\n    \"\"\"\n        converts terraform parsed configuration to iam policy document\n    \"\"\"\n    result = pickle_deepcopy(conf)\n    if \"statement\" in result.keys():\n        result[\"Statement\"] = result.pop(\"statement\")\n        for statement in result[\"Statement\"]:\n            if \"actions\" in statement:\n                statement[\"Action\"] = statement.pop(\"actions\")[0]\n            if \"resources\" in statement:\n                statement[\"Resource\"] = statement.pop(\"resources\")[0]\n            if \"not_actions\" in statement:\n                statement[\"NotAction\"] = statement.pop(\"not_actions\")[0]\n            if \"not_resources\" in statement:\n                statement[\"NotResource\"] = statement.pop(\"not_resources\")[0]\n            if \"effect\" in statement:\n                statement[\"Effect\"] = statement.pop(\"effect\")[0]\n            if \"effect\" not in statement and \"Effect\" not in statement:\n                statement[\"Effect\"] = \"Allow\"\n            if \"condition\" in statement:\n                conditions = statement.pop(\"condition\")\n                if conditions and isinstance(conditions, list):\n                    statement[\"Condition\"] = {}\n                    for condition in conditions:\n                        cond_operator = condition[\"test\"][0]\n                        cond_key = condition[\"variable\"][0]\n                        cond_value = condition[\"values\"][0]\n                        statement[\"Condition\"].setdefault(cond_operator, {})[cond_key] = cond_value\n    return result\n", "path": "checkov/terraform/checks/utils/iam_terraform_document_to_policy_converter.py"}]}