We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Scanning IAM Role Public Access
Describe the bug
It seems when specifying more than one  json, the policy does not scan all principals, rather it looks at the first one. 

To Reproduce
Steps to reproduce the behavior:

Create policy with more than one SID
`resource "aws_iam_role" "lambdaRole" {
  name               = "test-role"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
      {
        "Action": "sts:AssumeRole",
        "Principal" : {"Service": "lambda.amazonaws.com"},
        "Effect": "Allow"
      },
      {
        "Action": "sts:AssumeRole",
        "Principal" : {"AWS": "*"},
        "Effect": "Allow"
      },
      {
        "Action": "sts:AssumeRole",
        "Principal" : {"Service": "events.amazonaws.com"},
        "Effect": "Allow"
      },
  ]
}

EOF
}`
Run Checkov against policy
Expected behavior
I would expect the scan to check each json within the policy rather than the first one

Desktop (please complete the following information):

OS: Mac
Checkov Version: 1.0.459


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py`
Content:
```
1 from checkov.common.models.enums import CheckResult, CheckCategories
2 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
3 import json
4 
5 
6 class IAMRoleAllowsPublicAssume(BaseResourceCheck):
7 
8     def __init__(self):
9         name = "Ensure IAM role allows only specific services or principals to assume it"
10         id = "CKV_AWS_60"
11         supported_resources = ['aws_iam_role']
12         categories = [CheckCategories.IAM]
13         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
14 
15     def scan_resource_conf(self, conf):
16         if isinstance(conf['assume_role_policy'][0], str):
17             try:
18                 assume_role_block = json.loads(conf['assume_role_policy'][0])
19                 if 'Statement' in assume_role_block.keys():
20                     if 'Principal' in assume_role_block['Statement'][0]:
21                         if 'AWS' in assume_role_block['Statement'][0]['Principal']:
22                             if assume_role_block['Statement'][0]['Principal']['AWS'] == '*':
23                                     return CheckResult.FAILED
24             except: # nosec
25                 pass
26         return CheckResult.PASSED
27 
28 
29 check = IAMRoleAllowsPublicAssume()
30
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py b/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py
--- a/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py
+++ b/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py
@@ -17,10 +17,10 @@
             try:
                 assume_role_block = json.loads(conf['assume_role_policy'][0])
                 if 'Statement' in assume_role_block.keys():
-                    if 'Principal' in assume_role_block['Statement'][0]:
-                        if 'AWS' in assume_role_block['Statement'][0]['Principal']:
-                            if assume_role_block['Statement'][0]['Principal']['AWS'] == '*':
-                                    return CheckResult.FAILED
+                    for statement in assume_role_block['Statement']:
+                        if 'AWS' in statement['Principal']:
+                            if statement['Principal']['AWS'] == '*':
+                                return CheckResult.FAILED
             except: # nosec
                 pass
         return CheckResult.PASSED

{"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py b/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py\n--- a/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py\n+++ b/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py\n@@ -17,10 +17,10 @@\n             try:\n                 assume_role_block = json.loads(conf['assume_role_policy'][0])\n                 if 'Statement' in assume_role_block.keys():\n-                    if 'Principal' in assume_role_block['Statement'][0]:\n-                        if 'AWS' in assume_role_block['Statement'][0]['Principal']:\n-                            if assume_role_block['Statement'][0]['Principal']['AWS'] == '*':\n-                                    return CheckResult.FAILED\n+                    for statement in assume_role_block['Statement']:\n+                        if 'AWS' in statement['Principal']:\n+                            if statement['Principal']['AWS'] == '*':\n+                                return CheckResult.FAILED\n             except: # nosec\n                 pass\n         return CheckResult.PASSED\n", "issue": "Scanning IAM Role Public Access\nDescribe the bug\r\nIt seems when specifying more than one  json, the policy does not scan all principals, rather it looks at the first one. \r\n\r\nTo Reproduce\r\nSteps to reproduce the behavior:\r\n\r\nCreate policy with more than one SID\r\n`resource \"aws_iam_role\" \"lambdaRole\" {\r\n  name               = \"test-role\"\r\n  assume_role_policy = <<EOF\r\n{\r\n  \"Version\": \"2012-10-17\",\r\n  \"Statement\": [\r\n      {\r\n        \"Action\": \"sts:AssumeRole\",\r\n        \"Principal\" : {\"Service\": \"lambda.amazonaws.com\"},\r\n        \"Effect\": \"Allow\"\r\n      },\r\n      {\r\n        \"Action\": \"sts:AssumeRole\",\r\n        \"Principal\" : {\"AWS\": \"*\"},\r\n        \"Effect\": \"Allow\"\r\n      },\r\n      {\r\n        \"Action\": \"sts:AssumeRole\",\r\n        \"Principal\" : {\"Service\": \"events.amazonaws.com\"},\r\n        \"Effect\": \"Allow\"\r\n      },\r\n  ]\r\n}\r\n\r\nEOF\r\n}`\r\nRun Checkov against policy\r\nExpected behavior\r\nI would expect the scan to check each json within the policy rather than the first one\r\n\r\nDesktop (please complete the following information):\r\n\r\nOS: Mac\r\nCheckov Version: 1.0.459\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nimport json\n\n\nclass IAMRoleAllowsPublicAssume(BaseResourceCheck):\n\n    def __init__(self):\n        name = \"Ensure IAM role allows only specific services or principals to assume it\"\n        id = \"CKV_AWS_60\"\n        supported_resources = ['aws_iam_role']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if isinstance(conf['assume_role_policy'][0], str):\n            try:\n                assume_role_block = json.loads(conf['assume_role_policy'][0])\n                if 'Statement' in assume_role_block.keys():\n                    if 'Principal' in assume_role_block['Statement'][0]:\n                        if 'AWS' in assume_role_block['Statement'][0]['Principal']:\n                            if assume_role_block['Statement'][0]['Principal']['AWS'] == '*':\n                                    return CheckResult.FAILED\n            except: # nosec\n                pass\n        return CheckResult.PASSED\n\n\ncheck = IAMRoleAllowsPublicAssume()\n", "path": "checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nimport json\n\n\nclass IAMRoleAllowsPublicAssume(BaseResourceCheck):\n\n    def __init__(self):\n        name = \"Ensure IAM role allows only specific services or principals to assume it\"\n        id = \"CKV_AWS_60\"\n        supported_resources = ['aws_iam_role']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if isinstance(conf['assume_role_policy'][0], str):\n            try:\n                assume_role_block = json.loads(conf['assume_role_policy'][0])\n                if 'Statement' in assume_role_block.keys():\n                    for statement in assume_role_block['Statement']:\n                        if 'AWS' in statement['Principal']:\n                            if statement['Principal']['AWS'] == '*':\n                                return CheckResult.FAILED\n            except: # nosec\n                pass\n        return CheckResult.PASSED\n\n\ncheck = IAMRoleAllowsPublicAssume()\n", "path": "checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py"}]}