We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
CKV_GCP_26 is not working as expected when using terraform plan output.
**Describe the bug**
CKV_GCP_26 check is not providing expected output when it is ran against terraform output json file. Check is gives the result as PASSED even if we don't have the flow logs enabled for the subnet. However if we run it against the directory where we have the .tf files then the check returns the FAILED status which is expected. 

checkov version used: `2.0.236`
Terraform version used: `1.0.1`

**To Reproduce**
1. Create a sample subnet resource in a network.tf file. 
```
resource "google_compute_network" "vpc" {
  name                    = "test-vpc"
  auto_create_subnetworks = "false"
  routing_mode            = "REGIONAL"
}

resource "google_compute_subnetwork" "private-subnet" {
  name                     = "test-sub"
  ip_cidr_range            = "10.1.0.0/16"
  network                  = google_compute_network.vpc.self_link
  private_ip_google_access = true
}
```
2. terraform plan -out tf.plan
3. terraform show -json tf.plan  > tf.json 
4. checkov -f tf.json
5. Now run checkov -f network.tf

Both the commands will give conflicting results

```
Check: CKV_GCP_26: "Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network"
        PASSED for resource: google_compute_subnetwork.private-subnet
        File: /tf/tfplan.json:0-0
        Guide: https://docs.bridgecrew.io/docs/bc_gcp_logging_1
```
```
Check: CKV_GCP_26: "Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network"
        FAILED for resource: google_compute_subnetwork.private-subnet
        File: /network.tf:6-11
        Guide: https://docs.bridgecrew.io/docs/bc_gcp_logging_1

                6  | resource "google_compute_subnetwork" "private-subnet" {
                7  |   name                     = var.private_subnet_name
                8  |   ip_cidr_range            = var.private_subnet_cidr
                9  |   network                  = google_compute_network.vpc.self_link
                10 |   private_ip_google_access = true
                11 | }
```
**Expected behavior**
The check should return the status as FAILED when running it against terraform plan output json


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py`
Content:
```
1 from checkov.common.models.enums import CheckCategories
2 from checkov.common.models.consts import ANY_VALUE
3 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
4 
5 
6 class AKSApiServerAuthorizedIpRanges(BaseResourceValueCheck):
7     def __init__(self):
8         name = "Ensure AKS has an API Server Authorized IP Ranges enabled"
9         id = "CKV_AZURE_6"
10         supported_resources = ['azurerm_kubernetes_cluster']
11         categories = [CheckCategories.KUBERNETES]
12         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
13 
14     def get_inspected_key(self):
15         return 'api_server_authorized_ip_ranges/[0]'
16 
17     def get_expected_value(self):
18         return ANY_VALUE
19 
20 
21 check = AKSApiServerAuthorizedIpRanges()
22
```

Path: `checkov/terraform/checks/resource/base_resource_value_check.py`
Content:
```
1 from abc import abstractmethod
2 from collections.abc import Iterable
3 from typing import List, Dict, Any
4 
5 import dpath.util
6 import re
7 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
8 from checkov.common.models.enums import CheckResult, CheckCategories
9 from checkov.common.models.consts import ANY_VALUE
10 from checkov.common.util.type_forcers import force_list
11 from checkov.terraform.graph_builder.utils import get_referenced_vertices_in_value
12 from checkov.terraform.parser_functions import handle_dynamic_values
13 from checkov.terraform.parser_utils import find_var_blocks
14 
15 
16 
17 class BaseResourceValueCheck(BaseResourceCheck):
18     def __init__(
19         self,
20         name: str,
21         id: str,
22         categories: "Iterable[CheckCategories]",
23         supported_resources: "Iterable[str]",
24         missing_block_result: CheckResult = CheckResult.FAILED,
25     ) -> None:
26         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
27         self.missing_block_result = missing_block_result
28 
29     @staticmethod
30     def _filter_key_path(path: str) -> List[str]:
31         """
32         Filter an attribute path to contain only named attributes by dropping array indices from the path)
33         :param path: valid JSONPath of an attribute
34         :return: List of named attributes with respect to the input JSONPath order
35         """
36         return [x for x in path.split("/") if not re.search(re.compile(r"^\[?\d+]?$"), x)]
37 
38     @staticmethod
39     def _is_variable_dependant(value: Any) -> bool:
40         if not isinstance(value, str):
41             return False
42         if "${" not in value:
43             return False
44 
45         if find_var_blocks(value):
46             return True
47         return False
48 
49     @staticmethod
50     def _is_nesting_key(inspected_attributes: List[str], key: List[str]) -> bool:
51         """
52         Resolves whether a key is a subset of the inspected nesting attributes
53         :param inspected_attributes: list of nesting attributes
54         :param key: JSONPath key of an attribute
55         :return: True/False
56         """
57         return any(x in key for x in inspected_attributes)
58 
59     def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:
60         handle_dynamic_values(conf)
61         inspected_key = self.get_inspected_key()
62         expected_values = self.get_expected_values()
63         if dpath.search(conf, inspected_key) != {}:
64             # Inspected key exists
65             value = dpath.get(conf, inspected_key)
66             if isinstance(value, list) and len(value) == 1:
67                 value = value[0]
68             if value is None:
69                 return self.missing_block_result
70             if ANY_VALUE in expected_values and value is not None and (not isinstance(value, str) or value):
71                 # Key is found on the configuration - if it accepts any value, the check is PASSED
72                 return CheckResult.PASSED
73             if self._is_variable_dependant(value):
74                 # If the tested attribute is variable-dependant, then result is PASSED
75                 return CheckResult.PASSED
76             if value in expected_values:
77                 return CheckResult.PASSED
78             if get_referenced_vertices_in_value(value=value, aliases={}, resources_types=[]):
79                 # we don't provide resources_types as we want to stay provider agnostic
80                 return CheckResult.UNKNOWN
81             return CheckResult.FAILED
82         else:
83             # Look for the configuration in a bottom-up fashion
84             inspected_attributes = self._filter_key_path(inspected_key)
85             for attribute in reversed(inspected_attributes):
86                 for sub_key, sub_conf in dpath.search(conf, f"**/{attribute}", yielded=True):
87                     filtered_sub_key = self._filter_key_path(sub_key)
88                     # Only proceed with check if full path for key is similar - not partial match
89                     if inspected_attributes == filtered_sub_key:
90                         if self._is_nesting_key(inspected_attributes, filtered_sub_key):
91                             if isinstance(sub_conf, list) and len(sub_conf) == 1:
92                                 sub_conf = sub_conf[0]
93                             if sub_conf in self.get_expected_values():
94                                 return CheckResult.PASSED
95                             if self._is_variable_dependant(sub_conf):
96                                 # If the tested attribute is variable-dependant, then result is PASSED
97                                 return CheckResult.PASSED
98 
99         return self.missing_block_result
100 
101     @abstractmethod
102     def get_inspected_key(self) -> str:
103         """
104         :return: JSONPath syntax path of the checked attribute
105         """
106         raise NotImplementedError()
107 
108     def get_expected_values(self) -> List[Any]:
109         """
110         Override the method with the list of acceptable values if the check has more than one possible expected value, given
111         the inspected key
112         :return: List of expected values, defaults to a list of the expected value
113         """
114         return [self.get_expected_value()]
115 
116     def get_expected_value(self) -> Any:
117         """
118         Returns the default expected value, governed by provider best practices
119         """
120         return True
121 
122     def get_evaluated_keys(self) -> List[str]:
123         return force_list(self.get_inspected_key())
124
```

Path: `checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py`
Content:
```
1 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
2 from checkov.common.models.enums import CheckCategories
3 from checkov.common.models.consts import ANY_VALUE
4 
5 
6 class GoogleSubnetworkLoggingEnabled(BaseResourceValueCheck):
7     def __init__(self):
8         name = "Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network"
9         id = "CKV_GCP_26"
10         supported_resources = ['google_compute_subnetwork']
11         categories = [CheckCategories.LOGGING]
12         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
13 
14     def get_inspected_key(self):
15         return 'log_config'
16 
17     def get_expected_values(self):
18         return [ANY_VALUE]
19 
20 
21 check = GoogleSubnetworkLoggingEnabled()
22
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py b/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py
--- a/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py
+++ b/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py
@@ -1,21 +1,23 @@
-from checkov.common.models.enums import CheckCategories
+from typing import List, Any
+
 from checkov.common.models.consts import ANY_VALUE
+from checkov.common.models.enums import CheckCategories
 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
 
 
 class AKSApiServerAuthorizedIpRanges(BaseResourceValueCheck):
-    def __init__(self):
+    def __init__(self) -> None:
         name = "Ensure AKS has an API Server Authorized IP Ranges enabled"
         id = "CKV_AZURE_6"
-        supported_resources = ['azurerm_kubernetes_cluster']
-        categories = [CheckCategories.KUBERNETES]
+        supported_resources = ("azurerm_kubernetes_cluster",)
+        categories = (CheckCategories.KUBERNETES,)
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def get_inspected_key(self):
-        return 'api_server_authorized_ip_ranges/[0]'
+    def get_inspected_key(self) -> str:
+        return "api_server_authorized_ip_ranges/[0]"
 
-    def get_expected_value(self):
-        return ANY_VALUE
+    def get_expected_values(self) -> List[Any]:
+        return [ANY_VALUE]
 
 
 check = AKSApiServerAuthorizedIpRanges()
diff --git a/checkov/terraform/checks/resource/base_resource_value_check.py b/checkov/terraform/checks/resource/base_resource_value_check.py
--- a/checkov/terraform/checks/resource/base_resource_value_check.py
+++ b/checkov/terraform/checks/resource/base_resource_value_check.py
@@ -65,7 +65,7 @@
             value = dpath.get(conf, inspected_key)
             if isinstance(value, list) and len(value) == 1:
                 value = value[0]
-            if value is None:
+            if value is None or (isinstance(value, list) and not value):
                 return self.missing_block_result
             if ANY_VALUE in expected_values and value is not None and (not isinstance(value, str) or value):
                 # Key is found on the configuration - if it accepts any value, the check is PASSED
diff --git a/checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py b/checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py
--- a/checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py
+++ b/checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py
@@ -1,20 +1,30 @@
-from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
-from checkov.common.models.enums import CheckCategories
+from typing import Any, List, Dict
+
 from checkov.common.models.consts import ANY_VALUE
+from checkov.common.models.enums import CheckCategories, CheckResult
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
 
 
 class GoogleSubnetworkLoggingEnabled(BaseResourceValueCheck):
-    def __init__(self):
+    def __init__(self) -> None:
         name = "Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network"
         id = "CKV_GCP_26"
-        supported_resources = ['google_compute_subnetwork']
-        categories = [CheckCategories.LOGGING]
+        supported_resources = ("google_compute_subnetwork",)
+        categories = (CheckCategories.LOGGING,)
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def get_inspected_key(self):
-        return 'log_config'
+    def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:
+        # flow logs can't be enabled for `INTERNAL_HTTPS_LOAD_BALANCER` subnetworks
+        purpose = conf.get("purpose")
+        if purpose and purpose[0] == "INTERNAL_HTTPS_LOAD_BALANCER":
+            return CheckResult.UNKNOWN
+
+        return super().scan_resource_conf(conf)
+
+    def get_inspected_key(self) -> str:
+        return "log_config"
 
-    def get_expected_values(self):
+    def get_expected_values(self) -> List[Any]:
         return [ANY_VALUE]

{"golden_diff": "diff --git a/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py b/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py\n--- a/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py\n+++ b/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py\n@@ -1,21 +1,23 @@\n-from checkov.common.models.enums import CheckCategories\n+from typing import List, Any\n+\n from checkov.common.models.consts import ANY_VALUE\n+from checkov.common.models.enums import CheckCategories\n from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n \n \n class AKSApiServerAuthorizedIpRanges(BaseResourceValueCheck):\n-    def __init__(self):\n+    def __init__(self) -> None:\n         name = \"Ensure AKS has an API Server Authorized IP Ranges enabled\"\n         id = \"CKV_AZURE_6\"\n-        supported_resources = ['azurerm_kubernetes_cluster']\n-        categories = [CheckCategories.KUBERNETES]\n+        supported_resources = (\"azurerm_kubernetes_cluster\",)\n+        categories = (CheckCategories.KUBERNETES,)\n         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n \n-    def get_inspected_key(self):\n-        return 'api_server_authorized_ip_ranges/[0]'\n+    def get_inspected_key(self) -> str:\n+        return \"api_server_authorized_ip_ranges/[0]\"\n \n-    def get_expected_value(self):\n-        return ANY_VALUE\n+    def get_expected_values(self) -> List[Any]:\n+        return [ANY_VALUE]\n \n \n check = AKSApiServerAuthorizedIpRanges()\ndiff --git a/checkov/terraform/checks/resource/base_resource_value_check.py b/checkov/terraform/checks/resource/base_resource_value_check.py\n--- a/checkov/terraform/checks/resource/base_resource_value_check.py\n+++ b/checkov/terraform/checks/resource/base_resource_value_check.py\n@@ -65,7 +65,7 @@\n             value = dpath.get(conf, inspected_key)\n             if isinstance(value, list) and len(value) == 1:\n                 value = value[0]\n-            if value is None:\n+            if value is None or (isinstance(value, list) and not value):\n                 return self.missing_block_result\n             if ANY_VALUE in expected_values and value is not None and (not isinstance(value, str) or value):\n                 # Key is found on the configuration - if it accepts any value, the check is PASSED\ndiff --git a/checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py b/checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py\n--- a/checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py\n+++ b/checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py\n@@ -1,20 +1,30 @@\n-from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n-from checkov.common.models.enums import CheckCategories\n+from typing import Any, List, Dict\n+\n from checkov.common.models.consts import ANY_VALUE\n+from checkov.common.models.enums import CheckCategories, CheckResult\n+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n \n \n class GoogleSubnetworkLoggingEnabled(BaseResourceValueCheck):\n-    def __init__(self):\n+    def __init__(self) -> None:\n         name = \"Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network\"\n         id = \"CKV_GCP_26\"\n-        supported_resources = ['google_compute_subnetwork']\n-        categories = [CheckCategories.LOGGING]\n+        supported_resources = (\"google_compute_subnetwork\",)\n+        categories = (CheckCategories.LOGGING,)\n         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n \n-    def get_inspected_key(self):\n-        return 'log_config'\n+    def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:\n+        # flow logs can't be enabled for `INTERNAL_HTTPS_LOAD_BALANCER` subnetworks\n+        purpose = conf.get(\"purpose\")\n+        if purpose and purpose[0] == \"INTERNAL_HTTPS_LOAD_BALANCER\":\n+            return CheckResult.UNKNOWN\n+\n+        return super().scan_resource_conf(conf)\n+\n+    def get_inspected_key(self) -> str:\n+        return \"log_config\"\n \n-    def get_expected_values(self):\n+    def get_expected_values(self) -> List[Any]:\n         return [ANY_VALUE]\n", "issue": "CKV_GCP_26 is not working as expected when using terraform plan output.\n**Describe the bug**\r\nCKV_GCP_26 check is not providing expected output when it is ran against terraform output json file. Check is gives the result as PASSED even if we don't have the flow logs enabled for the subnet. However if we run it against the directory where we have the .tf files then the check returns the FAILED status which is expected. \r\n\r\ncheckov version used: `2.0.236`\r\nTerraform version used: `1.0.1`\r\n\r\n**To Reproduce**\r\n1. Create a sample subnet resource in a network.tf file. \r\n```\r\nresource \"google_compute_network\" \"vpc\" {\r\n  name                    = \"test-vpc\"\r\n  auto_create_subnetworks = \"false\"\r\n  routing_mode            = \"REGIONAL\"\r\n}\r\n\r\nresource \"google_compute_subnetwork\" \"private-subnet\" {\r\n  name                     = \"test-sub\"\r\n  ip_cidr_range            = \"10.1.0.0/16\"\r\n  network                  = google_compute_network.vpc.self_link\r\n  private_ip_google_access = true\r\n}\r\n```\r\n2. terraform plan -out tf.plan\r\n3. terraform show -json tf.plan  > tf.json \r\n4. checkov -f tf.json\r\n5. Now run checkov -f network.tf\r\n\r\nBoth the commands will give conflicting results\r\n\r\n```\r\nCheck: CKV_GCP_26: \"Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network\"\r\n        PASSED for resource: google_compute_subnetwork.private-subnet\r\n        File: /tf/tfplan.json:0-0\r\n        Guide: https://docs.bridgecrew.io/docs/bc_gcp_logging_1\r\n```\r\n```\r\nCheck: CKV_GCP_26: \"Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network\"\r\n        FAILED for resource: google_compute_subnetwork.private-subnet\r\n        File: /network.tf:6-11\r\n        Guide: https://docs.bridgecrew.io/docs/bc_gcp_logging_1\r\n\r\n                6  | resource \"google_compute_subnetwork\" \"private-subnet\" {\r\n                7  |   name                     = var.private_subnet_name\r\n                8  |   ip_cidr_range            = var.private_subnet_cidr\r\n                9  |   network                  = google_compute_network.vpc.self_link\r\n                10 |   private_ip_google_access = true\r\n                11 | }\r\n```\r\n**Expected behavior**\r\nThe check should return the status as FAILED when running it against terraform plan output json\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckCategories\nfrom checkov.common.models.consts import ANY_VALUE\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n\n\nclass AKSApiServerAuthorizedIpRanges(BaseResourceValueCheck):\n    def __init__(self):\n        name = \"Ensure AKS has an API Server Authorized IP Ranges enabled\"\n        id = \"CKV_AZURE_6\"\n        supported_resources = ['azurerm_kubernetes_cluster']\n        categories = [CheckCategories.KUBERNETES]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self):\n        return 'api_server_authorized_ip_ranges/[0]'\n\n    def get_expected_value(self):\n        return ANY_VALUE\n\n\ncheck = AKSApiServerAuthorizedIpRanges()\n", "path": "checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py"}, {"content": "from abc import abstractmethod\nfrom collections.abc import Iterable\nfrom typing import List, Dict, Any\n\nimport dpath.util\nimport re\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.common.models.consts import ANY_VALUE\nfrom checkov.common.util.type_forcers import force_list\nfrom checkov.terraform.graph_builder.utils import get_referenced_vertices_in_value\nfrom checkov.terraform.parser_functions import handle_dynamic_values\nfrom checkov.terraform.parser_utils import find_var_blocks\n\n\n\nclass BaseResourceValueCheck(BaseResourceCheck):\n    def __init__(\n        self,\n        name: str,\n        id: str,\n        categories: \"Iterable[CheckCategories]\",\n        supported_resources: \"Iterable[str]\",\n        missing_block_result: CheckResult = CheckResult.FAILED,\n    ) -> None:\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n        self.missing_block_result = missing_block_result\n\n    @staticmethod\n    def _filter_key_path(path: str) -> List[str]:\n        \"\"\"\n        Filter an attribute path to contain only named attributes by dropping array indices from the path)\n        :param path: valid JSONPath of an attribute\n        :return: List of named attributes with respect to the input JSONPath order\n        \"\"\"\n        return [x for x in path.split(\"/\") if not re.search(re.compile(r\"^\\[?\\d+]?$\"), x)]\n\n    @staticmethod\n    def _is_variable_dependant(value: Any) -> bool:\n        if not isinstance(value, str):\n            return False\n        if \"${\" not in value:\n            return False\n\n        if find_var_blocks(value):\n            return True\n        return False\n\n    @staticmethod\n    def _is_nesting_key(inspected_attributes: List[str], key: List[str]) -> bool:\n        \"\"\"\n        Resolves whether a key is a subset of the inspected nesting attributes\n        :param inspected_attributes: list of nesting attributes\n        :param key: JSONPath key of an attribute\n        :return: True/False\n        \"\"\"\n        return any(x in key for x in inspected_attributes)\n\n    def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:\n        handle_dynamic_values(conf)\n        inspected_key = self.get_inspected_key()\n        expected_values = self.get_expected_values()\n        if dpath.search(conf, inspected_key) != {}:\n            # Inspected key exists\n            value = dpath.get(conf, inspected_key)\n            if isinstance(value, list) and len(value) == 1:\n                value = value[0]\n            if value is None:\n                return self.missing_block_result\n            if ANY_VALUE in expected_values and value is not None and (not isinstance(value, str) or value):\n                # Key is found on the configuration - if it accepts any value, the check is PASSED\n                return CheckResult.PASSED\n            if self._is_variable_dependant(value):\n                # If the tested attribute is variable-dependant, then result is PASSED\n                return CheckResult.PASSED\n            if value in expected_values:\n                return CheckResult.PASSED\n            if get_referenced_vertices_in_value(value=value, aliases={}, resources_types=[]):\n                # we don't provide resources_types as we want to stay provider agnostic\n                return CheckResult.UNKNOWN\n            return CheckResult.FAILED\n        else:\n            # Look for the configuration in a bottom-up fashion\n            inspected_attributes = self._filter_key_path(inspected_key)\n            for attribute in reversed(inspected_attributes):\n                for sub_key, sub_conf in dpath.search(conf, f\"**/{attribute}\", yielded=True):\n                    filtered_sub_key = self._filter_key_path(sub_key)\n                    # Only proceed with check if full path for key is similar - not partial match\n                    if inspected_attributes == filtered_sub_key:\n                        if self._is_nesting_key(inspected_attributes, filtered_sub_key):\n                            if isinstance(sub_conf, list) and len(sub_conf) == 1:\n                                sub_conf = sub_conf[0]\n                            if sub_conf in self.get_expected_values():\n                                return CheckResult.PASSED\n                            if self._is_variable_dependant(sub_conf):\n                                # If the tested attribute is variable-dependant, then result is PASSED\n                                return CheckResult.PASSED\n\n        return self.missing_block_result\n\n    @abstractmethod\n    def get_inspected_key(self) -> str:\n        \"\"\"\n        :return: JSONPath syntax path of the checked attribute\n        \"\"\"\n        raise NotImplementedError()\n\n    def get_expected_values(self) -> List[Any]:\n        \"\"\"\n        Override the method with the list of acceptable values if the check has more than one possible expected value, given\n        the inspected key\n        :return: List of expected values, defaults to a list of the expected value\n        \"\"\"\n        return [self.get_expected_value()]\n\n    def get_expected_value(self) -> Any:\n        \"\"\"\n        Returns the default expected value, governed by provider best practices\n        \"\"\"\n        return True\n\n    def get_evaluated_keys(self) -> List[str]:\n        return force_list(self.get_inspected_key())\n", "path": "checkov/terraform/checks/resource/base_resource_value_check.py"}, {"content": "from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\nfrom checkov.common.models.enums import CheckCategories\nfrom checkov.common.models.consts import ANY_VALUE\n\n\nclass GoogleSubnetworkLoggingEnabled(BaseResourceValueCheck):\n    def __init__(self):\n        name = \"Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network\"\n        id = \"CKV_GCP_26\"\n        supported_resources = ['google_compute_subnetwork']\n        categories = [CheckCategories.LOGGING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self):\n        return 'log_config'\n\n    def get_expected_values(self):\n        return [ANY_VALUE]\n\n\ncheck = GoogleSubnetworkLoggingEnabled()\n", "path": "checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py"}], "after_files": [{"content": "from typing import List, Any\n\nfrom checkov.common.models.consts import ANY_VALUE\nfrom checkov.common.models.enums import CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n\n\nclass AKSApiServerAuthorizedIpRanges(BaseResourceValueCheck):\n    def __init__(self) -> None:\n        name = \"Ensure AKS has an API Server Authorized IP Ranges enabled\"\n        id = \"CKV_AZURE_6\"\n        supported_resources = (\"azurerm_kubernetes_cluster\",)\n        categories = (CheckCategories.KUBERNETES,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self) -> str:\n        return \"api_server_authorized_ip_ranges/[0]\"\n\n    def get_expected_values(self) -> List[Any]:\n        return [ANY_VALUE]\n\n\ncheck = AKSApiServerAuthorizedIpRanges()\n", "path": "checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py"}, {"content": "from abc import abstractmethod\nfrom collections.abc import Iterable\nfrom typing import List, Dict, Any\n\nimport dpath.util\nimport re\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.common.models.consts import ANY_VALUE\nfrom checkov.common.util.type_forcers import force_list\nfrom checkov.terraform.graph_builder.utils import get_referenced_vertices_in_value\nfrom checkov.terraform.parser_functions import handle_dynamic_values\nfrom checkov.terraform.parser_utils import find_var_blocks\n\n\n\nclass BaseResourceValueCheck(BaseResourceCheck):\n    def __init__(\n        self,\n        name: str,\n        id: str,\n        categories: \"Iterable[CheckCategories]\",\n        supported_resources: \"Iterable[str]\",\n        missing_block_result: CheckResult = CheckResult.FAILED,\n    ) -> None:\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n        self.missing_block_result = missing_block_result\n\n    @staticmethod\n    def _filter_key_path(path: str) -> List[str]:\n        \"\"\"\n        Filter an attribute path to contain only named attributes by dropping array indices from the path)\n        :param path: valid JSONPath of an attribute\n        :return: List of named attributes with respect to the input JSONPath order\n        \"\"\"\n        return [x for x in path.split(\"/\") if not re.search(re.compile(r\"^\\[?\\d+]?$\"), x)]\n\n    @staticmethod\n    def _is_variable_dependant(value: Any) -> bool:\n        if not isinstance(value, str):\n            return False\n        if \"${\" not in value:\n            return False\n\n        if find_var_blocks(value):\n            return True\n        return False\n\n    @staticmethod\n    def _is_nesting_key(inspected_attributes: List[str], key: List[str]) -> bool:\n        \"\"\"\n        Resolves whether a key is a subset of the inspected nesting attributes\n        :param inspected_attributes: list of nesting attributes\n        :param key: JSONPath key of an attribute\n        :return: True/False\n        \"\"\"\n        return any(x in key for x in inspected_attributes)\n\n    def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:\n        handle_dynamic_values(conf)\n        inspected_key = self.get_inspected_key()\n        expected_values = self.get_expected_values()\n        if dpath.search(conf, inspected_key) != {}:\n            # Inspected key exists\n            value = dpath.get(conf, inspected_key)\n            if isinstance(value, list) and len(value) == 1:\n                value = value[0]\n            if value is None or (isinstance(value, list) and not value):\n                return self.missing_block_result\n            if ANY_VALUE in expected_values and value is not None and (not isinstance(value, str) or value):\n                # Key is found on the configuration - if it accepts any value, the check is PASSED\n                return CheckResult.PASSED\n            if self._is_variable_dependant(value):\n                # If the tested attribute is variable-dependant, then result is PASSED\n                return CheckResult.PASSED\n            if value in expected_values:\n                return CheckResult.PASSED\n            if get_referenced_vertices_in_value(value=value, aliases={}, resources_types=[]):\n                # we don't provide resources_types as we want to stay provider agnostic\n                return CheckResult.UNKNOWN\n            return CheckResult.FAILED\n        else:\n            # Look for the configuration in a bottom-up fashion\n            inspected_attributes = self._filter_key_path(inspected_key)\n            for attribute in reversed(inspected_attributes):\n                for sub_key, sub_conf in dpath.search(conf, f\"**/{attribute}\", yielded=True):\n                    filtered_sub_key = self._filter_key_path(sub_key)\n                    # Only proceed with check if full path for key is similar - not partial match\n                    if inspected_attributes == filtered_sub_key:\n                        if self._is_nesting_key(inspected_attributes, filtered_sub_key):\n                            if isinstance(sub_conf, list) and len(sub_conf) == 1:\n                                sub_conf = sub_conf[0]\n                            if sub_conf in self.get_expected_values():\n                                return CheckResult.PASSED\n                            if self._is_variable_dependant(sub_conf):\n                                # If the tested attribute is variable-dependant, then result is PASSED\n                                return CheckResult.PASSED\n\n        return self.missing_block_result\n\n    @abstractmethod\n    def get_inspected_key(self) -> str:\n        \"\"\"\n        :return: JSONPath syntax path of the checked attribute\n        \"\"\"\n        raise NotImplementedError()\n\n    def get_expected_values(self) -> List[Any]:\n        \"\"\"\n        Override the method with the list of acceptable values if the check has more than one possible expected value, given\n        the inspected key\n        :return: List of expected values, defaults to a list of the expected value\n        \"\"\"\n        return [self.get_expected_value()]\n\n    def get_expected_value(self) -> Any:\n        \"\"\"\n        Returns the default expected value, governed by provider best practices\n        \"\"\"\n        return True\n\n    def get_evaluated_keys(self) -> List[str]:\n        return force_list(self.get_inspected_key())\n", "path": "checkov/terraform/checks/resource/base_resource_value_check.py"}, {"content": "from typing import Any, List, Dict\n\nfrom checkov.common.models.consts import ANY_VALUE\nfrom checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n\n\nclass GoogleSubnetworkLoggingEnabled(BaseResourceValueCheck):\n    def __init__(self) -> None:\n        name = \"Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network\"\n        id = \"CKV_GCP_26\"\n        supported_resources = (\"google_compute_subnetwork\",)\n        categories = (CheckCategories.LOGGING,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:\n        # flow logs can't be enabled for `INTERNAL_HTTPS_LOAD_BALANCER` subnetworks\n        purpose = conf.get(\"purpose\")\n        if purpose and purpose[0] == \"INTERNAL_HTTPS_LOAD_BALANCER\":\n            return CheckResult.UNKNOWN\n\n        return super().scan_resource_conf(conf)\n\n    def get_inspected_key(self) -> str:\n        return \"log_config\"\n\n    def get_expected_values(self) -> List[Any]:\n        return [ANY_VALUE]\n\n\ncheck = GoogleSubnetworkLoggingEnabled()\n", "path": "checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py"}]}