Replace /[0]/[0] with manual yet consistent check for attribute
+from typing import Any, Dict, List
+
from checkov.common.models.enums import CheckCategories, CheckResult
from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
-from typing import Any
-from checkov.common.models.consts import ANY_VALUE
class DBInstanceLogging(BaseResourceValueCheck):
@@ -13,10 +13,11 @@ class DBInstanceLogging(BaseResourceValueCheck):
super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
def get_inspected_key(self) -> str:
- return "enabled_cloudwatch_logs_exports/[0]/[0]"
+ return "enabled_cloudwatch_logs_exports/[0]"
- def get_expected_value(self) -> Any:
- return ANY_VALUE
+ def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:
+ logs_exports = conf.get('enabled_cloudwatch_logs_exports', [[]])[0]
+ return CheckResult.PASSED if logs_exports else CheckResult.FAILED
check = DBInstanceLogging()
