False Positives for CKV_AWS_70

[blue-tornado]

CKV_AWS_70 is returning false positive when scanning terraform plan that is changing principal value from * to a specific principal.

Examples

Terraform plan example:

relevant part of terraform plan

                 ~ {
                     ~ Principal = {
                         ~ AWS = "*" -> "arn:aws:iam::1234567890:rolename"
                       }
                       # (5 unchanged attributes hidden)
                   },

checkov output:

Passed checks: 1, Failed checks: 1, Skipped checks: 0

Check: CKV_AWS_70: "Ensure S3 bucket does not allow an action with any Principal"
   FAILED for resource: module.mybucket.module.bucket[0].aws_s3_bucket.s3_bucket
   File: /plan.json:0-0

Version

• Checkov Version 2.3.140

[itariq20]

@blue-tornado Hi, can you please try to update Checkov and see if that helps, since the the latest Checkov version is 3.2.90 and you're on a much older version.