diff --git a/HomebrewFormula/checkov.rb b/HomebrewFormula/checkov.rb
index 72582b9d4..6e42909e4 100644
--- a/HomebrewFormula/checkov.rb
+++ b/HomebrewFormula/checkov.rb
@@ -3,8 +3,8 @@ class Checkov < Formula
 
   desc "Shiny new formula"
   homepage "https://github.com/bridgecrewio/checkov"
-  url "https://files.pythonhosted.org/packages/41/68/47ab4baf980eb55cdfd184039b7af8456348ffa7173b5f7f532b14afa547/checkov-1.0.456.tar.gz"
-  sha256 "4b504c7bbf3cfbfec7f71cb875a5cea36af94ca190d5174aa4a9b6293f1aad59"
+  url "https://files.pythonhosted.org/packages/67/3b/e616e79e503d4d63c691467bf7be6a402beccfeafb1e047dd717e40f28e6/checkov-1.0.454.tar.gz"
+  sha256 "cea41b4f64ec5b58d69d3de1a291aaf6152a3e97cec6507417be335bbd7413ab"
 
   depends_on "python3"
 
diff --git a/checkov/kubernetes/base_registry.py b/checkov/kubernetes/base_registry.py
index 75e862b58..7e25187a5 100644
--- a/checkov/kubernetes/base_registry.py
+++ b/checkov/kubernetes/base_registry.py
@@ -23,55 +23,14 @@ class Registry(BaseCheckRegistry):
                 if check.id in [x['id'] for x in skipped_checks]:
                     skip_info = [x for x in skipped_checks if x['id'] == check.id][0]
             if check_id_allowlist:
-                # Allow list provides namespace-only allows, check-only allows, or both
-                # If namespaces not specified, all namespaces are scanned
-                # If checks not specified, all checks are scanned
-                run_check = False
-                allowed_namespaces = [string for string in check_id_allowlist if "CKV_" not in string]
-                if not any("CKV_" in check for check in check_id_allowlist):
-                    if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]:
-                        if entity_configuration["metadata"]["namespace"] in allowed_namespaces:
-                            run_check = True
-                    elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]:
-                        if entity_configuration["parent_metadata"]["namespace"] in allowed_namespaces:
-                            run_check = True
-                    else:
-                        if "default" in allowed_namespaces:
-                            run_check = True
-                else:
-                    if check.id in check_id_allowlist:
-                        if allowed_namespaces:
-                            # Check if namespace in allowed namespaces
-                            if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]:
-                                if entity_configuration["metadata"]["namespace"] in allowed_namespaces:
-                                    run_check = True
-                            elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]:
-                                if entity_configuration["parent_metadata"]["namespace"] in allowed_namespaces:
-                                    run_check = True
-                            else:
-                                if "default" in allowed_namespaces:
-                                    run_check = True
-                        else:
-                            # No namespaces to filter
-                            run_check = True
-                if run_check:
+                if check.id in check_id_allowlist:
                     self.logger.debug("Running check: {} on file {}".format(check.name, scanned_file))
 
                     result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,
                                        entity_name=entity_type, entity_type=entity_type, skip_info=skip_info)
                     results[check] = result
             elif check_id_denylist:
-                namespace_skip = False
-                if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]:
-                    if entity_configuration["metadata"]["namespace"] in check_id_denylist:
-                        namespace_skip = True
-                elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]:
-                    if entity_configuration["parent_metadata"]["namespace"] in check_id_denylist:
-                        namespace_skip = True
-                else:
-                    if "default" in check_id_denylist:
-                        namespace_skip = True
-                if check.id not in check_id_denylist and namespace_skip == False:
+                if check.id not in check_id_denylist:
                     result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,
                                        entity_name=entity_type, entity_type=entity_type, skip_info=skip_info)
                     results[check] = result
diff --git a/checkov/kubernetes/runner.py b/checkov/kubernetes/runner.py
index 69aba5a6e..736da9545 100644
--- a/checkov/kubernetes/runner.py
+++ b/checkov/kubernetes/runner.py
@@ -81,12 +81,6 @@ class Runner(BaseRunner):
                     else:
                         continue
 
-                    # Skip entity with parent (metadata["ownerReferences"]) in runtime
-                    # We will alert in runtime only
-                    if "ownerReferences" in entity_conf["metadata"] and \
-                            entity_conf["metadata"]["ownerReferences"] is not None:
-                        continue
-
                     # Append containers and initContainers to definitions list
                     for type in ["containers", "initContainers"]:
                         containers = []
@@ -133,13 +127,6 @@ class Runner(BaseRunner):
                         else:
                             continue
 
-                    # Skip entity with parent (metadata["ownerReferences"]) in runtime
-                    # We will alert in runtime only
-                    if "metadata" in entity_conf:
-                        if "ownerReferences" in entity_conf["metadata"] and \
-                                entity_conf["metadata"]["ownerReferences"] is not None:
-                            continue
-
                     # Skip Kustomization Templates (for now)
                     if entity_conf["kind"] == "Kustomization":
                         continue
@@ -213,7 +200,7 @@ def get_skipped_checks(entity_conf):
     else:
         if "metadata" in entity_conf.keys():
             metadata = entity_conf["metadata"]
-    if "annotations" in metadata.keys() and metadata["annotations"] is not None:
+    if "annotations" in metadata.keys():
         for key in metadata["annotations"].keys():
             skipped_item = {}
             if "checkov.io/skip" in key or "bridgecrew.io/skip" in key:
diff --git a/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py b/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
index 113b818f9..b964758f3 100644
--- a/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
+++ b/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
@@ -19,7 +19,7 @@ class StarActionPolicyDocument(BaseDataCheck):
         """
         key = 'statement'
         if key in conf.keys():
-            for statement in conf['statement']:
+            for statement in conf[key]:
                 if 'actions' in statement and '*' in statement['actions'][0] and statement.get('effect', ['Allow'])[0] == 'Allow':
                     return CheckResult.FAILED
         return CheckResult.PASSED
diff --git a/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py b/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py
index 75ded03ff..2f0b07734 100644
--- a/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py
+++ b/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py
@@ -17,13 +17,13 @@ class IAMAdminPolicyDocument(BaseResourceCheck):
             try:
                 policy_block = json.loads(conf['policy'][0])
                 if 'Statement' in policy_block.keys():
-                        if 'Action' in policy_block['Statement'][0] and \
-                                policy_block['Statement'][0].get('Effect', ['Allow']) == 'Allow' and \
-                                policy_block['Statement'][0]['Action'][0] == "*" and \
-                                'Resource' in policy_block['Statement'][0] and \
-                                policy_block['Statement'][0]['Resource'] == '*':
+                    for statement in policy_block['Statement']:
+                        if 'Action' in statement and \
+                                statement.get('Effect', ['Allow']) == 'Allow' and \
+                                '*' in statement.get('Action', ['']) and \
+                                '*' in statement.get('Resource', ['']):
                             return CheckResult.FAILED
-            except: # nosec
+            except:  # nosec
                 pass
         return CheckResult.PASSED
 
diff --git a/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py b/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py
index 7707d6729..7c88da617 100644
--- a/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py
+++ b/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py
@@ -17,9 +17,10 @@ class IAMStarActionPolicyDocument(BaseResourceCheck):
             try:
                 policy_block = json.loads(conf['policy'][0])
                 if 'Statement' in policy_block.keys():
-                        if 'Action' in policy_block['Statement'][0] and \
-                                policy_block['Statement'][0].get('Effect', ['Allow']) == 'Allow' and \
-                                policy_block['Statement'][0]['Action'][0] == "*":
+                    for statement in policy_block['Statement']:
+                        if 'Action' in statement and \
+                                statement.get('Effect', ['Allow']) == 'Allow' and \
+                                '*' in statement.get('Action', ['']):
                             return CheckResult.FAILED
             except: # nosec
                 pass
diff --git a/checkov/version.py b/checkov/version.py
index ed831beff..03577afd2 100644
--- a/checkov/version.py
+++ b/checkov/version.py
@@ -1,1 +1,1 @@
-version = '1.0.456'
+version = '1.0.454'
diff --git a/docs/3.Scans/resource-scans.md b/docs/3.Scans/resource-scans.md
index 91dfcf819..3c371d332 100644
--- a/docs/3.Scans/resource-scans.md
+++ b/docs/3.Scans/resource-scans.md
@@ -75,8 +75,8 @@ nav_order: 1
 |  64 | CKV_AWS_37   | resource          | aws_eks_cluster                                                              | Ensure Amazon EKS control plane logging enabled for all log types                                                                                                                                        | Terraform      |
 |  65 | CKV_AWS_38   | resource          | aws_eks_cluster                                                              | Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0                                                                                                                                            | Terraform      |
 |  66 | CKV_AWS_39   | resource          | aws_eks_cluster                                                              | Ensure Amazon EKS public endpoint disabled                                                                                                                                                               | Terraform      |
-|  67 | CKV_AWS_40   | resource          | aws_iam_user_policy_attachment                                               | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform      |
-|  68 | CKV_AWS_40   | resource          | aws_iam_user_policy                                                          | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform      |
+|  67 | CKV_AWS_40   | resource          | aws_iam_user_policy                                                          | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform      |
+|  68 | CKV_AWS_40   | resource          | aws_iam_user_policy_attachment                                               | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform      |
 |  69 | CKV_AWS_40   | resource          | aws_iam_policy_attachment                                                    | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform      |
 |  70 | CKV_AWS_40   | resource          | AWS::IAM::Policy                                                             | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Cloudformation |
 |  71 | CKV_AWS_41   | provider          | aws                                                                          | Ensure no hard coded AWS access key and and secret key exists in provider                                                                                                                                | Terraform      |
@@ -116,12 +116,12 @@ nav_order: 1
 | 105 | CKV_AWS_6    | resource          | AWS::Elasticsearch::Domain                                                   | Ensure all Elasticsearch has node-to-node encryption enabled                                                                                                                                             | Cloudformation |
 | 106 | CKV_AWS_60   | resource          | aws_iam_role                                                                 | Ensure IAM role allows only specific services or principals to assume it                                                                                                                                 | Terraform      |
 | 107 | CKV_AWS_61   | resource          | aws_iam_role                                                                 | Ensure IAM role allows only specific principals in account to assume it                                                                                                                                  | Terraform      |
-| 108 | CKV_AWS_62   | resource          | aws_iam_user_policy                                                          | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
-| 109 | CKV_AWS_62   | resource          | aws_iam_role_policy                                                          | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
+| 108 | CKV_AWS_62   | resource          | aws_iam_role_policy                                                          | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
+| 109 | CKV_AWS_62   | resource          | aws_iam_user_policy                                                          | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
 | 110 | CKV_AWS_62   | resource          | aws_iam_group_policy                                                         | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
 | 111 | CKV_AWS_62   | resource          | aws_iam_policy                                                               | Ensure IAM policies that allow full "*-*" administrative privileges are not created                                                                                                                      | Terraform      |
-| 112 | CKV_AWS_63   | resource          | aws_iam_user_policy                                                          | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
-| 113 | CKV_AWS_63   | resource          | aws_iam_role_policy                                                          | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
+| 112 | CKV_AWS_63   | resource          | aws_iam_role_policy                                                          | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
+| 113 | CKV_AWS_63   | resource          | aws_iam_user_policy                                                          | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
 | 114 | CKV_AWS_63   | resource          | aws_iam_group_policy                                                         | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
 | 115 | CKV_AWS_63   | resource          | aws_iam_policy                                                               | Ensure no IAM policies documents allow "*" as a statement's actions                                                                                                                                      | Terraform      |
 | 116 | CKV_AWS_64   | resource          | aws_redshift_cluster                                                         | Ensure all data stored in the Redshift cluster is securely encrypted at rest                                                                                                                             | Terraform      |
@@ -280,8 +280,8 @@ nav_order: 1
 | 269 | CKV_GCP_39   | resource          | google_compute_instance                                                      | Ensure Compute instances are launched with Shielded VM enabled                                                                                                                                           | Terraform      |
 | 270 | CKV_GCP_4    | resource          | google_compute_ssl_policy                                                    | Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites                                                                                                                  | Terraform      |
 | 271 | CKV_GCP_40   | resource          | google_compute_instance                                                      | Ensure that Compute instances do not have public IP addresses                                                                                                                                            | Terraform      |
-| 272 | CKV_GCP_41   | resource          | google_project_iam_member                                                    | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level                                                                                  | Terraform      |
-| 273 | CKV_GCP_41   | resource          | google_project_iam_binding                                                   | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level                                                                                  | Terraform      |
+| 272 | CKV_GCP_41   | resource          | google_project_iam_binding                                                   | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level                                                                                  | Terraform      |
+| 273 | CKV_GCP_41   | resource          | google_project_iam_member                                                    | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level                                                                                  | Terraform      |
 | 274 | CKV_GCP_42   | resource          | google_project_iam_member                                                    | Ensure that Service Account has no Admin privileges                                                                                                                                                      | Terraform      |
 | 275 | CKV_GCP_43   | resource          | google_kms_crypto_key                                                        | Ensure KMS encryption keys are rotated within a period of 90 days                                                                                                                                        | Terraform      |
 | 276 | CKV_GCP_5    | resource          | google_storage_bucket                                                        | Ensure Google storage bucket have encryption enabled                                                                                                                                                     | Terraform      |
@@ -332,7 +332,7 @@ nav_order: 1
 | 321 | CKV_K8S_2    | PodSecurityPolicy | PodSecurityPolicy                                                            | Do not admit privileged containers                                                                                                                                                                       | Kubernetes     |
 | 322 | CKV_K8S_20   | PodSecurityPolicy | containers                                                                   | Containers should not run with allowPrivilegeEscalation                                                                                                                                                  | Kubernetes     |
 | 323 | CKV_K8S_20   | PodSecurityPolicy | initContainers                                                               | Containers should not run with allowPrivilegeEscalation                                                                                                                                                  | Kubernetes     |
-| 324 | CKV_K8S_21   | PodSecurityPolicy | RoleBinding                                                                  | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 324 | CKV_K8S_21   | PodSecurityPolicy | ServiceAccount                                                               | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 325 | CKV_K8S_21   | PodSecurityPolicy | Pod                                                                          | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 326 | CKV_K8S_21   | PodSecurityPolicy | Deployment                                                                   | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 327 | CKV_K8S_21   | PodSecurityPolicy | DaemonSet                                                                    | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
@@ -343,8 +343,8 @@ nav_order: 1
 | 332 | CKV_K8S_21   | PodSecurityPolicy | CronJob                                                                      | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 333 | CKV_K8S_21   | PodSecurityPolicy | Service                                                                      | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 334 | CKV_K8S_21   | PodSecurityPolicy | Secret                                                                       | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 335 | CKV_K8S_21   | PodSecurityPolicy | ServiceAccount                                                               | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
-| 336 | CKV_K8S_21   | PodSecurityPolicy | Role                                                                         | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 335 | CKV_K8S_21   | PodSecurityPolicy | Role                                                                         | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
+| 336 | CKV_K8S_21   | PodSecurityPolicy | RoleBinding                                                                  | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 337 | CKV_K8S_21   | PodSecurityPolicy | ConfigMap                                                                    | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 338 | CKV_K8S_21   | PodSecurityPolicy | Ingress                                                                      | The default namespace should not be used                                                                                                                                                                 | Kubernetes     |
 | 339 | CKV_K8S_22   | PodSecurityPolicy | containers                                                                   | Use read-only filesystem for containers where possible                                                                                                                                                   | Kubernetes     |
diff --git a/kubernetes/requirements.txt b/kubernetes/requirements.txt
index 3051ae690..17d8961c2 100644
--- a/kubernetes/requirements.txt
+++ b/kubernetes/requirements.txt
@@ -1,1 +1,1 @@
-checkov==1.0.456
+checkov==1.0.454

Scanning IAM policy only takes First SID in json rather than looping through
**Describe the bug**
It seems when specifying more than one SID in a json, the policies do not loop through each one rather it just looks at the first one and ends. 

**To Reproduce**
Steps to reproduce the behavior:
1. Create policy with more than one SID
`{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "SqsAllow",
      "Effect": "Allow",
      "Action": [
        "sqs:GetQueueAttributes",
        "sqs:GetQueueUrl",
        "sqs:ListDeadLetterSourceQueues",
        "sqs:ListQueues",
        "sqs:ReceiveMessage",
        "sqs:SendMessage",
        "sqs:SendMessageBatch"
      ],
      "Resource": "*"
          },
    {
      "Sid": "ALL",
      "Effect": "Allow",
      "Action": [ "*"
      ],
      "Resource": ["*"]
    },`
2. Run Checkov against policy


**Expected behavior**
I would expect the scan to check each json within the policy rather than the first one



**Desktop (please complete the following information):**
 - OS: Mac
 - Checkov Version: 1.0.442



diff --git a/tests/kubernetes/checks/test_AllowPrivilegeEscalationPSP.py b/tests/kubernetes/checks/test_AllowPrivilegeEscalationPSP.py
index 2f497253b..df76aef83 100644
--- a/tests/kubernetes/checks/test_AllowPrivilegeEscalationPSP.py
+++ b/tests/kubernetes/checks/test_AllowPrivilegeEscalationPSP.py
@@ -28,7 +28,7 @@ class TestAllowPrivilegeEscalationPSP(unittest.TestCase):
         test_files_dir = current_dir + "/example_PSP"
         report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(skip_checks=[check.id]))
         for record in report.failed_checks:
-            self.assertNotEqual(record.check_id,check.id,"check should be skipped")
+            self.assertNotEquals(record.check_id,check.id,"check should be skipped")
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/tests/kubernetes/checks/test_LivenessProbe.py b/tests/kubernetes/checks/test_LivenessProbe.py
index 8d71343be..71015ff42 100644
--- a/tests/kubernetes/checks/test_LivenessProbe.py
+++ b/tests/kubernetes/checks/test_LivenessProbe.py
@@ -17,7 +17,7 @@ class TestLivenessProbe(unittest.TestCase):
         summary = report.get_summary()
 
         self.assertEqual(summary['passed'], 1)
-        self.assertEqual(summary['failed'], 1)
+        self.assertEqual(summary['failed'], 2)
         self.assertEqual(summary['skipped'], 0)
         self.assertEqual(summary['parsing_errors'], 0)
 
diff --git a/tests/kubernetes/checks/test_ReadinessProbe.py b/tests/kubernetes/checks/test_ReadinessProbe.py
index 5344b1421..0b0098fea 100644
--- a/tests/kubernetes/checks/test_ReadinessProbe.py
+++ b/tests/kubernetes/checks/test_ReadinessProbe.py
@@ -16,7 +16,7 @@ class TestReadinessProbe(unittest.TestCase):
         report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id]))
         summary = report.get_summary()
 
-        self.assertEqual(summary['passed'], 1)
+        self.assertEqual(summary['passed'], 2)
         self.assertEqual(summary['failed'], 1)
         self.assertEqual(summary['skipped'], 0)
         self.assertEqual(summary['parsing_errors'], 0)
diff --git a/tests/terraform/checks/resource/aws/test_IAMAdminPolicyDocument.py b/tests/terraform/checks/resource/aws/test_IAMAdminPolicyDocument.py
index 26d0e1e84..f130d0259 100644
--- a/tests/terraform/checks/resource/aws/test_IAMAdminPolicyDocument.py
+++ b/tests/terraform/checks/resource/aws/test_IAMAdminPolicyDocument.py
@@ -26,6 +26,17 @@ class TestAdminPolicyDocument(unittest.TestCase):
         scan_result = check.scan_entity_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
+    def test_failure_multiple_statements(self):
+        resource_conf = {'name': ['test'], 'user': ['${aws_iam_user.lb.name}'],
+                         'policy': [
+                             '{"Version":"2012-10-17","Statement":[{"Sid":"SqsAllow","Effect":"Allow","Action":['
+                             '"sqs:GetQueueAttributes","sqs:GetQueueUrl","sqs:ListDeadLetterSourceQueues",'
+                             '"sqs:ListQueues","sqs:ReceiveMessage","sqs:SendMessage","sqs:SendMessageBatch"],'
+                             '"Resource":"*"},{"Sid":"ALL","Effect":"Allow","Action":["*"],"Resource":["*"]}]} '
+                             ]}
+        scan_result = check.scan_entity_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
 
 if __name__ == '__main__':
-    unittest.main()
+    unittest.main()
\ No newline at end of file
diff --git a/tests/terraform/checks/resource/aws/test_IAMStarActionPolicyDocument.py b/tests/terraform/checks/resource/aws/test_IAMStarActionPolicyDocument.py
index 925e03f96..a8bb11419 100644
--- a/tests/terraform/checks/resource/aws/test_IAMStarActionPolicyDocument.py
+++ b/tests/terraform/checks/resource/aws/test_IAMStarActionPolicyDocument.py
@@ -26,6 +26,16 @@ class TestAdminPolicyDocument(unittest.TestCase):
         scan_result = check.scan_entity_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
+    def test_failure_multiple_statements(self):
+        resource_conf = {'name': ['test'], 'user': ['${aws_iam_user.lb.name}'],
+                         'policy': [
+                             '{"Version":"2012-10-17","Statement":[{"Sid":"SqsAllow","Effect":"Allow","Action":['
+                             '"sqs:GetQueueAttributes","sqs:GetQueueUrl","sqs:ListDeadLetterSourceQueues",'
+                             '"sqs:ListQueues","sqs:ReceiveMessage","sqs:SendMessage","sqs:SendMessageBatch"],'
+                             '"Resource":"*"},{"Sid":"ALL","Effect":"Allow","Action":["*"],"Resource":["${var.my_resource_arn}"]}]}'
+                         ]}
+        scan_result = check.scan_entity_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
 
 if __name__ == '__main__':
     unittest.main()

pip install -e .
parse_log_pytest
pytest
pytest
apt-get update apt-get install -y git
3.7
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
attrs @ file:///croot/attrs_1668696182826/work
boto3==1.12.43
botocore==1.15.49
certifi @ file:///croot/certifi_1671487769961/work/certifi
chardet==3.0.4
-e git+https://github.com/bridgecrewio/checkov.git@652f6c2c11f374d25b3e493ceaaed7b097c2dd41#egg=checkov
colorama==0.4.3
docopt==0.6.2
docutils==0.15.2
dpath==1.5.0
flit_core @ file:///opt/conda/conda-bld/flit-core_1644941570762/work/source/flit_core
gitdb==4.0.5
GitPython==3.1.7
idna==2.8
importlib-metadata @ file:///tmp/build/80754af9/importlib-metadata_1648562407465/work
iniconfig @ file:///home/linux1/recipes/ci/iniconfig_1610983019677/work
jmespath==0.10.0
junit-xml==1.8
lark-parser==0.7.8
packaging @ file:///croot/packaging_1671697413597/work
pluggy @ file:///tmp/build/80754af9/pluggy_1648042572264/work
py @ file:///opt/conda/conda-bld/py_1644396412707/work
pytest==7.1.2
python-dateutil==2.9.0.post0
python-hcl2==0.2.5
PyYAML==5.3.1
requests==2.22.0
s3transfer==0.3.7
six==1.13.0
smmap==3.0.5
tabulate==0.8.6
termcolor==1.1.0
tomli @ file:///opt/conda/conda-bld/tomli_1657175507142/work
typing_extensions @ file:///croot/typing_extensions_1669924550328/work
urllib3==1.25.7
zipp @ file:///croot/zipp_1672387121353/work

name: checkov
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - attrs=22.1.0=py37h06a4308_0
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2022.12.7=py37h06a4308_0
  - flit-core=3.6.0=pyhd3eb1b0_0
  - importlib-metadata=4.11.3=py37h06a4308_0
  - importlib_metadata=4.11.3=hd3eb1b0_0
  - iniconfig=1.1.1=pyhd3eb1b0_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - packaging=22.0=py37h06a4308_0
  - pip=22.3.1=py37h06a4308_0
  - pluggy=1.0.0=py37h06a4308_1
  - py=1.11.0=pyhd3eb1b0_0
  - pytest=7.1.2=py37h06a4308_0
  - python=3.7.16=h7a1cb2a_0
  - readline=8.2=h5eee18b_0
  - setuptools=65.6.3=py37h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - tomli=2.0.1=py37h06a4308_0
  - typing_extensions=4.4.0=py37h06a4308_0
  - wheel=0.38.4=py37h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zipp=3.11.0=py37h06a4308_0
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - boto3==1.12.43
      - botocore==1.15.49
      - chardet==3.0.4
      - colorama==0.4.3
      - docopt==0.6.2
      - docutils==0.15.2
      - dpath==1.5.0
      - gitdb==4.0.5
      - gitpython==3.1.7
      - idna==2.8
      - jmespath==0.10.0
      - junit-xml==1.8
      - lark-parser==0.7.8
      - python-dateutil==2.9.0.post0
      - python-hcl2==0.2.5
      - pyyaml==5.3.1
      - requests==2.22.0
      - s3transfer==0.3.7
      - six==1.13.0
      - smmap==3.0.5
      - tabulate==0.8.6
      - termcolor==1.1.0
      - urllib3==1.25.7
prefix: /opt/conda/envs/checkov

tests/kubernetes/checks/test_LivenessProbe.py::TestLivenessProbe::test_summary tests/kubernetes/checks/test_ReadinessProbe.py::TestReadinessProbe::test_summary tests/terraform/checks/resource/aws/test_IAMAdminPolicyDocument.py::TestAdminPolicyDocument::test_failure_multiple_statements tests/terraform/checks/resource/aws/test_IAMStarActionPolicyDocument.py::TestAdminPolicyDocument::test_failure_multiple_statements
tests/kubernetes/checks/test_AllowPrivilegeEscalationPSP.py::TestAllowPrivilegeEscalationPSP::test_summary tests/kubernetes/checks/test_AllowPrivilegeEscalationPSP.py::TestAllowPrivilegeEscalationPSP::test_summary_skip_check tests/terraform/checks/resource/aws/test_IAMAdminPolicyDocument.py::TestAdminPolicyDocument::test_failure tests/terraform/checks/resource/aws/test_IAMAdminPolicyDocument.py::TestAdminPolicyDocument::test_success tests/terraform/checks/resource/aws/test_IAMStarActionPolicyDocument.py::TestAdminPolicyDocument::test_failure tests/terraform/checks/resource/aws/test_IAMStarActionPolicyDocument.py::TestAdminPolicyDocument::test_success
checkov/terraform/checks/data/aws/StarActionPolicyDocument.py checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py docs/3.Scans/resource-scans.md checkov/kubernetes/runner.py checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py HomebrewFormula/checkov.rb checkov/version.py checkov/kubernetes/base_registry.py kubernetes/requirements.txt
checkov/terraform/checks/data/aws/StarActionPolicyDocument.py checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py docs/3.Scans/resource-scans.md checkov/kubernetes/runner.py checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py HomebrewFormula/checkov.rb checkov/version.py checkov/kubernetes/base_registry.py kubernetes/requirements.txt