prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  [CKV_AWS_358] - false alarm triggered even when GH Organisation is specified
  **Describe the issue**
  
  I guess there is false alarm triggered by this check.
  The GitHub Organisation is already included in the values of condition for the `token.actions.githubusercontent.com:sub` variable.
  
  **Examples**
  ```terraform
  data "aws_iam_policy_document" "assumerole" {
    statement {
      sid    = "DefaultAssumeRole"
      effect = "Allow"
  
      actions = [
        "sts:AssumeRoleWithWebIdentity",
      ]
  
      condition {
        test     = "StringEquals"
        variable = "token.actions.githubusercontent.com:aud"
  
        values = [
          "sts.amazonaws.com"
        ]
      }
  
      condition {
        test     = "StringLike"
        variable = "token.actions.githubusercontent.com:sub"
  
        values = [
          "repo:GitHub-Organization/${var.github_repo}:*"
        ]
      }
  
      principals {
        type = "Federated"
        identifiers = [
          "arn:aws:iam::${var.aws_account_id}:oidc-provider/token.actions.githubusercontent.com"
        ]
      }
    }
  }
  ```
  
  Checkov output:
  ```sh
  Check: CKV_AWS_358: "Ensure GitHub Actions OIDC trust policies only allows actions from a specific known organization"
  	FAILED for resource: module.ecr_repo.aws_iam_policy_document.assumerole
  	File: /../../modules/ecr-repository/data_aws_iam_policy_document_assumerole.tf:1-35
  	Calling File: /module_ecr_repository.tf:2-24
  ```
  
  **Version:**
   - Checkov Version [2.3.359]
  
  **Additional context**
  See https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services
  
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/terraform/checks/data/aws/GithubActionsOIDCTrustPolicy.py`
  Content:
  ```
  1 from typing import Dict, List, Any
  2 import re
  3 from checkov.common.models.enums import CheckResult, CheckCategories
  4 from checkov.common.util.type_forcers import force_list
  5 from checkov.terraform.checks.data.base_check import BaseDataCheck
  6 
  7 gh_repo_regex = re.compile(r'repo:[^/]+/[^/]+')
  8 
  9 
  10 class GithubActionsOIDCTrustPolicy(BaseDataCheck):
  11     def __init__(self):
  12         name = 'Ensure GitHub Actions OIDC trust policies only allows actions from a specific known organization'
  13         id = "CKV_AWS_358"
  14         supported_data = ("aws_iam_policy_document",)
  15         categories = [CheckCategories.IAM]
  16         super().__init__(name=name, id=id, categories=categories, supported_data=supported_data)
  17 
  18     def scan_data_conf(self, conf: Dict[str, List[Any]], entity_type: str) -> CheckResult:
  19         statements = force_list(conf.get('statement'))
  20         for statement in statements:
  21             found_federated_gh_oidc = False
  22             if isinstance(statement, dict):
  23                 if statement.get('principals'):
  24                     principals = statement['principals']
  25                     for principal in force_list(principals):
  26                         if 'type' not in principal and 'identifiers' not in principal:
  27                             continue
  28                         principal_type = principal['type']
  29                         principal_identifiers = principal['identifiers']
  30                         if isinstance(principal_type, list) and len(
  31                                 principal_type) and 'Federated' in principal_type and isinstance(principal_identifiers,
  32                                                                                                  list):
  33                             for identifier in principal_identifiers:
  34                                 if isinstance(identifier,
  35                                               list) and 'oidc-provider/token.actions.githubusercontent.com' in \
  36                                         identifier[0]:
  37                                     found_federated_gh_oidc = True
  38                                     break
  39                 if not found_federated_gh_oidc:
  40                     return CheckResult.PASSED
  41                 if found_federated_gh_oidc and not statement.get('condition'):
  42                     return CheckResult.FAILED
  43                 found_sub_condition_variable = False
  44                 found_sub_condition_value = False
  45                 for condition in statement.get('condition'):
  46                     condition_variables = condition.get('variable')
  47                     condition_values = condition.get('values')
  48                     if isinstance(condition_variables, list):
  49                         for condition_variable in condition_variables:
  50                             if condition_variable == 'token.actions.githubusercontent.com:sub':
  51                                 found_sub_condition_variable = True
  52                                 break
  53                         for condition_value in condition_values:
  54                             if isinstance(condition_value, list) and gh_repo_regex.search(condition_value[0]):
  55                                 found_sub_condition_value = True
  56                                 break
  57                         if found_sub_condition_value and found_sub_condition_variable:
  58                             return CheckResult.PASSED
  59                         else:
  60                             return CheckResult.FAILED
  61 
  62         return CheckResult.PASSED
  63 
  64 
  65 check = GithubActionsOIDCTrustPolicy()
  66
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/terraform/checks/data/aws/GithubActionsOIDCTrustPolicy.py b/checkov/terraform/checks/data/aws/GithubActionsOIDCTrustPolicy.py
  --- a/checkov/terraform/checks/data/aws/GithubActionsOIDCTrustPolicy.py
  +++ b/checkov/terraform/checks/data/aws/GithubActionsOIDCTrustPolicy.py
  @@ -56,8 +56,9 @@
                                   break
                           if found_sub_condition_value and found_sub_condition_variable:
                               return CheckResult.PASSED
  -                        else:
  -                            return CheckResult.FAILED
  +
  +                # Found a federated GitHub user, but no restirctions
  +                return CheckResult.FAILED
   
           return CheckResult.PASSED
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/data/aws/GithubActionsOIDCTrustPolicy.py b/checkov/terraform/checks/data/aws/GithubActionsOIDCTrustPolicy.py\n--- a/checkov/terraform/checks/data/aws/GithubActionsOIDCTrustPolicy.py\n+++ b/checkov/terraform/checks/data/aws/GithubActionsOIDCTrustPolicy.py\n@@ -56,8 +56,9 @@\n                                 break\n                         if found_sub_condition_value and found_sub_condition_variable:\n                             return CheckResult.PASSED\n-                        else:\n-                            return CheckResult.FAILED\n+\n+                # Found a federated GitHub user, but no restirctions\n+                return CheckResult.FAILED\n \n         return CheckResult.PASSED\n", "issue": "[CKV_AWS_358] - false alarm triggered even when GH Organisation is specified\n**Describe the issue**\r\n\r\nI guess there is false alarm triggered by this check.\r\nThe GitHub Organisation is already included in the values of condition for the `token.actions.githubusercontent.com:sub` variable.\r\n\r\n**Examples**\r\n```terraform\r\ndata \"aws_iam_policy_document\" \"assumerole\" {\r\n  statement {\r\n    sid    = \"DefaultAssumeRole\"\r\n    effect = \"Allow\"\r\n\r\n    actions = [\r\n      \"sts:AssumeRoleWithWebIdentity\",\r\n    ]\r\n\r\n    condition {\r\n      test     = \"StringEquals\"\r\n      variable = \"token.actions.githubusercontent.com:aud\"\r\n\r\n      values = [\r\n        \"sts.amazonaws.com\"\r\n      ]\r\n    }\r\n\r\n    condition {\r\n      test     = \"StringLike\"\r\n      variable = \"token.actions.githubusercontent.com:sub\"\r\n\r\n      values = [\r\n        \"repo:GitHub-Organization/${var.github_repo}:*\"\r\n      ]\r\n    }\r\n\r\n    principals {\r\n      type = \"Federated\"\r\n      identifiers = [\r\n        \"arn:aws:iam::${var.aws_account_id}:oidc-provider/token.actions.githubusercontent.com\"\r\n      ]\r\n    }\r\n  }\r\n}\r\n```\r\n\r\nCheckov output:\r\n```sh\r\nCheck: CKV_AWS_358: \"Ensure GitHub Actions OIDC trust policies only allows actions from a specific known organization\"\r\n\tFAILED for resource: module.ecr_repo.aws_iam_policy_document.assumerole\r\n\tFile: /../../modules/ecr-repository/data_aws_iam_policy_document_assumerole.tf:1-35\r\n\tCalling File: /module_ecr_repository.tf:2-24\r\n```\r\n\r\n**Version:**\r\n - Checkov Version [2.3.359]\r\n\r\n**Additional context**\r\nSee https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services\r\n\r\n\n", "before_files": [{"content": "from typing import Dict, List, Any\nimport re\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.common.util.type_forcers import force_list\nfrom checkov.terraform.checks.data.base_check import BaseDataCheck\n\ngh_repo_regex = re.compile(r'repo:[^/]+/[^/]+')\n\n\nclass GithubActionsOIDCTrustPolicy(BaseDataCheck):\n    def __init__(self):\n        name = 'Ensure GitHub Actions OIDC trust policies only allows actions from a specific known organization'\n        id = \"CKV_AWS_358\"\n        supported_data = (\"aws_iam_policy_document\",)\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_data=supported_data)\n\n    def scan_data_conf(self, conf: Dict[str, List[Any]], entity_type: str) -> CheckResult:\n        statements = force_list(conf.get('statement'))\n        for statement in statements:\n            found_federated_gh_oidc = False\n            if isinstance(statement, dict):\n                if statement.get('principals'):\n                    principals = statement['principals']\n                    for principal in force_list(principals):\n                        if 'type' not in principal and 'identifiers' not in principal:\n                            continue\n                        principal_type = principal['type']\n                        principal_identifiers = principal['identifiers']\n                        if isinstance(principal_type, list) and len(\n                                principal_type) and 'Federated' in principal_type and isinstance(principal_identifiers,\n                                                                                                 list):\n                            for identifier in principal_identifiers:\n                                if isinstance(identifier,\n                                              list) and 'oidc-provider/token.actions.githubusercontent.com' in \\\n                                        identifier[0]:\n                                    found_federated_gh_oidc = True\n                                    break\n                if not found_federated_gh_oidc:\n                    return CheckResult.PASSED\n                if found_federated_gh_oidc and not statement.get('condition'):\n                    return CheckResult.FAILED\n                found_sub_condition_variable = False\n                found_sub_condition_value = False\n                for condition in statement.get('condition'):\n                    condition_variables = condition.get('variable')\n                    condition_values = condition.get('values')\n                    if isinstance(condition_variables, list):\n                        for condition_variable in condition_variables:\n                            if condition_variable == 'token.actions.githubusercontent.com:sub':\n                                found_sub_condition_variable = True\n                                break\n                        for condition_value in condition_values:\n                            if isinstance(condition_value, list) and gh_repo_regex.search(condition_value[0]):\n                                found_sub_condition_value = True\n                                break\n                        if found_sub_condition_value and found_sub_condition_variable:\n                            return CheckResult.PASSED\n                        else:\n                            return CheckResult.FAILED\n\n        return CheckResult.PASSED\n\n\ncheck = GithubActionsOIDCTrustPolicy()\n", "path": "checkov/terraform/checks/data/aws/GithubActionsOIDCTrustPolicy.py"}], "after_files": [{"content": "from typing import Dict, List, Any\nimport re\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.common.util.type_forcers import force_list\nfrom checkov.terraform.checks.data.base_check import BaseDataCheck\n\ngh_repo_regex = re.compile(r'repo:[^/]+/[^/]+')\n\n\nclass GithubActionsOIDCTrustPolicy(BaseDataCheck):\n    def __init__(self):\n        name = 'Ensure GitHub Actions OIDC trust policies only allows actions from a specific known organization'\n        id = \"CKV_AWS_358\"\n        supported_data = (\"aws_iam_policy_document\",)\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_data=supported_data)\n\n    def scan_data_conf(self, conf: Dict[str, List[Any]], entity_type: str) -> CheckResult:\n        statements = force_list(conf.get('statement'))\n        for statement in statements:\n            found_federated_gh_oidc = False\n            if isinstance(statement, dict):\n                if statement.get('principals'):\n                    principals = statement['principals']\n                    for principal in force_list(principals):\n                        if 'type' not in principal and 'identifiers' not in principal:\n                            continue\n                        principal_type = principal['type']\n                        principal_identifiers = principal['identifiers']\n                        if isinstance(principal_type, list) and len(\n                                principal_type) and 'Federated' in principal_type and isinstance(principal_identifiers,\n                                                                                                 list):\n                            for identifier in principal_identifiers:\n                                if isinstance(identifier,\n                                              list) and 'oidc-provider/token.actions.githubusercontent.com' in \\\n                                        identifier[0]:\n                                    found_federated_gh_oidc = True\n                                    break\n                if not found_federated_gh_oidc:\n                    return CheckResult.PASSED\n                if found_federated_gh_oidc and not statement.get('condition'):\n                    return CheckResult.FAILED\n                found_sub_condition_variable = False\n                found_sub_condition_value = False\n                for condition in statement.get('condition'):\n                    condition_variables = condition.get('variable')\n                    condition_values = condition.get('values')\n                    if isinstance(condition_variables, list):\n                        for condition_variable in condition_variables:\n                            if condition_variable == 'token.actions.githubusercontent.com:sub':\n                                found_sub_condition_variable = True\n                                break\n                        for condition_value in condition_values:\n                            if isinstance(condition_value, list) and gh_repo_regex.search(condition_value[0]):\n                                found_sub_condition_value = True\n                                break\n                        if found_sub_condition_value and found_sub_condition_variable:\n                            return CheckResult.PASSED\n\n                # Found a federated GitHub user, but no restirctions\n                return CheckResult.FAILED\n\n        return CheckResult.PASSED\n\n\ncheck = GithubActionsOIDCTrustPolicy()\n", "path": "checkov/terraform/checks/data/aws/GithubActionsOIDCTrustPolicy.py"}]}