prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  Add new check: IAM Policies should not be attached to a user
  Attach policies only to groups or roles 
  
  https://www.terraform.io/docs/providers/aws/r/iam_user_policy.html
  https://www.terraform.io/docs/providers/aws/r/iam_user_policy_attachment.html
  users: https://www.terraform.io/docs/providers/aws/r/iam_policy_attachment.html
  
  Policies / ManagedPolicyArns: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-user.html
  Users: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html
  
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py`
  Content:
  ```
  1 from checkov.common.models.enums import CheckResult, CheckCategories
  2 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
  3 
  4 
  5 class IAMPolicyAttachedToGroupOrRoles(BaseResourceCheck):
  6     def __init__(self):
  7         name = "Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may " \
  8                "in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) "
  9         id = "CKV_AWS_40"
  10         supported_resources = ['aws_iam_user_policy_attachment', 'aws_iam_user_policy', 'aws_iam_policy_attachment']
  11         categories = [CheckCategories.IAM]
  12         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  13 
  14     def scan_resource_conf(self, conf):
  15         if 'user' in conf.keys() or 'users' in conf.keys():
  16             return CheckResult.FAILED
  17         return CheckResult.PASSED
  18 
  19 check = IAMPolicyAttachedToGroupOrRoles()
  20
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py b/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py
  --- a/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py
  +++ b/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py
  @@ -12,8 +12,9 @@
           super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
   
       def scan_resource_conf(self, conf):
  -        if 'user' in conf.keys() or 'users' in conf.keys():
  +        if 'user' in conf.keys() or ('users' in conf.keys() and len(conf['users'][0]) > 0):
               return CheckResult.FAILED
           return CheckResult.PASSED
   
  +
   check = IAMPolicyAttachedToGroupOrRoles()
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py b/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py\n--- a/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py\n+++ b/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py\n@@ -12,8 +12,9 @@\n         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n \n     def scan_resource_conf(self, conf):\n-        if 'user' in conf.keys() or 'users' in conf.keys():\n+        if 'user' in conf.keys() or ('users' in conf.keys() and len(conf['users'][0]) > 0):\n             return CheckResult.FAILED\n         return CheckResult.PASSED\n \n+\n check = IAMPolicyAttachedToGroupOrRoles()\n", "issue": "Add new check: IAM Policies should not be attached to a user\nAttach policies only to groups or roles \r\n\r\nhttps://www.terraform.io/docs/providers/aws/r/iam_user_policy.html\r\nhttps://www.terraform.io/docs/providers/aws/r/iam_user_policy_attachment.html\r\nusers: https://www.terraform.io/docs/providers/aws/r/iam_policy_attachment.html\r\n\r\nPolicies / ManagedPolicyArns: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-user.html\r\nUsers: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html\r\n\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass IAMPolicyAttachedToGroupOrRoles(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may \" \\\n               \"in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) \"\n        id = \"CKV_AWS_40\"\n        supported_resources = ['aws_iam_user_policy_attachment', 'aws_iam_user_policy', 'aws_iam_policy_attachment']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if 'user' in conf.keys() or 'users' in conf.keys():\n            return CheckResult.FAILED\n        return CheckResult.PASSED\n\ncheck = IAMPolicyAttachedToGroupOrRoles()\n", "path": "checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass IAMPolicyAttachedToGroupOrRoles(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may \" \\\n               \"in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) \"\n        id = \"CKV_AWS_40\"\n        supported_resources = ['aws_iam_user_policy_attachment', 'aws_iam_user_policy', 'aws_iam_policy_attachment']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if 'user' in conf.keys() or ('users' in conf.keys() and len(conf['users'][0]) > 0):\n            return CheckResult.FAILED\n        return CheckResult.PASSED\n\n\ncheck = IAMPolicyAttachedToGroupOrRoles()\n", "path": "checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py"}]}