prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  Scanning IAM Role Public Access
  Describe the bug
  It seems when specifying more than one  json, the policy does not scan all principals, rather it looks at the first one. 
  
  To Reproduce
  Steps to reproduce the behavior:
  
  Create policy with more than one SID
  `resource "aws_iam_role" "lambdaRole" {
    name               = "test-role"
    assume_role_policy = <<EOF
  {
    "Version": "2012-10-17",
    "Statement": [
        {
          "Action": "sts:AssumeRole",
          "Principal" : {"Service": "lambda.amazonaws.com"},
          "Effect": "Allow"
        },
        {
          "Action": "sts:AssumeRole",
          "Principal" : {"AWS": "*"},
          "Effect": "Allow"
        },
        {
          "Action": "sts:AssumeRole",
          "Principal" : {"Service": "events.amazonaws.com"},
          "Effect": "Allow"
        },
    ]
  }
  
  EOF
  }`
  Run Checkov against policy
  Expected behavior
  I would expect the scan to check each json within the policy rather than the first one
  
  Desktop (please complete the following information):
  
  OS: Mac
  Checkov Version: 1.0.459
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py`
  Content:
  ```
  1 from checkov.common.models.enums import CheckResult, CheckCategories
  2 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
  3 import json
  4 
  5 
  6 class IAMRoleAllowsPublicAssume(BaseResourceCheck):
  7 
  8     def __init__(self):
  9         name = "Ensure IAM role allows only specific services or principals to assume it"
  10         id = "CKV_AWS_60"
  11         supported_resources = ['aws_iam_role']
  12         categories = [CheckCategories.IAM]
  13         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  14 
  15     def scan_resource_conf(self, conf):
  16         if isinstance(conf['assume_role_policy'][0], str):
  17             try:
  18                 assume_role_block = json.loads(conf['assume_role_policy'][0])
  19                 if 'Statement' in assume_role_block.keys():
  20                     if 'Principal' in assume_role_block['Statement'][0]:
  21                         if 'AWS' in assume_role_block['Statement'][0]['Principal']:
  22                             if assume_role_block['Statement'][0]['Principal']['AWS'] == '*':
  23                                     return CheckResult.FAILED
  24             except: # nosec
  25                 pass
  26         return CheckResult.PASSED
  27 
  28 
  29 check = IAMRoleAllowsPublicAssume()
  30
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py b/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py
  --- a/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py
  +++ b/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py
  @@ -17,10 +17,10 @@
               try:
                   assume_role_block = json.loads(conf['assume_role_policy'][0])
                   if 'Statement' in assume_role_block.keys():
  -                    if 'Principal' in assume_role_block['Statement'][0]:
  -                        if 'AWS' in assume_role_block['Statement'][0]['Principal']:
  -                            if assume_role_block['Statement'][0]['Principal']['AWS'] == '*':
  -                                    return CheckResult.FAILED
  +                    for statement in assume_role_block['Statement']:
  +                        if 'AWS' in statement['Principal']:
  +                            if statement['Principal']['AWS'] == '*':
  +                                return CheckResult.FAILED
               except: # nosec
                   pass
           return CheckResult.PASSED
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py b/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py\n--- a/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py\n+++ b/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py\n@@ -17,10 +17,10 @@\n             try:\n                 assume_role_block = json.loads(conf['assume_role_policy'][0])\n                 if 'Statement' in assume_role_block.keys():\n-                    if 'Principal' in assume_role_block['Statement'][0]:\n-                        if 'AWS' in assume_role_block['Statement'][0]['Principal']:\n-                            if assume_role_block['Statement'][0]['Principal']['AWS'] == '*':\n-                                    return CheckResult.FAILED\n+                    for statement in assume_role_block['Statement']:\n+                        if 'AWS' in statement['Principal']:\n+                            if statement['Principal']['AWS'] == '*':\n+                                return CheckResult.FAILED\n             except: # nosec\n                 pass\n         return CheckResult.PASSED\n", "issue": "Scanning IAM Role Public Access\nDescribe the bug\r\nIt seems when specifying more than one  json, the policy does not scan all principals, rather it looks at the first one. \r\n\r\nTo Reproduce\r\nSteps to reproduce the behavior:\r\n\r\nCreate policy with more than one SID\r\n`resource \"aws_iam_role\" \"lambdaRole\" {\r\n  name               = \"test-role\"\r\n  assume_role_policy = <<EOF\r\n{\r\n  \"Version\": \"2012-10-17\",\r\n  \"Statement\": [\r\n      {\r\n        \"Action\": \"sts:AssumeRole\",\r\n        \"Principal\" : {\"Service\": \"lambda.amazonaws.com\"},\r\n        \"Effect\": \"Allow\"\r\n      },\r\n      {\r\n        \"Action\": \"sts:AssumeRole\",\r\n        \"Principal\" : {\"AWS\": \"*\"},\r\n        \"Effect\": \"Allow\"\r\n      },\r\n      {\r\n        \"Action\": \"sts:AssumeRole\",\r\n        \"Principal\" : {\"Service\": \"events.amazonaws.com\"},\r\n        \"Effect\": \"Allow\"\r\n      },\r\n  ]\r\n}\r\n\r\nEOF\r\n}`\r\nRun Checkov against policy\r\nExpected behavior\r\nI would expect the scan to check each json within the policy rather than the first one\r\n\r\nDesktop (please complete the following information):\r\n\r\nOS: Mac\r\nCheckov Version: 1.0.459\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nimport json\n\n\nclass IAMRoleAllowsPublicAssume(BaseResourceCheck):\n\n    def __init__(self):\n        name = \"Ensure IAM role allows only specific services or principals to assume it\"\n        id = \"CKV_AWS_60\"\n        supported_resources = ['aws_iam_role']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if isinstance(conf['assume_role_policy'][0], str):\n            try:\n                assume_role_block = json.loads(conf['assume_role_policy'][0])\n                if 'Statement' in assume_role_block.keys():\n                    if 'Principal' in assume_role_block['Statement'][0]:\n                        if 'AWS' in assume_role_block['Statement'][0]['Principal']:\n                            if assume_role_block['Statement'][0]['Principal']['AWS'] == '*':\n                                    return CheckResult.FAILED\n            except: # nosec\n                pass\n        return CheckResult.PASSED\n\n\ncheck = IAMRoleAllowsPublicAssume()\n", "path": "checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nimport json\n\n\nclass IAMRoleAllowsPublicAssume(BaseResourceCheck):\n\n    def __init__(self):\n        name = \"Ensure IAM role allows only specific services or principals to assume it\"\n        id = \"CKV_AWS_60\"\n        supported_resources = ['aws_iam_role']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if isinstance(conf['assume_role_policy'][0], str):\n            try:\n                assume_role_block = json.loads(conf['assume_role_policy'][0])\n                if 'Statement' in assume_role_block.keys():\n                    for statement in assume_role_block['Statement']:\n                        if 'AWS' in statement['Principal']:\n                            if statement['Principal']['AWS'] == '*':\n                                return CheckResult.FAILED\n            except: # nosec\n                pass\n        return CheckResult.PASSED\n\n\ncheck = IAMRoleAllowsPublicAssume()\n", "path": "checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py"}]}