prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  Failed to run check CKV_AWS_224: TemplateAttributeError: get is invalid
  **Describe the issue**
  Error occurs when checked ECS Cluster using terraform_plan framework.
  
  **Examples**
  ```
  module "cluster" {
    source  = "terraform-aws-modules/ecs/aws"
    version = "4.1.3"
  
    cluster_name = "foo"
    fargate_capacity_providers = {
      FARGATE = {}
    }
  }
  ```
  
  **Version (please complete the following information):**
  - checkov 2.3.165
  - terraform 1.4.5
  - aws provider 4.63.0
  
  **Additional context**
  traceback:
  ```
  2023-04-18 09:53:09,676 [MainThread  ] [ERROR]  Failed to run check CKV_AWS_224 on /tfplan.json:aws_ecs_cluster.this
  Traceback (most recent call last):
    File "/usr/local/lib/python3.9/site-packages/checkov/common/checks/base_check.py", line 73, in run
      check_result["result"] = self.scan_entity_conf(entity_configuration, entity_type)
    File "/usr/local/lib/python3.9/site-packages/checkov/terraform/checks/resource/base_resource_check.py", line 43, in scan_entity_conf
      return self.scan_resource_conf(conf)
    File "/usr/local/lib/python3.9/site-packages/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py", line 21, in scan_resource_conf
      if log_conf.get('cloud_watch_encryption_enabled') == [True] or \
    File "/usr/local/lib/python3.9/site-packages/checkov/common/parsers/node.py", line 189, in __getattr__
      raise TemplateAttributeError(f'{name} is invalid')
  checkov.common.parsers.node.TemplateAttributeError: get is invalid
  ```
  
  This only occurs when using terraform_plan framework. It works without issue when using vanilla terraform framework.
  
  The plan generation is just `terraform plan -out tfplan.bin && terraform show -json tfplan.bin > tfplan.json` then running `checkof -f tfplan.json`.
  
  Here is my checkov config file in repo:
  ```
  ➜ cat .checkov.yaml     
  block-list-secret-scan: []
  compact: true
  download-external-modules: true
  evaluate-variables: true
  external-modules-download-path: .external_modules
  file:
  - tfplan.json
  framework:
  - terraform_plan
  mask: []
  quiet: true
  repo-root-for-plan-enrichment:
  - .
  secrets-history-timeout: 12h
  secrets-scan-file-type: []
  skip-check:
  - CKV2_AWS_34
  summary-position: top
  ```
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py`
  Content:
  ```
  1 from checkov.common.models.enums import CheckResult, CheckCategories
  2 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
  3 
  4 
  5 class ECSClusterLoggingEncryptedWithCMK(BaseResourceCheck):
  6     def __init__(self):
  7         name = "Ensure Cluster logging with CMK"
  8         id = "CKV_AWS_224"
  9         supported_resources = ['aws_ecs_cluster']
  10         categories = [CheckCategories.ENCRYPTION]
  11         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  12 
  13     def scan_resource_conf(self, conf):
  14         configuration = conf.get("configuration")
  15         if configuration and isinstance(configuration[0], dict) and configuration[0].get('execute_command_configuration'):
  16             command_conf = configuration[0].get('execute_command_configuration')[0]
  17             if not command_conf.get('logging') == ['NONE']:
  18                 if command_conf.get('kms_key_id'):
  19                     if command_conf.get('log_configuration'):
  20                         log_conf = command_conf.get('log_configuration')[0]
  21                         if log_conf.get('cloud_watch_encryption_enabled') == [True] or \
  22                                 log_conf.get('s3_bucket_encryption_enabled') == [True]:
  23                             return CheckResult.PASSED
  24                     return CheckResult.FAILED
  25                 else:
  26                     return CheckResult.FAILED
  27 
  28         return CheckResult.UNKNOWN
  29 
  30 
  31 check = ECSClusterLoggingEncryptedWithCMK()
  32
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py b/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py
  --- a/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py
  +++ b/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py
  @@ -1,28 +1,36 @@
  +from __future__ import annotations
  +
  +from typing import Any
  +
   from checkov.common.models.enums import CheckResult, CheckCategories
   from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
   
   
   class ECSClusterLoggingEncryptedWithCMK(BaseResourceCheck):
  -    def __init__(self):
  -        name = "Ensure Cluster logging with CMK"
  +    def __init__(self) -> None:
  +        name = "Ensure ECS Cluster logging uses CMK"
           id = "CKV_AWS_224"
  -        supported_resources = ['aws_ecs_cluster']
  -        categories = [CheckCategories.ENCRYPTION]
  +        supported_resources = ("aws_ecs_cluster",)
  +        categories = (CheckCategories.ENCRYPTION,)
           super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
   
  -    def scan_resource_conf(self, conf):
  +    def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:
           configuration = conf.get("configuration")
  -        if configuration and isinstance(configuration[0], dict) and configuration[0].get('execute_command_configuration'):
  -            command_conf = configuration[0].get('execute_command_configuration')[0]
  -            if not command_conf.get('logging') == ['NONE']:
  -                if command_conf.get('kms_key_id'):
  -                    if command_conf.get('log_configuration'):
  -                        log_conf = command_conf.get('log_configuration')[0]
  -                        if log_conf.get('cloud_watch_encryption_enabled') == [True] or \
  -                                log_conf.get('s3_bucket_encryption_enabled') == [True]:
  -                            return CheckResult.PASSED
  -                    return CheckResult.FAILED
  -                else:
  +        if configuration and isinstance(configuration, list) and isinstance(configuration[0], dict):
  +            execute_command = configuration[0].get("execute_command_configuration")
  +            if execute_command and isinstance(execute_command, list):
  +                execute_command = execute_command[0]
  +                if isinstance(execute_command, dict) and not execute_command.get("logging") == ["NONE"]:
  +                    if execute_command.get("kms_key_id"):
  +                        log_conf = execute_command.get("log_configuration")
  +                        if log_conf and isinstance(log_conf, list):
  +                            log_conf = log_conf[0]
  +                            if isinstance(log_conf, dict) and (
  +                                log_conf.get("cloud_watch_encryption_enabled") == [True]
  +                                or log_conf.get("s3_bucket_encryption_enabled") == [True]
  +                            ):
  +                                return CheckResult.PASSED
  +
                       return CheckResult.FAILED
   
           return CheckResult.UNKNOWN
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py b/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py\n--- a/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py\n+++ b/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py\n@@ -1,28 +1,36 @@\n+from __future__ import annotations\n+\n+from typing import Any\n+\n from checkov.common.models.enums import CheckResult, CheckCategories\n from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n \n \n class ECSClusterLoggingEncryptedWithCMK(BaseResourceCheck):\n-    def __init__(self):\n-        name = \"Ensure Cluster logging with CMK\"\n+    def __init__(self) -> None:\n+        name = \"Ensure ECS Cluster logging uses CMK\"\n         id = \"CKV_AWS_224\"\n-        supported_resources = ['aws_ecs_cluster']\n-        categories = [CheckCategories.ENCRYPTION]\n+        supported_resources = (\"aws_ecs_cluster\",)\n+        categories = (CheckCategories.ENCRYPTION,)\n         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n \n-    def scan_resource_conf(self, conf):\n+    def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:\n         configuration = conf.get(\"configuration\")\n-        if configuration and isinstance(configuration[0], dict) and configuration[0].get('execute_command_configuration'):\n-            command_conf = configuration[0].get('execute_command_configuration')[0]\n-            if not command_conf.get('logging') == ['NONE']:\n-                if command_conf.get('kms_key_id'):\n-                    if command_conf.get('log_configuration'):\n-                        log_conf = command_conf.get('log_configuration')[0]\n-                        if log_conf.get('cloud_watch_encryption_enabled') == [True] or \\\n-                                log_conf.get('s3_bucket_encryption_enabled') == [True]:\n-                            return CheckResult.PASSED\n-                    return CheckResult.FAILED\n-                else:\n+        if configuration and isinstance(configuration, list) and isinstance(configuration[0], dict):\n+            execute_command = configuration[0].get(\"execute_command_configuration\")\n+            if execute_command and isinstance(execute_command, list):\n+                execute_command = execute_command[0]\n+                if isinstance(execute_command, dict) and not execute_command.get(\"logging\") == [\"NONE\"]:\n+                    if execute_command.get(\"kms_key_id\"):\n+                        log_conf = execute_command.get(\"log_configuration\")\n+                        if log_conf and isinstance(log_conf, list):\n+                            log_conf = log_conf[0]\n+                            if isinstance(log_conf, dict) and (\n+                                log_conf.get(\"cloud_watch_encryption_enabled\") == [True]\n+                                or log_conf.get(\"s3_bucket_encryption_enabled\") == [True]\n+                            ):\n+                                return CheckResult.PASSED\n+\n                     return CheckResult.FAILED\n \n         return CheckResult.UNKNOWN\n", "issue": "Failed to run check CKV_AWS_224: TemplateAttributeError: get is invalid\n**Describe the issue**\r\nError occurs when checked ECS Cluster using terraform_plan framework.\r\n\r\n**Examples**\r\n```\r\nmodule \"cluster\" {\r\n  source  = \"terraform-aws-modules/ecs/aws\"\r\n  version = \"4.1.3\"\r\n\r\n  cluster_name = \"foo\"\r\n  fargate_capacity_providers = {\r\n    FARGATE = {}\r\n  }\r\n}\r\n```\r\n\r\n**Version (please complete the following information):**\r\n- checkov 2.3.165\r\n- terraform 1.4.5\r\n- aws provider 4.63.0\r\n\r\n**Additional context**\r\ntraceback:\r\n```\r\n2023-04-18 09:53:09,676 [MainThread  ] [ERROR]  Failed to run check CKV_AWS_224 on /tfplan.json:aws_ecs_cluster.this\r\nTraceback (most recent call last):\r\n  File \"/usr/local/lib/python3.9/site-packages/checkov/common/checks/base_check.py\", line 73, in run\r\n    check_result[\"result\"] = self.scan_entity_conf(entity_configuration, entity_type)\r\n  File \"/usr/local/lib/python3.9/site-packages/checkov/terraform/checks/resource/base_resource_check.py\", line 43, in scan_entity_conf\r\n    return self.scan_resource_conf(conf)\r\n  File \"/usr/local/lib/python3.9/site-packages/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py\", line 21, in scan_resource_conf\r\n    if log_conf.get('cloud_watch_encryption_enabled') == [True] or \\\r\n  File \"/usr/local/lib/python3.9/site-packages/checkov/common/parsers/node.py\", line 189, in __getattr__\r\n    raise TemplateAttributeError(f'{name} is invalid')\r\ncheckov.common.parsers.node.TemplateAttributeError: get is invalid\r\n```\r\n\r\nThis only occurs when using terraform_plan framework. It works without issue when using vanilla terraform framework.\r\n\r\nThe plan generation is just `terraform plan -out tfplan.bin && terraform show -json tfplan.bin > tfplan.json` then running `checkof -f tfplan.json`.\r\n\r\nHere is my checkov config file in repo:\r\n```\r\n\u279c cat .checkov.yaml     \r\nblock-list-secret-scan: []\r\ncompact: true\r\ndownload-external-modules: true\r\nevaluate-variables: true\r\nexternal-modules-download-path: .external_modules\r\nfile:\r\n- tfplan.json\r\nframework:\r\n- terraform_plan\r\nmask: []\r\nquiet: true\r\nrepo-root-for-plan-enrichment:\r\n- .\r\nsecrets-history-timeout: 12h\r\nsecrets-scan-file-type: []\r\nskip-check:\r\n- CKV2_AWS_34\r\nsummary-position: top\r\n```\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass ECSClusterLoggingEncryptedWithCMK(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure Cluster logging with CMK\"\n        id = \"CKV_AWS_224\"\n        supported_resources = ['aws_ecs_cluster']\n        categories = [CheckCategories.ENCRYPTION]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        configuration = conf.get(\"configuration\")\n        if configuration and isinstance(configuration[0], dict) and configuration[0].get('execute_command_configuration'):\n            command_conf = configuration[0].get('execute_command_configuration')[0]\n            if not command_conf.get('logging') == ['NONE']:\n                if command_conf.get('kms_key_id'):\n                    if command_conf.get('log_configuration'):\n                        log_conf = command_conf.get('log_configuration')[0]\n                        if log_conf.get('cloud_watch_encryption_enabled') == [True] or \\\n                                log_conf.get('s3_bucket_encryption_enabled') == [True]:\n                            return CheckResult.PASSED\n                    return CheckResult.FAILED\n                else:\n                    return CheckResult.FAILED\n\n        return CheckResult.UNKNOWN\n\n\ncheck = ECSClusterLoggingEncryptedWithCMK()\n", "path": "checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py"}], "after_files": [{"content": "from __future__ import annotations\n\nfrom typing import Any\n\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass ECSClusterLoggingEncryptedWithCMK(BaseResourceCheck):\n    def __init__(self) -> None:\n        name = \"Ensure ECS Cluster logging uses CMK\"\n        id = \"CKV_AWS_224\"\n        supported_resources = (\"aws_ecs_cluster\",)\n        categories = (CheckCategories.ENCRYPTION,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:\n        configuration = conf.get(\"configuration\")\n        if configuration and isinstance(configuration, list) and isinstance(configuration[0], dict):\n            execute_command = configuration[0].get(\"execute_command_configuration\")\n            if execute_command and isinstance(execute_command, list):\n                execute_command = execute_command[0]\n                if isinstance(execute_command, dict) and not execute_command.get(\"logging\") == [\"NONE\"]:\n                    if execute_command.get(\"kms_key_id\"):\n                        log_conf = execute_command.get(\"log_configuration\")\n                        if log_conf and isinstance(log_conf, list):\n                            log_conf = log_conf[0]\n                            if isinstance(log_conf, dict) and (\n                                log_conf.get(\"cloud_watch_encryption_enabled\") == [True]\n                                or log_conf.get(\"s3_bucket_encryption_enabled\") == [True]\n                            ):\n                                return CheckResult.PASSED\n\n                    return CheckResult.FAILED\n\n        return CheckResult.UNKNOWN\n\n\ncheck = ECSClusterLoggingEncryptedWithCMK()\n", "path": "checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py"}]}