We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Policy Document Check Bugs
**Describe the bug**
StarActionPolicyDocument  has issues with SCPs that use not_action.

Stack trace:
```
 Traceback (most recent call last):
   File "/usr/local/bin/checkov", line 5, in <module>
     run()
   File "/usr/local/lib/python3.8/site-packages/checkov/main.py", line 47, in run
     scan_reports = runner_registry.run(root_folder, external_checks_dir=args.external_checks_dir, files=file)
   File "/usr/local/lib/python3.8/site-packages/checkov/common/runners/runner_registry.py", line 20, in run
     scan_report = runner.run(root_folder, external_checks_dir=external_checks_dir, files=files)
   File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 38, in run
     self.check_tf_definition(report, root_folder, tf_definitions)
   File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 66, in check_tf_definition
     self.run_block(definition[1][block_type], definitions_context, full_file_path, report, scanned_file,
   File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 88, in run_block
     results = registry.scan(scanned_file, entity,
   File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check_registry.py", line 48, in scan
     result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,
   File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check.py", line 44, in run
     raise e
   File "/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check.py", line 33, in run
     check_result['result'] = self.scan_entity_conf(entity_configuration)
   File "/usr/local/lib/python3.8/site-packages/checkov/terraform/checks/data/base_check.py", line 19, in scan_entity_conf
     return self.scan_data_conf(conf)
   File "/usr/local/lib/python3.8/site-packages/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py", line 23, in scan_data_conf
     if '*' in statement['actions'][0] and statement['effect'][0] == "Allow":
 KeyError: 'actions'
```

**To Reproduce**
Attempt to scan a SCP policy document with a statement like:
```
  statement {
    sid    = "NoIAMUsers"
    effect = "Deny"
    not_actions = [
      "iam:Get*",
      "iam:List*",
      "iam:Describe*",
    ]
    resources = [
      "arn:aws:iam::*:user/*",
    ]
  }
```

**Expected behavior**
The checks should probably ignore statements that use not_actions.

**Screenshots**
N/A

**Desktop (please complete the following information):**
 - Docker (GitLab CI)
 - Checkov Version: 1.0.230 

**Additional context**
Add any other context about the problem here (e.g. code snippets).


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/terraform/checks/data/aws/AdminPolicyDocument.py`
Content:
```
1 from checkov.terraform.checks.data.base_check import BaseDataCheck
2 from checkov.common.models.enums import CheckResult, CheckCategories
3 
4 
5 class AdminPolicyDocument(BaseDataCheck):
6     def __init__(self):
7         name = "Ensure IAM policies that allow full \"*-*\" administrative privileges are not created"
8         id = "CKV_AWS_1"
9         supported_data = ['aws_iam_policy_document']
10         categories = [CheckCategories.IAM]
11         super().__init__(name=name, id=id, categories=categories, supported_data=supported_data)
12 
13     def scan_data_conf(self, conf):
14         """
15             validates iam policy document
16             https://learn.hashicorp.com/terraform/aws/iam-policy
17         :param conf: aws_kms_key configuration
18         :return: <CheckResult>
19         """
20         key = 'statement'
21         if key in conf.keys():
22             for statement in conf[key]:
23                 if statement['effect'][0] == 'Allow' and '*' in statement['actions'][0] and '*' in statement['resources'][0]:
24                     return CheckResult.FAILED
25         return CheckResult.PASSED
26 
27 
28 check = AdminPolicyDocument()
29
```

Path: `checkov/terraform/checks/data/aws/StarActionPolicyDocument.py`
Content:
```
1 from checkov.terraform.checks.data.base_check import BaseDataCheck
2 from checkov.common.models.enums import CheckResult, CheckCategories
3 
4 
5 class StarActionPolicyDocument(BaseDataCheck):
6     def __init__(self):
7         name = "Ensure no IAM policies documents allow \"*\" as a statement's actions"
8         id = "CKV_AWS_49"
9         supported_data = ['aws_iam_policy_document']
10         categories = [CheckCategories.IAM]
11         super().__init__(name=name, id=id, categories=categories, supported_data=supported_data)
12 
13     def scan_data_conf(self, conf):
14         """
15             validates iam policy document
16             https://learn.hashicorp.com/terraform/aws/iam-policy
17         :param conf: aws_kms_key configuration
18         :return: <CheckResult>
19         """
20         key = 'statement'
21         if key in conf.keys():
22             for statement in conf['statement']:
23                 if '*' in statement['actions'][0] and statement['effect'][0] == "Allow":
24                     return CheckResult.FAILED
25         return CheckResult.PASSED
26 
27 
28 check = StarActionPolicyDocument()
29
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/terraform/checks/data/aws/AdminPolicyDocument.py b/checkov/terraform/checks/data/aws/AdminPolicyDocument.py
--- a/checkov/terraform/checks/data/aws/AdminPolicyDocument.py
+++ b/checkov/terraform/checks/data/aws/AdminPolicyDocument.py
@@ -20,7 +20,7 @@
         key = 'statement'
         if key in conf.keys():
             for statement in conf[key]:
-                if statement['effect'][0] == 'Allow' and '*' in statement['actions'][0] and '*' in statement['resources'][0]:
+                if 'actions' in statement and statement['effect'][0] == 'Allow' and '*' in statement['actions'][0] and '*' in statement['resources'][0]:
                     return CheckResult.FAILED
         return CheckResult.PASSED
 
diff --git a/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py b/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
--- a/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
+++ b/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
@@ -20,7 +20,7 @@
         key = 'statement'
         if key in conf.keys():
             for statement in conf['statement']:
-                if '*' in statement['actions'][0] and statement['effect'][0] == "Allow":
+                if 'actions' in statement and '*' in statement['actions'][0] and statement['effect'][0] == "Allow":
                     return CheckResult.FAILED
         return CheckResult.PASSED

{"golden_diff": "diff --git a/checkov/terraform/checks/data/aws/AdminPolicyDocument.py b/checkov/terraform/checks/data/aws/AdminPolicyDocument.py\n--- a/checkov/terraform/checks/data/aws/AdminPolicyDocument.py\n+++ b/checkov/terraform/checks/data/aws/AdminPolicyDocument.py\n@@ -20,7 +20,7 @@\n         key = 'statement'\n         if key in conf.keys():\n             for statement in conf[key]:\n-                if statement['effect'][0] == 'Allow' and '*' in statement['actions'][0] and '*' in statement['resources'][0]:\n+                if 'actions' in statement and statement['effect'][0] == 'Allow' and '*' in statement['actions'][0] and '*' in statement['resources'][0]:\n                     return CheckResult.FAILED\n         return CheckResult.PASSED\n \ndiff --git a/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py b/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py\n--- a/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py\n+++ b/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py\n@@ -20,7 +20,7 @@\n         key = 'statement'\n         if key in conf.keys():\n             for statement in conf['statement']:\n-                if '*' in statement['actions'][0] and statement['effect'][0] == \"Allow\":\n+                if 'actions' in statement and '*' in statement['actions'][0] and statement['effect'][0] == \"Allow\":\n                     return CheckResult.FAILED\n         return CheckResult.PASSED\n", "issue": "Policy Document Check Bugs\n**Describe the bug**\r\nStarActionPolicyDocument  has issues with SCPs that use not_action.\r\n\r\nStack trace:\r\n```\r\n Traceback (most recent call last):\r\n   File \"/usr/local/bin/checkov\", line 5, in <module>\r\n     run()\r\n   File \"/usr/local/lib/python3.8/site-packages/checkov/main.py\", line 47, in run\r\n     scan_reports = runner_registry.run(root_folder, external_checks_dir=args.external_checks_dir, files=file)\r\n   File \"/usr/local/lib/python3.8/site-packages/checkov/common/runners/runner_registry.py\", line 20, in run\r\n     scan_report = runner.run(root_folder, external_checks_dir=external_checks_dir, files=files)\r\n   File \"/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py\", line 38, in run\r\n     self.check_tf_definition(report, root_folder, tf_definitions)\r\n   File \"/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py\", line 66, in check_tf_definition\r\n     self.run_block(definition[1][block_type], definitions_context, full_file_path, report, scanned_file,\r\n   File \"/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py\", line 88, in run_block\r\n     results = registry.scan(scanned_file, entity,\r\n   File \"/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check_registry.py\", line 48, in scan\r\n     result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,\r\n   File \"/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check.py\", line 44, in run\r\n     raise e\r\n   File \"/usr/local/lib/python3.8/site-packages/checkov/common/checks/base_check.py\", line 33, in run\r\n     check_result['result'] = self.scan_entity_conf(entity_configuration)\r\n   File \"/usr/local/lib/python3.8/site-packages/checkov/terraform/checks/data/base_check.py\", line 19, in scan_entity_conf\r\n     return self.scan_data_conf(conf)\r\n   File \"/usr/local/lib/python3.8/site-packages/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py\", line 23, in scan_data_conf\r\n     if '*' in statement['actions'][0] and statement['effect'][0] == \"Allow\":\r\n KeyError: 'actions'\r\n```\r\n\r\n**To Reproduce**\r\nAttempt to scan a SCP policy document with a statement like:\r\n```\r\n  statement {\r\n    sid    = \"NoIAMUsers\"\r\n    effect = \"Deny\"\r\n    not_actions = [\r\n      \"iam:Get*\",\r\n      \"iam:List*\",\r\n      \"iam:Describe*\",\r\n    ]\r\n    resources = [\r\n      \"arn:aws:iam::*:user/*\",\r\n    ]\r\n  }\r\n```\r\n\r\n**Expected behavior**\r\nThe checks should probably ignore statements that use not_actions.\r\n\r\n**Screenshots**\r\nN/A\r\n\r\n**Desktop (please complete the following information):**\r\n - Docker (GitLab CI)\r\n - Checkov Version: 1.0.230 \r\n\r\n**Additional context**\r\nAdd any other context about the problem here (e.g. code snippets).\r\n\n", "before_files": [{"content": "from checkov.terraform.checks.data.base_check import BaseDataCheck\nfrom checkov.common.models.enums import CheckResult, CheckCategories\n\n\nclass AdminPolicyDocument(BaseDataCheck):\n    def __init__(self):\n        name = \"Ensure IAM policies that allow full \\\"*-*\\\" administrative privileges are not created\"\n        id = \"CKV_AWS_1\"\n        supported_data = ['aws_iam_policy_document']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_data=supported_data)\n\n    def scan_data_conf(self, conf):\n        \"\"\"\n            validates iam policy document\n            https://learn.hashicorp.com/terraform/aws/iam-policy\n        :param conf: aws_kms_key configuration\n        :return: <CheckResult>\n        \"\"\"\n        key = 'statement'\n        if key in conf.keys():\n            for statement in conf[key]:\n                if statement['effect'][0] == 'Allow' and '*' in statement['actions'][0] and '*' in statement['resources'][0]:\n                    return CheckResult.FAILED\n        return CheckResult.PASSED\n\n\ncheck = AdminPolicyDocument()\n", "path": "checkov/terraform/checks/data/aws/AdminPolicyDocument.py"}, {"content": "from checkov.terraform.checks.data.base_check import BaseDataCheck\nfrom checkov.common.models.enums import CheckResult, CheckCategories\n\n\nclass StarActionPolicyDocument(BaseDataCheck):\n    def __init__(self):\n        name = \"Ensure no IAM policies documents allow \\\"*\\\" as a statement's actions\"\n        id = \"CKV_AWS_49\"\n        supported_data = ['aws_iam_policy_document']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_data=supported_data)\n\n    def scan_data_conf(self, conf):\n        \"\"\"\n            validates iam policy document\n            https://learn.hashicorp.com/terraform/aws/iam-policy\n        :param conf: aws_kms_key configuration\n        :return: <CheckResult>\n        \"\"\"\n        key = 'statement'\n        if key in conf.keys():\n            for statement in conf['statement']:\n                if '*' in statement['actions'][0] and statement['effect'][0] == \"Allow\":\n                    return CheckResult.FAILED\n        return CheckResult.PASSED\n\n\ncheck = StarActionPolicyDocument()\n", "path": "checkov/terraform/checks/data/aws/StarActionPolicyDocument.py"}], "after_files": [{"content": "from checkov.terraform.checks.data.base_check import BaseDataCheck\nfrom checkov.common.models.enums import CheckResult, CheckCategories\n\n\nclass AdminPolicyDocument(BaseDataCheck):\n    def __init__(self):\n        name = \"Ensure IAM policies that allow full \\\"*-*\\\" administrative privileges are not created\"\n        id = \"CKV_AWS_1\"\n        supported_data = ['aws_iam_policy_document']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_data=supported_data)\n\n    def scan_data_conf(self, conf):\n        \"\"\"\n            validates iam policy document\n            https://learn.hashicorp.com/terraform/aws/iam-policy\n        :param conf: aws_kms_key configuration\n        :return: <CheckResult>\n        \"\"\"\n        key = 'statement'\n        if key in conf.keys():\n            for statement in conf[key]:\n                if 'actions' in statement and statement['effect'][0] == 'Allow' and '*' in statement['actions'][0] and '*' in statement['resources'][0]:\n                    return CheckResult.FAILED\n        return CheckResult.PASSED\n\n\ncheck = AdminPolicyDocument()\n", "path": "checkov/terraform/checks/data/aws/AdminPolicyDocument.py"}, {"content": "from checkov.terraform.checks.data.base_check import BaseDataCheck\nfrom checkov.common.models.enums import CheckResult, CheckCategories\n\n\nclass StarActionPolicyDocument(BaseDataCheck):\n    def __init__(self):\n        name = \"Ensure no IAM policies documents allow \\\"*\\\" as a statement's actions\"\n        id = \"CKV_AWS_49\"\n        supported_data = ['aws_iam_policy_document']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_data=supported_data)\n\n    def scan_data_conf(self, conf):\n        \"\"\"\n            validates iam policy document\n            https://learn.hashicorp.com/terraform/aws/iam-policy\n        :param conf: aws_kms_key configuration\n        :return: <CheckResult>\n        \"\"\"\n        key = 'statement'\n        if key in conf.keys():\n            for statement in conf['statement']:\n                if 'actions' in statement and '*' in statement['actions'][0] and statement['effect'][0] == \"Allow\":\n                    return CheckResult.FAILED\n        return CheckResult.PASSED\n\n\ncheck = StarActionPolicyDocument()\n", "path": "checkov/terraform/checks/data/aws/StarActionPolicyDocument.py"}]}