We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Details has not been printed
**Describe the issue**
I'm trying to add details to a custom policy, but it has not been printed.
Run: On MacOS and on Github Action checkov-action@v12.1943.0
Version: 2.2.168
**Additional context**

  MANDATORY_TAGS = [
      "Application",
	  "Env",
	  "Team",
  ]
  
  
  class MandatoryTags(BaseResourceCheck):

      def __init__(self):
          name = "Ensure all resources has madatory tags"
          id = "CUSTOM_AWS_001"
          supported_resources = ['aws_kms_key']
          categories = [CheckCategories.GENERAL_SECURITY]
          guideline = "Check page blah blah"
          super().__init__(name=name, id=id, categories=categories,
                supported_resources=supported_resources, guideline=guideline)
  
      def scan_resource_conf(self, conf):
          if 'tags_all' in conf.keys():
              resource_tags = list(conf['tags_all'][0].keys())
              if not all(tag in resource_tags for tag in MANDATORY_TAGS):
                  self.details.append("default_tags need to be set on provider level")
                  return CheckResult.FAILED
              return CheckResult.PASSED
   
  
  
  check = MandatoryTags()
  
  ** output **
  `                "check_id": "CUSTOM_AWS_001",
                "bc_check_id": null,
                "check_name": "Ensure all resources has mandatory tags",
                "check_result": {
                    "result": "FAILED",
                    "evaluated_keys": []
                },
                "code_block": [...],
                "file_path": "/plan_fmt.json",
                "file_abs_path": "/private/tmp/platform-checkov-custom-policies/plan_fmt.json",
                "repo_file_path": "/plan_fmt.json",
                "file_line_range": [...],
                "resource": "aws_kms_key.default",
                "evaluations": null,
                "check_class": "CheckMandatoryTags",
                "fixed_definition": null,
                "entity_tags": null,
                "caller_file_path": null,
                "caller_file_line_range": null,
                "resource_address": "aws_kms_key.default",
                "severity": null,
                "bc_category": null,
                "benchmarks": null,
                "description": null,
                "short_description": null,
                "vulnerability_details": null,
                "connected_node": null,
                "guideline": "",
                "details": [],
                "check_len": null
            },`

In the output, it shows the details list as empty.


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/terraform/plan_runner.py`
Content:
```
1 from __future__ import annotations
2 
3 import logging
4 import os
5 import platform
6 
7 from typing import Type, Optional
8 
9 from checkov.common.graph.checks_infra.registry import BaseRegistry
10 from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector
11 from checkov.terraform.graph_builder.graph_components.block_types import BlockType
12 from checkov.terraform.graph_manager import TerraformGraphManager
13 from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph
14 from checkov.common.checks_infra.registry import get_graph_checks_registry
15 from checkov.common.graph.graph_builder.graph_components.attribute_names import CustomAttributes
16 from checkov.common.output.record import Record
17 from checkov.common.util.secrets import omit_secret_value_from_checks, omit_secret_value_from_definitions
18 
19 from checkov.common.bridgecrew.check_type import CheckType
20 from checkov.common.output.report import Report
21 from checkov.common.runners.base_runner import CHECKOV_CREATE_GRAPH
22 from checkov.runner_filter import RunnerFilter
23 from checkov.terraform.checks.resource.registry import resource_registry
24 from checkov.terraform.context_parsers.registry import parser_registry
25 from checkov.terraform.plan_utils import create_definitions, build_definitions_context
26 from checkov.terraform.runner import Runner as TerraformRunner, merge_reports
27 from checkov.terraform.deep_analysis_plan_graph_manager import DeepAnalysisGraphManager
28 
29 # set of check IDs with lifecycle condition
30 TF_LIFECYCLE_CHECK_IDS = {
31     "CKV_AWS_217",
32     "CKV_AWS_233",
33     "CKV_AWS_237",
34     "CKV_GCP_82",
35 }
36 
37 RESOURCE_ATTRIBUTES_TO_OMIT = {
38     'aws_db_instance': ['password'],
39     'aws_secretsmanager_secret_version': ['secret_string'],
40     'aws_ssm_parameter': ['value'],
41     'azurerm_container_registry': ['admin_password'],
42     'azurerm_key_vault_secret': ['value'],
43     'azurerm_linux_virtual_machine': ['admin_password'],
44     'azurerm_mssql_managed_instance_vulnerability_assessment': ['storage_container_path'],
45     'azurerm_mssql_server': ['administrator_login_password'],
46     'azurerm_mssql_server_vulnerability_assessment': ['storage_container_path'],
47     'azurerm_redis_cache': ['primary_access_key', 'secondary_access_key', 'primary_connection_string',
48                             'secondary_connection_string'],
49     'azurerm_sql_server': ['administrator_login_password'],
50     'azurerm_sql_managed_instance': ['administrator_login_password'],
51     'azurerm_storage_account': ['primary_access_key', 'secondary_access_key', 'primary_blob_connection_string',
52                                 'secondary_blob_connection_string', 'primary_blob_endpoint', 'primary_blob_host',
53                                 'secondary_blob_endpoint', 'secondary_blob_host', 'primary_connection_string',
54                                 'secondary_connection_string'],
55     'azurerm_synapse_workspace_vulnerability_assessment': ['storage_container_path'],
56     'azurerm_synapse_sql_pool_vulnerability_assessment': ['storage_container_path'],
57     'azurerm_virtual_machine': ['admin_password'],
58     'azurerm_windows_virtual_machine': ['admin_password'],
59     'google_kms_secret_ciphertext': ['plaintext']
60 }
61 
62 
63 class Runner(TerraformRunner):
64     check_type = CheckType.TERRAFORM_PLAN  # noqa: CCE003  # a static attribute
65 
66     def __init__(self, graph_class: Type[TerraformLocalGraph] = TerraformLocalGraph,
67                  graph_manager: TerraformGraphManager | None = None,
68                  db_connector: NetworkxConnector | None = None,
69                  external_registries: list[BaseRegistry] | None = None,
70                  source: str = "Terraform") -> None:
71         super().__init__(
72             graph_class=graph_class,
73             graph_manager=graph_manager,
74             db_connector=db_connector or NetworkxConnector(),
75             external_registries=external_registries,
76             source=source,
77         )
78         self.file_extensions = ['.json']  # override what gets set from the TF runner
79         self.definitions = None
80         self.context = None
81         self.graph_registry = get_graph_checks_registry(super().check_type)
82         self.deep_analysis = False
83         self.repo_root_for_plan_enrichment = []
84         self.tf_plan_local_graph = None
85 
86     block_type_registries = {  # noqa: CCE003  # a static attribute
87         'resource': resource_registry,
88     }
89 
90     def run(
91             self,
92             root_folder: str | None = None,
93             external_checks_dir: list[str] | None = None,
94             files: list[str] | None = None,
95             runner_filter: RunnerFilter | None = None,
96             collect_skip_comments: bool = True
97     ) -> Report | list[Report]:
98         runner_filter = runner_filter or RunnerFilter()
99         self.deep_analysis = runner_filter.deep_analysis
100         if runner_filter.repo_root_for_plan_enrichment:
101             self.repo_root_for_plan_enrichment = runner_filter.repo_root_for_plan_enrichment[0]
102         report = Report(self.check_type)
103         parsing_errors: dict[str, str] = {}
104         tf_local_graph: Optional[TerraformLocalGraph] = None
105         if self.definitions is None or self.context is None:
106             self.definitions, definitions_raw = create_definitions(root_folder, files, runner_filter, parsing_errors)
107             self.context = build_definitions_context(self.definitions, definitions_raw)
108             if CHECKOV_CREATE_GRAPH:
109                 censored_definitions = omit_secret_value_from_definitions(definitions=self.definitions,
110                                                                           resource_attributes_to_omit=RESOURCE_ATTRIBUTES_TO_OMIT)
111                 self.tf_plan_local_graph = self.graph_manager.build_graph_from_definitions(censored_definitions, render_variables=False)
112                 for vertex in self.tf_plan_local_graph.vertices:
113                     if vertex.block_type == BlockType.RESOURCE:
114                         report.add_resource(f'{vertex.path}:{vertex.id}')
115                 self.graph_manager.save_graph(self.tf_plan_local_graph)
116                 if self._should_run_deep_analysis:
117                     tf_local_graph = self._create_terraform_graph()
118 
119         if external_checks_dir:
120             for directory in external_checks_dir:
121                 resource_registry.load_external_checks(directory)
122                 self.graph_registry.load_external_checks(directory)
123         if not root_folder:
124             root_folder = os.path.split(os.path.commonprefix(files))[0]
125         self.check_tf_definition(report, root_folder, runner_filter)
126         report.add_parsing_errors(parsing_errors.keys())
127 
128         if self.definitions:
129             graph_report = self._get_graph_report(root_folder, runner_filter, tf_local_graph)
130             merge_reports(report, graph_report)
131 
132         if runner_filter.run_image_referencer:
133             image_report = self.check_container_image_references(
134                 graph_connector=self.graph_manager.get_reader_endpoint(),
135                 root_path=root_folder,
136                 runner_filter=runner_filter,
137             )
138 
139             if image_report:
140                 # due too many tests failing only return a list, if there is an image report
141                 return [report, image_report]
142 
143         return report
144 
145     def _get_graph_report(self, root_folder: str, runner_filter: RunnerFilter, tf_local_graph: Optional[TerraformLocalGraph]) -> Report:
146         if self._should_run_deep_analysis and tf_local_graph:
147             deep_analysis_graph_manager = DeepAnalysisGraphManager(tf_local_graph, self.tf_plan_local_graph)
148             deep_analysis_graph_manager.enrich_tf_graph_attributes()
149             self.graph_manager.save_graph(tf_local_graph)
150             graph_report = self.get_graph_checks_report(root_folder, runner_filter)
151             deep_analysis_graph_manager.filter_report(graph_report)
152             return graph_report
153         return self.get_graph_checks_report(root_folder, runner_filter)
154 
155     def _create_terraform_graph(self) -> TerraformLocalGraph:
156         graph_manager = TerraformGraphManager(db_connector=NetworkxConnector())
157         tf_local_graph, _ = graph_manager.build_graph_from_source_directory(self.repo_root_for_plan_enrichment,
158                                                                             render_variables=True)
159         self.graph_manager = graph_manager
160         return tf_local_graph
161 
162     def check_tf_definition(self, report, root_folder, runner_filter, collect_skip_comments=True):
163         for full_file_path, definition in self.definitions.items():
164             if platform.system() == "Windows":
165                 temp = os.path.split(full_file_path)[0]
166                 scanned_file = f"/{os.path.relpath(full_file_path,temp)}"
167             else:
168                 scanned_file = f"/{os.path.relpath(full_file_path, root_folder)}"
169             logging.debug(f"Scanning file: {scanned_file}")
170             for block_type in definition.keys():
171                 if block_type in self.block_type_registries.keys():
172                     self.run_block(definition[block_type], None, full_file_path, root_folder, report, scanned_file,
173                                    block_type, runner_filter)
174 
175     def run_block(self, entities,
176                   definition_context,
177                   full_file_path, root_folder, report, scanned_file,
178                   block_type, runner_filter=None, entity_context_path_header=None,
179                   module_referrer: str | None = None):
180         registry = self.block_type_registries[block_type]
181         if registry:
182             for entity in entities:
183                 context_parser = parser_registry.context_parsers[block_type]
184                 definition_path = context_parser.get_entity_context_path(entity)
185                 entity_id = ".".join(definition_path)
186                 # Entity can exist only once per dir, for file as well
187                 entity_context = self.get_entity_context(definition_path, full_file_path)
188                 entity_lines_range = [entity_context.get('start_line'), entity_context.get('end_line')]
189                 entity_code_lines = entity_context.get('code_lines')
190                 entity_address = entity_context.get('address')
191                 _, _, entity_config = registry.extract_entity_details(entity)
192 
193                 results = registry.scan(scanned_file, entity, [], runner_filter, report_type=CheckType.TERRAFORM_PLAN)
194                 for check, check_result in results.items():
195                     if check.id in TF_LIFECYCLE_CHECK_IDS:
196                         # can't be evaluated in TF plan
197                         continue
198                     censored_code_lines = omit_secret_value_from_checks(check=check,
199                                                                         check_result=check_result,
200                                                                         entity_code_lines=entity_code_lines,
201                                                                         entity_config=entity_config,
202                                                                         resource_attributes_to_omit=RESOURCE_ATTRIBUTES_TO_OMIT)
203                     record = Record(check_id=check.id, bc_check_id=check.bc_id, check_name=check.name,
204                                     check_result=check_result,
205                                     code_block=censored_code_lines, file_path=scanned_file,
206                                     file_line_range=entity_lines_range,
207                                     resource=entity_id, resource_address=entity_address, evaluations=None,
208                                     check_class=check.__class__.__module__, file_abs_path=full_file_path,
209                                     severity=check.severity)
210                     record.set_guideline(check.guideline)
211                     report.add_record(record=record)
212 
213     def get_entity_context_and_evaluations(self, entity):
214         raw_context = self.get_entity_context(entity[CustomAttributes.BLOCK_NAME].split("."),
215                                               entity[CustomAttributes.FILE_PATH])
216         raw_context['definition_path'] = entity[CustomAttributes.BLOCK_NAME].split('.')
217         return raw_context, None
218 
219     def get_entity_context(self, definition_path, full_file_path):
220         entity_id = ".".join(definition_path)
221         return self.context.get(full_file_path, {}).get(entity_id)
222 
223     @property
224     def _should_run_deep_analysis(self) -> bool:
225         return self.deep_analysis and self.repo_root_for_plan_enrichment and self.tf_plan_local_graph
226
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/terraform/plan_runner.py b/checkov/terraform/plan_runner.py
--- a/checkov/terraform/plan_runner.py
+++ b/checkov/terraform/plan_runner.py
@@ -195,18 +195,30 @@
                     if check.id in TF_LIFECYCLE_CHECK_IDS:
                         # can't be evaluated in TF plan
                         continue
-                    censored_code_lines = omit_secret_value_from_checks(check=check,
-                                                                        check_result=check_result,
-                                                                        entity_code_lines=entity_code_lines,
-                                                                        entity_config=entity_config,
-                                                                        resource_attributes_to_omit=RESOURCE_ATTRIBUTES_TO_OMIT)
-                    record = Record(check_id=check.id, bc_check_id=check.bc_id, check_name=check.name,
-                                    check_result=check_result,
-                                    code_block=censored_code_lines, file_path=scanned_file,
-                                    file_line_range=entity_lines_range,
-                                    resource=entity_id, resource_address=entity_address, evaluations=None,
-                                    check_class=check.__class__.__module__, file_abs_path=full_file_path,
-                                    severity=check.severity)
+
+                    censored_code_lines = omit_secret_value_from_checks(
+                        check=check,
+                        check_result=check_result,
+                        entity_code_lines=entity_code_lines,
+                        entity_config=entity_config,
+                        resource_attributes_to_omit=RESOURCE_ATTRIBUTES_TO_OMIT
+                    )
+                    record = Record(
+                        check_id=check.id,
+                        bc_check_id=check.bc_id,
+                        check_name=check.name,
+                        check_result=check_result,
+                        code_block=censored_code_lines,
+                        file_path=scanned_file,
+                        file_line_range=entity_lines_range,
+                        resource=entity_id,
+                        resource_address=entity_address,
+                        evaluations=None,
+                        check_class=check.__class__.__module__,
+                        file_abs_path=full_file_path,
+                        severity=check.severity,
+                        details=check.details,
+                    )
                     record.set_guideline(check.guideline)
                     report.add_record(record=record)

{"golden_diff": "diff --git a/checkov/terraform/plan_runner.py b/checkov/terraform/plan_runner.py\n--- a/checkov/terraform/plan_runner.py\n+++ b/checkov/terraform/plan_runner.py\n@@ -195,18 +195,30 @@\n                     if check.id in TF_LIFECYCLE_CHECK_IDS:\n                         # can't be evaluated in TF plan\n                         continue\n-                    censored_code_lines = omit_secret_value_from_checks(check=check,\n-                                                                        check_result=check_result,\n-                                                                        entity_code_lines=entity_code_lines,\n-                                                                        entity_config=entity_config,\n-                                                                        resource_attributes_to_omit=RESOURCE_ATTRIBUTES_TO_OMIT)\n-                    record = Record(check_id=check.id, bc_check_id=check.bc_id, check_name=check.name,\n-                                    check_result=check_result,\n-                                    code_block=censored_code_lines, file_path=scanned_file,\n-                                    file_line_range=entity_lines_range,\n-                                    resource=entity_id, resource_address=entity_address, evaluations=None,\n-                                    check_class=check.__class__.__module__, file_abs_path=full_file_path,\n-                                    severity=check.severity)\n+\n+                    censored_code_lines = omit_secret_value_from_checks(\n+                        check=check,\n+                        check_result=check_result,\n+                        entity_code_lines=entity_code_lines,\n+                        entity_config=entity_config,\n+                        resource_attributes_to_omit=RESOURCE_ATTRIBUTES_TO_OMIT\n+                    )\n+                    record = Record(\n+                        check_id=check.id,\n+                        bc_check_id=check.bc_id,\n+                        check_name=check.name,\n+                        check_result=check_result,\n+                        code_block=censored_code_lines,\n+                        file_path=scanned_file,\n+                        file_line_range=entity_lines_range,\n+                        resource=entity_id,\n+                        resource_address=entity_address,\n+                        evaluations=None,\n+                        check_class=check.__class__.__module__,\n+                        file_abs_path=full_file_path,\n+                        severity=check.severity,\n+                        details=check.details,\n+                    )\n                     record.set_guideline(check.guideline)\n                     report.add_record(record=record)\n", "issue": "Details has not been printed\n**Describe the issue**\r\nI'm trying to add details to a custom policy, but it has not been printed.\r\nRun: On MacOS and on Github Action checkov-action@v12.1943.0\r\nVersion: 2.2.168\r\n**Additional context**\r\n\r\n  MANDATORY_TAGS = [\r\n      \"Application\",\r\n\t  \"Env\",\r\n\t  \"Team\",\r\n  ]\r\n  \r\n  \r\n  class MandatoryTags(BaseResourceCheck):\r\n\r\n      def __init__(self):\r\n          name = \"Ensure all resources has madatory tags\"\r\n          id = \"CUSTOM_AWS_001\"\r\n          supported_resources = ['aws_kms_key']\r\n          categories = [CheckCategories.GENERAL_SECURITY]\r\n          guideline = \"Check page blah blah\"\r\n          super().__init__(name=name, id=id, categories=categories,\r\n                supported_resources=supported_resources, guideline=guideline)\r\n  \r\n      def scan_resource_conf(self, conf):\r\n          if 'tags_all' in conf.keys():\r\n              resource_tags = list(conf['tags_all'][0].keys())\r\n              if not all(tag in resource_tags for tag in MANDATORY_TAGS):\r\n                  self.details.append(\"default_tags need to be set on provider level\")\r\n                  return CheckResult.FAILED\r\n              return CheckResult.PASSED\r\n   \r\n  \r\n  \r\n  check = MandatoryTags()\r\n  \r\n  ** output **\r\n  `                \"check_id\": \"CUSTOM_AWS_001\",\r\n                \"bc_check_id\": null,\r\n                \"check_name\": \"Ensure all resources has mandatory tags\",\r\n                \"check_result\": {\r\n                    \"result\": \"FAILED\",\r\n                    \"evaluated_keys\": []\r\n                },\r\n                \"code_block\": [...],\r\n                \"file_path\": \"/plan_fmt.json\",\r\n                \"file_abs_path\": \"/private/tmp/platform-checkov-custom-policies/plan_fmt.json\",\r\n                \"repo_file_path\": \"/plan_fmt.json\",\r\n                \"file_line_range\": [...],\r\n                \"resource\": \"aws_kms_key.default\",\r\n                \"evaluations\": null,\r\n                \"check_class\": \"CheckMandatoryTags\",\r\n                \"fixed_definition\": null,\r\n                \"entity_tags\": null,\r\n                \"caller_file_path\": null,\r\n                \"caller_file_line_range\": null,\r\n                \"resource_address\": \"aws_kms_key.default\",\r\n                \"severity\": null,\r\n                \"bc_category\": null,\r\n                \"benchmarks\": null,\r\n                \"description\": null,\r\n                \"short_description\": null,\r\n                \"vulnerability_details\": null,\r\n                \"connected_node\": null,\r\n                \"guideline\": \"\",\r\n                \"details\": [],\r\n                \"check_len\": null\r\n            },`\r\n\r\nIn the output, it shows the details list as empty.\r\n\n", "before_files": [{"content": "from __future__ import annotations\n\nimport logging\nimport os\nimport platform\n\nfrom typing import Type, Optional\n\nfrom checkov.common.graph.checks_infra.registry import BaseRegistry\nfrom checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector\nfrom checkov.terraform.graph_builder.graph_components.block_types import BlockType\nfrom checkov.terraform.graph_manager import TerraformGraphManager\nfrom checkov.terraform.graph_builder.local_graph import TerraformLocalGraph\nfrom checkov.common.checks_infra.registry import get_graph_checks_registry\nfrom checkov.common.graph.graph_builder.graph_components.attribute_names import CustomAttributes\nfrom checkov.common.output.record import Record\nfrom checkov.common.util.secrets import omit_secret_value_from_checks, omit_secret_value_from_definitions\n\nfrom checkov.common.bridgecrew.check_type import CheckType\nfrom checkov.common.output.report import Report\nfrom checkov.common.runners.base_runner import CHECKOV_CREATE_GRAPH\nfrom checkov.runner_filter import RunnerFilter\nfrom checkov.terraform.checks.resource.registry import resource_registry\nfrom checkov.terraform.context_parsers.registry import parser_registry\nfrom checkov.terraform.plan_utils import create_definitions, build_definitions_context\nfrom checkov.terraform.runner import Runner as TerraformRunner, merge_reports\nfrom checkov.terraform.deep_analysis_plan_graph_manager import DeepAnalysisGraphManager\n\n# set of check IDs with lifecycle condition\nTF_LIFECYCLE_CHECK_IDS = {\n    \"CKV_AWS_217\",\n    \"CKV_AWS_233\",\n    \"CKV_AWS_237\",\n    \"CKV_GCP_82\",\n}\n\nRESOURCE_ATTRIBUTES_TO_OMIT = {\n    'aws_db_instance': ['password'],\n    'aws_secretsmanager_secret_version': ['secret_string'],\n    'aws_ssm_parameter': ['value'],\n    'azurerm_container_registry': ['admin_password'],\n    'azurerm_key_vault_secret': ['value'],\n    'azurerm_linux_virtual_machine': ['admin_password'],\n    'azurerm_mssql_managed_instance_vulnerability_assessment': ['storage_container_path'],\n    'azurerm_mssql_server': ['administrator_login_password'],\n    'azurerm_mssql_server_vulnerability_assessment': ['storage_container_path'],\n    'azurerm_redis_cache': ['primary_access_key', 'secondary_access_key', 'primary_connection_string',\n                            'secondary_connection_string'],\n    'azurerm_sql_server': ['administrator_login_password'],\n    'azurerm_sql_managed_instance': ['administrator_login_password'],\n    'azurerm_storage_account': ['primary_access_key', 'secondary_access_key', 'primary_blob_connection_string',\n                                'secondary_blob_connection_string', 'primary_blob_endpoint', 'primary_blob_host',\n                                'secondary_blob_endpoint', 'secondary_blob_host', 'primary_connection_string',\n                                'secondary_connection_string'],\n    'azurerm_synapse_workspace_vulnerability_assessment': ['storage_container_path'],\n    'azurerm_synapse_sql_pool_vulnerability_assessment': ['storage_container_path'],\n    'azurerm_virtual_machine': ['admin_password'],\n    'azurerm_windows_virtual_machine': ['admin_password'],\n    'google_kms_secret_ciphertext': ['plaintext']\n}\n\n\nclass Runner(TerraformRunner):\n    check_type = CheckType.TERRAFORM_PLAN  # noqa: CCE003  # a static attribute\n\n    def __init__(self, graph_class: Type[TerraformLocalGraph] = TerraformLocalGraph,\n                 graph_manager: TerraformGraphManager | None = None,\n                 db_connector: NetworkxConnector | None = None,\n                 external_registries: list[BaseRegistry] | None = None,\n                 source: str = \"Terraform\") -> None:\n        super().__init__(\n            graph_class=graph_class,\n            graph_manager=graph_manager,\n            db_connector=db_connector or NetworkxConnector(),\n            external_registries=external_registries,\n            source=source,\n        )\n        self.file_extensions = ['.json']  # override what gets set from the TF runner\n        self.definitions = None\n        self.context = None\n        self.graph_registry = get_graph_checks_registry(super().check_type)\n        self.deep_analysis = False\n        self.repo_root_for_plan_enrichment = []\n        self.tf_plan_local_graph = None\n\n    block_type_registries = {  # noqa: CCE003  # a static attribute\n        'resource': resource_registry,\n    }\n\n    def run(\n            self,\n            root_folder: str | None = None,\n            external_checks_dir: list[str] | None = None,\n            files: list[str] | None = None,\n            runner_filter: RunnerFilter | None = None,\n            collect_skip_comments: bool = True\n    ) -> Report | list[Report]:\n        runner_filter = runner_filter or RunnerFilter()\n        self.deep_analysis = runner_filter.deep_analysis\n        if runner_filter.repo_root_for_plan_enrichment:\n            self.repo_root_for_plan_enrichment = runner_filter.repo_root_for_plan_enrichment[0]\n        report = Report(self.check_type)\n        parsing_errors: dict[str, str] = {}\n        tf_local_graph: Optional[TerraformLocalGraph] = None\n        if self.definitions is None or self.context is None:\n            self.definitions, definitions_raw = create_definitions(root_folder, files, runner_filter, parsing_errors)\n            self.context = build_definitions_context(self.definitions, definitions_raw)\n            if CHECKOV_CREATE_GRAPH:\n                censored_definitions = omit_secret_value_from_definitions(definitions=self.definitions,\n                                                                          resource_attributes_to_omit=RESOURCE_ATTRIBUTES_TO_OMIT)\n                self.tf_plan_local_graph = self.graph_manager.build_graph_from_definitions(censored_definitions, render_variables=False)\n                for vertex in self.tf_plan_local_graph.vertices:\n                    if vertex.block_type == BlockType.RESOURCE:\n                        report.add_resource(f'{vertex.path}:{vertex.id}')\n                self.graph_manager.save_graph(self.tf_plan_local_graph)\n                if self._should_run_deep_analysis:\n                    tf_local_graph = self._create_terraform_graph()\n\n        if external_checks_dir:\n            for directory in external_checks_dir:\n                resource_registry.load_external_checks(directory)\n                self.graph_registry.load_external_checks(directory)\n        if not root_folder:\n            root_folder = os.path.split(os.path.commonprefix(files))[0]\n        self.check_tf_definition(report, root_folder, runner_filter)\n        report.add_parsing_errors(parsing_errors.keys())\n\n        if self.definitions:\n            graph_report = self._get_graph_report(root_folder, runner_filter, tf_local_graph)\n            merge_reports(report, graph_report)\n\n        if runner_filter.run_image_referencer:\n            image_report = self.check_container_image_references(\n                graph_connector=self.graph_manager.get_reader_endpoint(),\n                root_path=root_folder,\n                runner_filter=runner_filter,\n            )\n\n            if image_report:\n                # due too many tests failing only return a list, if there is an image report\n                return [report, image_report]\n\n        return report\n\n    def _get_graph_report(self, root_folder: str, runner_filter: RunnerFilter, tf_local_graph: Optional[TerraformLocalGraph]) -> Report:\n        if self._should_run_deep_analysis and tf_local_graph:\n            deep_analysis_graph_manager = DeepAnalysisGraphManager(tf_local_graph, self.tf_plan_local_graph)\n            deep_analysis_graph_manager.enrich_tf_graph_attributes()\n            self.graph_manager.save_graph(tf_local_graph)\n            graph_report = self.get_graph_checks_report(root_folder, runner_filter)\n            deep_analysis_graph_manager.filter_report(graph_report)\n            return graph_report\n        return self.get_graph_checks_report(root_folder, runner_filter)\n\n    def _create_terraform_graph(self) -> TerraformLocalGraph:\n        graph_manager = TerraformGraphManager(db_connector=NetworkxConnector())\n        tf_local_graph, _ = graph_manager.build_graph_from_source_directory(self.repo_root_for_plan_enrichment,\n                                                                            render_variables=True)\n        self.graph_manager = graph_manager\n        return tf_local_graph\n\n    def check_tf_definition(self, report, root_folder, runner_filter, collect_skip_comments=True):\n        for full_file_path, definition in self.definitions.items():\n            if platform.system() == \"Windows\":\n                temp = os.path.split(full_file_path)[0]\n                scanned_file = f\"/{os.path.relpath(full_file_path,temp)}\"\n            else:\n                scanned_file = f\"/{os.path.relpath(full_file_path, root_folder)}\"\n            logging.debug(f\"Scanning file: {scanned_file}\")\n            for block_type in definition.keys():\n                if block_type in self.block_type_registries.keys():\n                    self.run_block(definition[block_type], None, full_file_path, root_folder, report, scanned_file,\n                                   block_type, runner_filter)\n\n    def run_block(self, entities,\n                  definition_context,\n                  full_file_path, root_folder, report, scanned_file,\n                  block_type, runner_filter=None, entity_context_path_header=None,\n                  module_referrer: str | None = None):\n        registry = self.block_type_registries[block_type]\n        if registry:\n            for entity in entities:\n                context_parser = parser_registry.context_parsers[block_type]\n                definition_path = context_parser.get_entity_context_path(entity)\n                entity_id = \".\".join(definition_path)\n                # Entity can exist only once per dir, for file as well\n                entity_context = self.get_entity_context(definition_path, full_file_path)\n                entity_lines_range = [entity_context.get('start_line'), entity_context.get('end_line')]\n                entity_code_lines = entity_context.get('code_lines')\n                entity_address = entity_context.get('address')\n                _, _, entity_config = registry.extract_entity_details(entity)\n\n                results = registry.scan(scanned_file, entity, [], runner_filter, report_type=CheckType.TERRAFORM_PLAN)\n                for check, check_result in results.items():\n                    if check.id in TF_LIFECYCLE_CHECK_IDS:\n                        # can't be evaluated in TF plan\n                        continue\n                    censored_code_lines = omit_secret_value_from_checks(check=check,\n                                                                        check_result=check_result,\n                                                                        entity_code_lines=entity_code_lines,\n                                                                        entity_config=entity_config,\n                                                                        resource_attributes_to_omit=RESOURCE_ATTRIBUTES_TO_OMIT)\n                    record = Record(check_id=check.id, bc_check_id=check.bc_id, check_name=check.name,\n                                    check_result=check_result,\n                                    code_block=censored_code_lines, file_path=scanned_file,\n                                    file_line_range=entity_lines_range,\n                                    resource=entity_id, resource_address=entity_address, evaluations=None,\n                                    check_class=check.__class__.__module__, file_abs_path=full_file_path,\n                                    severity=check.severity)\n                    record.set_guideline(check.guideline)\n                    report.add_record(record=record)\n\n    def get_entity_context_and_evaluations(self, entity):\n        raw_context = self.get_entity_context(entity[CustomAttributes.BLOCK_NAME].split(\".\"),\n                                              entity[CustomAttributes.FILE_PATH])\n        raw_context['definition_path'] = entity[CustomAttributes.BLOCK_NAME].split('.')\n        return raw_context, None\n\n    def get_entity_context(self, definition_path, full_file_path):\n        entity_id = \".\".join(definition_path)\n        return self.context.get(full_file_path, {}).get(entity_id)\n\n    @property\n    def _should_run_deep_analysis(self) -> bool:\n        return self.deep_analysis and self.repo_root_for_plan_enrichment and self.tf_plan_local_graph\n", "path": "checkov/terraform/plan_runner.py"}], "after_files": [{"content": "from __future__ import annotations\n\nimport logging\nimport os\nimport platform\n\nfrom typing import Type, Optional\n\nfrom checkov.common.graph.checks_infra.registry import BaseRegistry\nfrom checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector\nfrom checkov.terraform.graph_builder.graph_components.block_types import BlockType\nfrom checkov.terraform.graph_manager import TerraformGraphManager\nfrom checkov.terraform.graph_builder.local_graph import TerraformLocalGraph\nfrom checkov.common.checks_infra.registry import get_graph_checks_registry\nfrom checkov.common.graph.graph_builder.graph_components.attribute_names import CustomAttributes\nfrom checkov.common.output.record import Record\nfrom checkov.common.util.secrets import omit_secret_value_from_checks, omit_secret_value_from_definitions\n\nfrom checkov.common.bridgecrew.check_type import CheckType\nfrom checkov.common.output.report import Report\nfrom checkov.common.runners.base_runner import CHECKOV_CREATE_GRAPH\nfrom checkov.runner_filter import RunnerFilter\nfrom checkov.terraform.checks.resource.registry import resource_registry\nfrom checkov.terraform.context_parsers.registry import parser_registry\nfrom checkov.terraform.plan_utils import create_definitions, build_definitions_context\nfrom checkov.terraform.runner import Runner as TerraformRunner, merge_reports\nfrom checkov.terraform.deep_analysis_plan_graph_manager import DeepAnalysisGraphManager\n\n# set of check IDs with lifecycle condition\nTF_LIFECYCLE_CHECK_IDS = {\n    \"CKV_AWS_217\",\n    \"CKV_AWS_233\",\n    \"CKV_AWS_237\",\n    \"CKV_GCP_82\",\n}\n\nRESOURCE_ATTRIBUTES_TO_OMIT = {\n    'aws_db_instance': ['password'],\n    'aws_secretsmanager_secret_version': ['secret_string'],\n    'aws_ssm_parameter': ['value'],\n    'azurerm_container_registry': ['admin_password'],\n    'azurerm_key_vault_secret': ['value'],\n    'azurerm_linux_virtual_machine': ['admin_password'],\n    'azurerm_mssql_managed_instance_vulnerability_assessment': ['storage_container_path'],\n    'azurerm_mssql_server': ['administrator_login_password'],\n    'azurerm_mssql_server_vulnerability_assessment': ['storage_container_path'],\n    'azurerm_redis_cache': ['primary_access_key', 'secondary_access_key', 'primary_connection_string',\n                            'secondary_connection_string'],\n    'azurerm_sql_server': ['administrator_login_password'],\n    'azurerm_sql_managed_instance': ['administrator_login_password'],\n    'azurerm_storage_account': ['primary_access_key', 'secondary_access_key', 'primary_blob_connection_string',\n                                'secondary_blob_connection_string', 'primary_blob_endpoint', 'primary_blob_host',\n                                'secondary_blob_endpoint', 'secondary_blob_host', 'primary_connection_string',\n                                'secondary_connection_string'],\n    'azurerm_synapse_workspace_vulnerability_assessment': ['storage_container_path'],\n    'azurerm_synapse_sql_pool_vulnerability_assessment': ['storage_container_path'],\n    'azurerm_virtual_machine': ['admin_password'],\n    'azurerm_windows_virtual_machine': ['admin_password'],\n    'google_kms_secret_ciphertext': ['plaintext']\n}\n\n\nclass Runner(TerraformRunner):\n    check_type = CheckType.TERRAFORM_PLAN  # noqa: CCE003  # a static attribute\n\n    def __init__(self, graph_class: Type[TerraformLocalGraph] = TerraformLocalGraph,\n                 graph_manager: TerraformGraphManager | None = None,\n                 db_connector: NetworkxConnector | None = None,\n                 external_registries: list[BaseRegistry] | None = None,\n                 source: str = \"Terraform\") -> None:\n        super().__init__(\n            graph_class=graph_class,\n            graph_manager=graph_manager,\n            db_connector=db_connector or NetworkxConnector(),\n            external_registries=external_registries,\n            source=source,\n        )\n        self.file_extensions = ['.json']  # override what gets set from the TF runner\n        self.definitions = None\n        self.context = None\n        self.graph_registry = get_graph_checks_registry(super().check_type)\n        self.deep_analysis = False\n        self.repo_root_for_plan_enrichment = []\n        self.tf_plan_local_graph = None\n\n    block_type_registries = {  # noqa: CCE003  # a static attribute\n        'resource': resource_registry,\n    }\n\n    def run(\n            self,\n            root_folder: str | None = None,\n            external_checks_dir: list[str] | None = None,\n            files: list[str] | None = None,\n            runner_filter: RunnerFilter | None = None,\n            collect_skip_comments: bool = True\n    ) -> Report | list[Report]:\n        runner_filter = runner_filter or RunnerFilter()\n        self.deep_analysis = runner_filter.deep_analysis\n        if runner_filter.repo_root_for_plan_enrichment:\n            self.repo_root_for_plan_enrichment = runner_filter.repo_root_for_plan_enrichment[0]\n        report = Report(self.check_type)\n        parsing_errors: dict[str, str] = {}\n        tf_local_graph: Optional[TerraformLocalGraph] = None\n        if self.definitions is None or self.context is None:\n            self.definitions, definitions_raw = create_definitions(root_folder, files, runner_filter, parsing_errors)\n            self.context = build_definitions_context(self.definitions, definitions_raw)\n            if CHECKOV_CREATE_GRAPH:\n                censored_definitions = omit_secret_value_from_definitions(definitions=self.definitions,\n                                                                          resource_attributes_to_omit=RESOURCE_ATTRIBUTES_TO_OMIT)\n                self.tf_plan_local_graph = self.graph_manager.build_graph_from_definitions(censored_definitions, render_variables=False)\n                for vertex in self.tf_plan_local_graph.vertices:\n                    if vertex.block_type == BlockType.RESOURCE:\n                        report.add_resource(f'{vertex.path}:{vertex.id}')\n                self.graph_manager.save_graph(self.tf_plan_local_graph)\n                if self._should_run_deep_analysis:\n                    tf_local_graph = self._create_terraform_graph()\n\n        if external_checks_dir:\n            for directory in external_checks_dir:\n                resource_registry.load_external_checks(directory)\n                self.graph_registry.load_external_checks(directory)\n        if not root_folder:\n            root_folder = os.path.split(os.path.commonprefix(files))[0]\n        self.check_tf_definition(report, root_folder, runner_filter)\n        report.add_parsing_errors(parsing_errors.keys())\n\n        if self.definitions:\n            graph_report = self._get_graph_report(root_folder, runner_filter, tf_local_graph)\n            merge_reports(report, graph_report)\n\n        if runner_filter.run_image_referencer:\n            image_report = self.check_container_image_references(\n                graph_connector=self.graph_manager.get_reader_endpoint(),\n                root_path=root_folder,\n                runner_filter=runner_filter,\n            )\n\n            if image_report:\n                # due too many tests failing only return a list, if there is an image report\n                return [report, image_report]\n\n        return report\n\n    def _get_graph_report(self, root_folder: str, runner_filter: RunnerFilter, tf_local_graph: Optional[TerraformLocalGraph]) -> Report:\n        if self._should_run_deep_analysis and tf_local_graph:\n            deep_analysis_graph_manager = DeepAnalysisGraphManager(tf_local_graph, self.tf_plan_local_graph)\n            deep_analysis_graph_manager.enrich_tf_graph_attributes()\n            self.graph_manager.save_graph(tf_local_graph)\n            graph_report = self.get_graph_checks_report(root_folder, runner_filter)\n            deep_analysis_graph_manager.filter_report(graph_report)\n            return graph_report\n        return self.get_graph_checks_report(root_folder, runner_filter)\n\n    def _create_terraform_graph(self) -> TerraformLocalGraph:\n        graph_manager = TerraformGraphManager(db_connector=NetworkxConnector())\n        tf_local_graph, _ = graph_manager.build_graph_from_source_directory(self.repo_root_for_plan_enrichment,\n                                                                            render_variables=True)\n        self.graph_manager = graph_manager\n        return tf_local_graph\n\n    def check_tf_definition(self, report, root_folder, runner_filter, collect_skip_comments=True):\n        for full_file_path, definition in self.definitions.items():\n            if platform.system() == \"Windows\":\n                temp = os.path.split(full_file_path)[0]\n                scanned_file = f\"/{os.path.relpath(full_file_path,temp)}\"\n            else:\n                scanned_file = f\"/{os.path.relpath(full_file_path, root_folder)}\"\n            logging.debug(f\"Scanning file: {scanned_file}\")\n            for block_type in definition.keys():\n                if block_type in self.block_type_registries.keys():\n                    self.run_block(definition[block_type], None, full_file_path, root_folder, report, scanned_file,\n                                   block_type, runner_filter)\n\n    def run_block(self, entities,\n                  definition_context,\n                  full_file_path, root_folder, report, scanned_file,\n                  block_type, runner_filter=None, entity_context_path_header=None,\n                  module_referrer: str | None = None):\n        registry = self.block_type_registries[block_type]\n        if registry:\n            for entity in entities:\n                context_parser = parser_registry.context_parsers[block_type]\n                definition_path = context_parser.get_entity_context_path(entity)\n                entity_id = \".\".join(definition_path)\n                # Entity can exist only once per dir, for file as well\n                entity_context = self.get_entity_context(definition_path, full_file_path)\n                entity_lines_range = [entity_context.get('start_line'), entity_context.get('end_line')]\n                entity_code_lines = entity_context.get('code_lines')\n                entity_address = entity_context.get('address')\n                _, _, entity_config = registry.extract_entity_details(entity)\n\n                results = registry.scan(scanned_file, entity, [], runner_filter, report_type=CheckType.TERRAFORM_PLAN)\n                for check, check_result in results.items():\n                    if check.id in TF_LIFECYCLE_CHECK_IDS:\n                        # can't be evaluated in TF plan\n                        continue\n\n                    censored_code_lines = omit_secret_value_from_checks(\n                        check=check,\n                        check_result=check_result,\n                        entity_code_lines=entity_code_lines,\n                        entity_config=entity_config,\n                        resource_attributes_to_omit=RESOURCE_ATTRIBUTES_TO_OMIT\n                    )\n                    record = Record(\n                        check_id=check.id,\n                        bc_check_id=check.bc_id,\n                        check_name=check.name,\n                        check_result=check_result,\n                        code_block=censored_code_lines,\n                        file_path=scanned_file,\n                        file_line_range=entity_lines_range,\n                        resource=entity_id,\n                        resource_address=entity_address,\n                        evaluations=None,\n                        check_class=check.__class__.__module__,\n                        file_abs_path=full_file_path,\n                        severity=check.severity,\n                        details=check.details,\n                    )\n                    record.set_guideline(check.guideline)\n                    report.add_record(record=record)\n\n    def get_entity_context_and_evaluations(self, entity):\n        raw_context = self.get_entity_context(entity[CustomAttributes.BLOCK_NAME].split(\".\"),\n                                              entity[CustomAttributes.FILE_PATH])\n        raw_context['definition_path'] = entity[CustomAttributes.BLOCK_NAME].split('.')\n        return raw_context, None\n\n    def get_entity_context(self, definition_path, full_file_path):\n        entity_id = \".\".join(definition_path)\n        return self.context.get(full_file_path, {}).get(entity_id)\n\n    @property\n    def _should_run_deep_analysis(self) -> bool:\n        return self.deep_analysis and self.repo_root_for_plan_enrichment and self.tf_plan_local_graph\n", "path": "checkov/terraform/plan_runner.py"}]}