We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Failed to run check CKV_AWS_224: TemplateAttributeError: get is invalid
**Describe the issue**
Error occurs when checked ECS Cluster using terraform_plan framework.

**Examples**
```
module "cluster" {
  source  = "terraform-aws-modules/ecs/aws"
  version = "4.1.3"

  cluster_name = "foo"
  fargate_capacity_providers = {
    FARGATE = {}
  }
}
```

**Version (please complete the following information):**
- checkov 2.3.165
- terraform 1.4.5
- aws provider 4.63.0

**Additional context**
traceback:
```
2023-04-18 09:53:09,676 [MainThread  ] [ERROR]  Failed to run check CKV_AWS_224 on /tfplan.json:aws_ecs_cluster.this
Traceback (most recent call last):
  File "/usr/local/lib/python3.9/site-packages/checkov/common/checks/base_check.py", line 73, in run
    check_result["result"] = self.scan_entity_conf(entity_configuration, entity_type)
  File "/usr/local/lib/python3.9/site-packages/checkov/terraform/checks/resource/base_resource_check.py", line 43, in scan_entity_conf
    return self.scan_resource_conf(conf)
  File "/usr/local/lib/python3.9/site-packages/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py", line 21, in scan_resource_conf
    if log_conf.get('cloud_watch_encryption_enabled') == [True] or \
  File "/usr/local/lib/python3.9/site-packages/checkov/common/parsers/node.py", line 189, in __getattr__
    raise TemplateAttributeError(f'{name} is invalid')
checkov.common.parsers.node.TemplateAttributeError: get is invalid
```

This only occurs when using terraform_plan framework. It works without issue when using vanilla terraform framework.

The plan generation is just `terraform plan -out tfplan.bin && terraform show -json tfplan.bin > tfplan.json` then running `checkof -f tfplan.json`.

Here is my checkov config file in repo:
```
➜ cat .checkov.yaml     
block-list-secret-scan: []
compact: true
download-external-modules: true
evaluate-variables: true
external-modules-download-path: .external_modules
file:
- tfplan.json
framework:
- terraform_plan
mask: []
quiet: true
repo-root-for-plan-enrichment:
- .
secrets-history-timeout: 12h
secrets-scan-file-type: []
skip-check:
- CKV2_AWS_34
summary-position: top
```


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py`
Content:
```
1 from checkov.common.models.enums import CheckResult, CheckCategories
2 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
3 
4 
5 class ECSClusterLoggingEncryptedWithCMK(BaseResourceCheck):
6     def __init__(self):
7         name = "Ensure Cluster logging with CMK"
8         id = "CKV_AWS_224"
9         supported_resources = ['aws_ecs_cluster']
10         categories = [CheckCategories.ENCRYPTION]
11         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
12 
13     def scan_resource_conf(self, conf):
14         configuration = conf.get("configuration")
15         if configuration and isinstance(configuration[0], dict) and configuration[0].get('execute_command_configuration'):
16             command_conf = configuration[0].get('execute_command_configuration')[0]
17             if not command_conf.get('logging') == ['NONE']:
18                 if command_conf.get('kms_key_id'):
19                     if command_conf.get('log_configuration'):
20                         log_conf = command_conf.get('log_configuration')[0]
21                         if log_conf.get('cloud_watch_encryption_enabled') == [True] or \
22                                 log_conf.get('s3_bucket_encryption_enabled') == [True]:
23                             return CheckResult.PASSED
24                     return CheckResult.FAILED
25                 else:
26                     return CheckResult.FAILED
27 
28         return CheckResult.UNKNOWN
29 
30 
31 check = ECSClusterLoggingEncryptedWithCMK()
32
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py b/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py
--- a/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py
+++ b/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py
@@ -1,28 +1,36 @@
+from __future__ import annotations
+
+from typing import Any
+
 from checkov.common.models.enums import CheckResult, CheckCategories
 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
 
 
 class ECSClusterLoggingEncryptedWithCMK(BaseResourceCheck):
-    def __init__(self):
-        name = "Ensure Cluster logging with CMK"
+    def __init__(self) -> None:
+        name = "Ensure ECS Cluster logging uses CMK"
         id = "CKV_AWS_224"
-        supported_resources = ['aws_ecs_cluster']
-        categories = [CheckCategories.ENCRYPTION]
+        supported_resources = ("aws_ecs_cluster",)
+        categories = (CheckCategories.ENCRYPTION,)
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
-    def scan_resource_conf(self, conf):
+    def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:
         configuration = conf.get("configuration")
-        if configuration and isinstance(configuration[0], dict) and configuration[0].get('execute_command_configuration'):
-            command_conf = configuration[0].get('execute_command_configuration')[0]
-            if not command_conf.get('logging') == ['NONE']:
-                if command_conf.get('kms_key_id'):
-                    if command_conf.get('log_configuration'):
-                        log_conf = command_conf.get('log_configuration')[0]
-                        if log_conf.get('cloud_watch_encryption_enabled') == [True] or \
-                                log_conf.get('s3_bucket_encryption_enabled') == [True]:
-                            return CheckResult.PASSED
-                    return CheckResult.FAILED
-                else:
+        if configuration and isinstance(configuration, list) and isinstance(configuration[0], dict):
+            execute_command = configuration[0].get("execute_command_configuration")
+            if execute_command and isinstance(execute_command, list):
+                execute_command = execute_command[0]
+                if isinstance(execute_command, dict) and not execute_command.get("logging") == ["NONE"]:
+                    if execute_command.get("kms_key_id"):
+                        log_conf = execute_command.get("log_configuration")
+                        if log_conf and isinstance(log_conf, list):
+                            log_conf = log_conf[0]
+                            if isinstance(log_conf, dict) and (
+                                log_conf.get("cloud_watch_encryption_enabled") == [True]
+                                or log_conf.get("s3_bucket_encryption_enabled") == [True]
+                            ):
+                                return CheckResult.PASSED
+
                     return CheckResult.FAILED
 
         return CheckResult.UNKNOWN

{"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py b/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py\n--- a/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py\n+++ b/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py\n@@ -1,28 +1,36 @@\n+from __future__ import annotations\n+\n+from typing import Any\n+\n from checkov.common.models.enums import CheckResult, CheckCategories\n from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n \n \n class ECSClusterLoggingEncryptedWithCMK(BaseResourceCheck):\n-    def __init__(self):\n-        name = \"Ensure Cluster logging with CMK\"\n+    def __init__(self) -> None:\n+        name = \"Ensure ECS Cluster logging uses CMK\"\n         id = \"CKV_AWS_224\"\n-        supported_resources = ['aws_ecs_cluster']\n-        categories = [CheckCategories.ENCRYPTION]\n+        supported_resources = (\"aws_ecs_cluster\",)\n+        categories = (CheckCategories.ENCRYPTION,)\n         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n \n-    def scan_resource_conf(self, conf):\n+    def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:\n         configuration = conf.get(\"configuration\")\n-        if configuration and isinstance(configuration[0], dict) and configuration[0].get('execute_command_configuration'):\n-            command_conf = configuration[0].get('execute_command_configuration')[0]\n-            if not command_conf.get('logging') == ['NONE']:\n-                if command_conf.get('kms_key_id'):\n-                    if command_conf.get('log_configuration'):\n-                        log_conf = command_conf.get('log_configuration')[0]\n-                        if log_conf.get('cloud_watch_encryption_enabled') == [True] or \\\n-                                log_conf.get('s3_bucket_encryption_enabled') == [True]:\n-                            return CheckResult.PASSED\n-                    return CheckResult.FAILED\n-                else:\n+        if configuration and isinstance(configuration, list) and isinstance(configuration[0], dict):\n+            execute_command = configuration[0].get(\"execute_command_configuration\")\n+            if execute_command and isinstance(execute_command, list):\n+                execute_command = execute_command[0]\n+                if isinstance(execute_command, dict) and not execute_command.get(\"logging\") == [\"NONE\"]:\n+                    if execute_command.get(\"kms_key_id\"):\n+                        log_conf = execute_command.get(\"log_configuration\")\n+                        if log_conf and isinstance(log_conf, list):\n+                            log_conf = log_conf[0]\n+                            if isinstance(log_conf, dict) and (\n+                                log_conf.get(\"cloud_watch_encryption_enabled\") == [True]\n+                                or log_conf.get(\"s3_bucket_encryption_enabled\") == [True]\n+                            ):\n+                                return CheckResult.PASSED\n+\n                     return CheckResult.FAILED\n \n         return CheckResult.UNKNOWN\n", "issue": "Failed to run check CKV_AWS_224: TemplateAttributeError: get is invalid\n**Describe the issue**\r\nError occurs when checked ECS Cluster using terraform_plan framework.\r\n\r\n**Examples**\r\n```\r\nmodule \"cluster\" {\r\n  source  = \"terraform-aws-modules/ecs/aws\"\r\n  version = \"4.1.3\"\r\n\r\n  cluster_name = \"foo\"\r\n  fargate_capacity_providers = {\r\n    FARGATE = {}\r\n  }\r\n}\r\n```\r\n\r\n**Version (please complete the following information):**\r\n- checkov 2.3.165\r\n- terraform 1.4.5\r\n- aws provider 4.63.0\r\n\r\n**Additional context**\r\ntraceback:\r\n```\r\n2023-04-18 09:53:09,676 [MainThread  ] [ERROR]  Failed to run check CKV_AWS_224 on /tfplan.json:aws_ecs_cluster.this\r\nTraceback (most recent call last):\r\n  File \"/usr/local/lib/python3.9/site-packages/checkov/common/checks/base_check.py\", line 73, in run\r\n    check_result[\"result\"] = self.scan_entity_conf(entity_configuration, entity_type)\r\n  File \"/usr/local/lib/python3.9/site-packages/checkov/terraform/checks/resource/base_resource_check.py\", line 43, in scan_entity_conf\r\n    return self.scan_resource_conf(conf)\r\n  File \"/usr/local/lib/python3.9/site-packages/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py\", line 21, in scan_resource_conf\r\n    if log_conf.get('cloud_watch_encryption_enabled') == [True] or \\\r\n  File \"/usr/local/lib/python3.9/site-packages/checkov/common/parsers/node.py\", line 189, in __getattr__\r\n    raise TemplateAttributeError(f'{name} is invalid')\r\ncheckov.common.parsers.node.TemplateAttributeError: get is invalid\r\n```\r\n\r\nThis only occurs when using terraform_plan framework. It works without issue when using vanilla terraform framework.\r\n\r\nThe plan generation is just `terraform plan -out tfplan.bin && terraform show -json tfplan.bin > tfplan.json` then running `checkof -f tfplan.json`.\r\n\r\nHere is my checkov config file in repo:\r\n```\r\n\u279c cat .checkov.yaml     \r\nblock-list-secret-scan: []\r\ncompact: true\r\ndownload-external-modules: true\r\nevaluate-variables: true\r\nexternal-modules-download-path: .external_modules\r\nfile:\r\n- tfplan.json\r\nframework:\r\n- terraform_plan\r\nmask: []\r\nquiet: true\r\nrepo-root-for-plan-enrichment:\r\n- .\r\nsecrets-history-timeout: 12h\r\nsecrets-scan-file-type: []\r\nskip-check:\r\n- CKV2_AWS_34\r\nsummary-position: top\r\n```\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass ECSClusterLoggingEncryptedWithCMK(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure Cluster logging with CMK\"\n        id = \"CKV_AWS_224\"\n        supported_resources = ['aws_ecs_cluster']\n        categories = [CheckCategories.ENCRYPTION]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        configuration = conf.get(\"configuration\")\n        if configuration and isinstance(configuration[0], dict) and configuration[0].get('execute_command_configuration'):\n            command_conf = configuration[0].get('execute_command_configuration')[0]\n            if not command_conf.get('logging') == ['NONE']:\n                if command_conf.get('kms_key_id'):\n                    if command_conf.get('log_configuration'):\n                        log_conf = command_conf.get('log_configuration')[0]\n                        if log_conf.get('cloud_watch_encryption_enabled') == [True] or \\\n                                log_conf.get('s3_bucket_encryption_enabled') == [True]:\n                            return CheckResult.PASSED\n                    return CheckResult.FAILED\n                else:\n                    return CheckResult.FAILED\n\n        return CheckResult.UNKNOWN\n\n\ncheck = ECSClusterLoggingEncryptedWithCMK()\n", "path": "checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py"}], "after_files": [{"content": "from __future__ import annotations\n\nfrom typing import Any\n\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass ECSClusterLoggingEncryptedWithCMK(BaseResourceCheck):\n    def __init__(self) -> None:\n        name = \"Ensure ECS Cluster logging uses CMK\"\n        id = \"CKV_AWS_224\"\n        supported_resources = (\"aws_ecs_cluster\",)\n        categories = (CheckCategories.ENCRYPTION,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:\n        configuration = conf.get(\"configuration\")\n        if configuration and isinstance(configuration, list) and isinstance(configuration[0], dict):\n            execute_command = configuration[0].get(\"execute_command_configuration\")\n            if execute_command and isinstance(execute_command, list):\n                execute_command = execute_command[0]\n                if isinstance(execute_command, dict) and not execute_command.get(\"logging\") == [\"NONE\"]:\n                    if execute_command.get(\"kms_key_id\"):\n                        log_conf = execute_command.get(\"log_configuration\")\n                        if log_conf and isinstance(log_conf, list):\n                            log_conf = log_conf[0]\n                            if isinstance(log_conf, dict) and (\n                                log_conf.get(\"cloud_watch_encryption_enabled\") == [True]\n                                or log_conf.get(\"s3_bucket_encryption_enabled\") == [True]\n                            ):\n                                return CheckResult.PASSED\n\n                    return CheckResult.FAILED\n\n        return CheckResult.UNKNOWN\n\n\ncheck = ECSClusterLoggingEncryptedWithCMK()\n", "path": "checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py"}]}