prompt: You will be provided with a partial code base and an issue statement explaining a problem to resolve.
  <issue>
  Checkov crashes when evaluating a Terraform dynamic block in NSGRulePortAccessRestricted.py
  **Describe the bug**
  When checking azure_security_group_rule, azurerm_network_security_rule or azurerm_network_security_group Terraform resource types, NSGRulePortAccessRestricted.py throws a "TypeError: string indices must be integers" error whenever there's a dynamic block.
  
  **To Reproduce**
  Steps to reproduce the behavior:
  1. Create a resource in terraform, containing a dynamic security rule -
  ```
  resource "azurerm_network_security_group" "snet_nsgs" {
    count               = "${length(local.subnets)}"
    name                = "${local.root}-snet-${lookup(local.subnets[count.index], "name")}-nsg"
    location            = "${azurerm_resource_group.net_rg.location}"
    resource_group_name = "${azurerm_resource_group.net_rg.name}"
    tags                = "${local.tags}"
  
  
    dynamic "security_rule" {
      for_each = [for s in local.subnets[count.index].nsg_rules : {
        name                       = s.name
        priority                   = s.priority
        direction                  = s.direction
        access                     = s.access
        protocol                   = s.protocol
        source_port_range          = s.source_port_range
        destination_port_range     = s.destination_port_range
        source_address_prefix      = s.source_address_prefix
        destination_address_prefix = s.destination_address_prefix
        description                = s.description
      }]
      content {
        name                       = security_rule.value.name
        priority                   = security_rule.value.priority
        direction                  = security_rule.value.direction
        access                     = security_rule.value.access
        protocol                   = security_rule.value.protocol
        source_port_range          = security_rule.value.source_port_range
        destination_port_range     = security_rule.value.destination_port_range
        source_address_prefix      = security_rule.value.source_address_prefix
        destination_address_prefix = security_rule.value.destination_address_prefix
        description                = security_rule.value.description
      }
    }
  }
  ```
  2. Run checkov
  3. Error!
  
  **Expected behavior**
  As checkov cannot evaluate the dynamic block, I expect the check to be skipped without throwing an error.
  
  **Desktop (please complete the following information):**
   - OS: Ubuntu
   - Checkov Version 1.0.479
  
  
  </issue>
  <code>
  [start of checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py]
  1 from checkov.common.models.enums import CheckResult, CheckCategories
  2 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck
  3 from checkov.common.util.type_forcers import force_list
  4 import re
  5 
  6 INTERNET_ADDRESSES = ["*", "0.0.0.0", "<nw>/0", "/0", "internet", "any"]
  7 PORT_RANGE = re.compile('\d+-\d+')
  8 
  9 
  10 class NSGRulePortAccessRestricted(BaseResourceCheck):
  11     def __init__(self, name, check_id, port):
  12         supported_resources = ['azure_security_group_rule', 'azurerm_network_security_rule', 'azurerm_network_security_group']
  13         categories = [CheckCategories.NETWORKING]
  14         super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources)
  15         self.port = port
  16 
  17     def is_port_in_range(self, conf):
  18         ports = force_list(conf['destination_port_range'][0])
  19         for range in ports:
  20             if re.match(PORT_RANGE, range):
  21                 start, end = int(range.split('-')[0]), int(range.split('-')[1])
  22                 if start <= self.port <= end:
  23                     return True
  24             if range in [str(self.port), '*']:
  25                 return True
  26         return False
  27 
  28     def scan_resource_conf(self, conf):
  29         rule_confs = [conf]
  30         if 'security_rule' in conf:
  31             rule_confs = conf['security_rule']
  32 
  33         for rule_conf in rule_confs:
  34             if 'access' in rule_conf and rule_conf['access'][0] == "Allow":
  35                 if 'direction' in rule_conf and rule_conf['direction'][0] == "Inbound":
  36                     if 'protocol' in rule_conf and rule_conf['protocol'][0] == 'TCP':
  37                         if 'destination_port_range' in rule_conf and self.is_port_in_range(rule_conf):
  38                             if 'source_address_prefix' in rule_conf and rule_conf['source_address_prefix'][0] in INTERNET_ADDRESSES:
  39                                 return CheckResult.FAILED
  40         return CheckResult.PASSED
  41 
  42
  [end of checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py]
  </code>
  
  I need you to solve this issue by generating a single patch file that I can apply directly to this repository using git apply. Please respond with a single patch file in the following format.
  <patch>
  diff --git a/file.py b/file.py
  --- a/file.py
  +++ b/file.py
  @@ -1,27 +1,35 @@
   def euclidean(a, b):
  -    while b:
  -        a, b = b, a % b
  -    return a
  +    if b == 0:
  +        return a
  +    return euclidean(b, a % b)
   
   
   def bresenham(x0, y0, x1, y1):
       points = []
       dx = abs(x1 - x0)
       dy = abs(y1 - y0)
  -    sx = 1 if x0 < x1 else -1
  -    sy = 1 if y0 < y1 else -1
  -    err = dx - dy
  +    x, y = x0, y0
  +    sx = -1 if x0 > x1 else 1
  +    sy = -1 if y0 > y1 else 1
   
  -    while True:
  -        points.append((x0, y0))
  -        if x0 == x1 and y0 == y1:
  -            break
  -        e2 = 2 * err
  -        if e2 > -dy:
  -            err -= dy
  -            x0 += sx
  -        if e2 < dx:
  -            err += dx
  -            y0 += sy
  +    if dx > dy:
  +        err = dx / 2.0
  +        while x != x1:
  +            points.append((x, y))
  +            err -= dy
  +            if err < 0:
  +                y += sy
  +                err += dx
  +            x += sx
  +    else:
  +        err = dy / 2.0
  +        while y != y1:
  +            points.append((x, y))
  +            err -= dx
  +            if err < 0:
  +                x += sx
  +                err += dy
  +            y += sy
  +
  +    points.append((x, y))
       return points
  
  </patch>
golden_diff: diff --git a/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py b/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py
  --- a/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py
  +++ b/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py
  @@ -26,6 +26,9 @@
           return False
   
       def scan_resource_conf(self, conf):
  +        if "dynamic" in conf:
  +            return CheckResult.UNKNOWN
  +            
           rule_confs = [conf]
           if 'security_rule' in conf:
               rule_confs = conf['security_rule']
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py b/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py\n--- a/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py\n+++ b/checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py\n@@ -26,6 +26,9 @@\n         return False\n \n     def scan_resource_conf(self, conf):\n+        if \"dynamic\" in conf:\n+            return CheckResult.UNKNOWN\n+            \n         rule_confs = [conf]\n         if 'security_rule' in conf:\n             rule_confs = conf['security_rule']\n", "issue": "Checkov crashes when evaluating a Terraform dynamic block in NSGRulePortAccessRestricted.py\n**Describe the bug**\r\nWhen checking azure_security_group_rule, azurerm_network_security_rule or azurerm_network_security_group Terraform resource types, NSGRulePortAccessRestricted.py throws a \"TypeError: string indices must be integers\" error whenever there's a dynamic block.\r\n\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\n1. Create a resource in terraform, containing a dynamic security rule -\r\n```\r\nresource \"azurerm_network_security_group\" \"snet_nsgs\" {\r\n  count               = \"${length(local.subnets)}\"\r\n  name                = \"${local.root}-snet-${lookup(local.subnets[count.index], \"name\")}-nsg\"\r\n  location            = \"${azurerm_resource_group.net_rg.location}\"\r\n  resource_group_name = \"${azurerm_resource_group.net_rg.name}\"\r\n  tags                = \"${local.tags}\"\r\n\r\n\r\n  dynamic \"security_rule\" {\r\n    for_each = [for s in local.subnets[count.index].nsg_rules : {\r\n      name                       = s.name\r\n      priority                   = s.priority\r\n      direction                  = s.direction\r\n      access                     = s.access\r\n      protocol                   = s.protocol\r\n      source_port_range          = s.source_port_range\r\n      destination_port_range     = s.destination_port_range\r\n      source_address_prefix      = s.source_address_prefix\r\n      destination_address_prefix = s.destination_address_prefix\r\n      description                = s.description\r\n    }]\r\n    content {\r\n      name                       = security_rule.value.name\r\n      priority                   = security_rule.value.priority\r\n      direction                  = security_rule.value.direction\r\n      access                     = security_rule.value.access\r\n      protocol                   = security_rule.value.protocol\r\n      source_port_range          = security_rule.value.source_port_range\r\n      destination_port_range     = security_rule.value.destination_port_range\r\n      source_address_prefix      = security_rule.value.source_address_prefix\r\n      destination_address_prefix = security_rule.value.destination_address_prefix\r\n      description                = security_rule.value.description\r\n    }\r\n  }\r\n}\r\n```\r\n2. Run checkov\r\n3. Error!\r\n\r\n**Expected behavior**\r\nAs checkov cannot evaluate the dynamic block, I expect the check to be skipped without throwing an error.\r\n\r\n**Desktop (please complete the following information):**\r\n - OS: Ubuntu\r\n - Checkov Version 1.0.479\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck\nfrom checkov.common.util.type_forcers import force_list\nimport re\n\nINTERNET_ADDRESSES = [\"*\", \"0.0.0.0\", \"<nw>/0\", \"/0\", \"internet\", \"any\"]\nPORT_RANGE = re.compile('\\d+-\\d+')\n\n\nclass NSGRulePortAccessRestricted(BaseResourceCheck):\n    def __init__(self, name, check_id, port):\n        supported_resources = ['azure_security_group_rule', 'azurerm_network_security_rule', 'azurerm_network_security_group']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources)\n        self.port = port\n\n    def is_port_in_range(self, conf):\n        ports = force_list(conf['destination_port_range'][0])\n        for range in ports:\n            if re.match(PORT_RANGE, range):\n                start, end = int(range.split('-')[0]), int(range.split('-')[1])\n                if start <= self.port <= end:\n                    return True\n            if range in [str(self.port), '*']:\n                return True\n        return False\n\n    def scan_resource_conf(self, conf):\n        rule_confs = [conf]\n        if 'security_rule' in conf:\n            rule_confs = conf['security_rule']\n\n        for rule_conf in rule_confs:\n            if 'access' in rule_conf and rule_conf['access'][0] == \"Allow\":\n                if 'direction' in rule_conf and rule_conf['direction'][0] == \"Inbound\":\n                    if 'protocol' in rule_conf and rule_conf['protocol'][0] == 'TCP':\n                        if 'destination_port_range' in rule_conf and self.is_port_in_range(rule_conf):\n                            if 'source_address_prefix' in rule_conf and rule_conf['source_address_prefix'][0] in INTERNET_ADDRESSES:\n                                return CheckResult.FAILED\n        return CheckResult.PASSED\n\n", "path": "checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py"}]}