prompt: You will be provided with a partial code base and an issue statement explaining a problem to resolve.
  <issue>
  Scanning IAM Role Public Access
  Describe the bug
  It seems when specifying more than one  json, the policy does not scan all principals, rather it looks at the first one. 
  
  To Reproduce
  Steps to reproduce the behavior:
  
  Create policy with more than one SID
  `resource "aws_iam_role" "lambdaRole" {
    name               = "test-role"
    assume_role_policy = <<EOF
  {
    "Version": "2012-10-17",
    "Statement": [
        {
          "Action": "sts:AssumeRole",
          "Principal" : {"Service": "lambda.amazonaws.com"},
          "Effect": "Allow"
        },
        {
          "Action": "sts:AssumeRole",
          "Principal" : {"AWS": "*"},
          "Effect": "Allow"
        },
        {
          "Action": "sts:AssumeRole",
          "Principal" : {"Service": "events.amazonaws.com"},
          "Effect": "Allow"
        },
    ]
  }
  
  EOF
  }`
  Run Checkov against policy
  Expected behavior
  I would expect the scan to check each json within the policy rather than the first one
  
  Desktop (please complete the following information):
  
  OS: Mac
  Checkov Version: 1.0.459
  
  
  </issue>
  <code>
  [start of checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py]
  1 from checkov.common.models.enums import CheckResult, CheckCategories
  2 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
  3 import json
  4 
  5 
  6 class IAMRoleAllowsPublicAssume(BaseResourceCheck):
  7 
  8     def __init__(self):
  9         name = "Ensure IAM role allows only specific services or principals to assume it"
  10         id = "CKV_AWS_60"
  11         supported_resources = ['aws_iam_role']
  12         categories = [CheckCategories.IAM]
  13         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  14 
  15     def scan_resource_conf(self, conf):
  16         if isinstance(conf['assume_role_policy'][0], str):
  17             try:
  18                 assume_role_block = json.loads(conf['assume_role_policy'][0])
  19                 if 'Statement' in assume_role_block.keys():
  20                     if 'Principal' in assume_role_block['Statement'][0]:
  21                         if 'AWS' in assume_role_block['Statement'][0]['Principal']:
  22                             if assume_role_block['Statement'][0]['Principal']['AWS'] == '*':
  23                                     return CheckResult.FAILED
  24             except: # nosec
  25                 pass
  26         return CheckResult.PASSED
  27 
  28 
  29 check = IAMRoleAllowsPublicAssume()
  30
  [end of checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py]
  </code>
  
  I need you to solve this issue by generating a single patch file that I can apply directly to this repository using git apply. Please respond with a single patch file in the following format.
  <patch>
  diff --git a/file.py b/file.py
  --- a/file.py
  +++ b/file.py
  @@ -1,27 +1,35 @@
   def euclidean(a, b):
  -    while b:
  -        a, b = b, a % b
  -    return a
  +    if b == 0:
  +        return a
  +    return euclidean(b, a % b)
   
   
   def bresenham(x0, y0, x1, y1):
       points = []
       dx = abs(x1 - x0)
       dy = abs(y1 - y0)
  -    sx = 1 if x0 < x1 else -1
  -    sy = 1 if y0 < y1 else -1
  -    err = dx - dy
  +    x, y = x0, y0
  +    sx = -1 if x0 > x1 else 1
  +    sy = -1 if y0 > y1 else 1
   
  -    while True:
  -        points.append((x0, y0))
  -        if x0 == x1 and y0 == y1:
  -            break
  -        e2 = 2 * err
  -        if e2 > -dy:
  -            err -= dy
  -            x0 += sx
  -        if e2 < dx:
  -            err += dx
  -            y0 += sy
  +    if dx > dy:
  +        err = dx / 2.0
  +        while x != x1:
  +            points.append((x, y))
  +            err -= dy
  +            if err < 0:
  +                y += sy
  +                err += dx
  +            x += sx
  +    else:
  +        err = dy / 2.0
  +        while y != y1:
  +            points.append((x, y))
  +            err -= dx
  +            if err < 0:
  +                x += sx
  +                err += dy
  +            y += sy
  +
  +    points.append((x, y))
       return points
  
  </patch>
golden_diff: diff --git a/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py b/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py
  --- a/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py
  +++ b/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py
  @@ -17,10 +17,10 @@
               try:
                   assume_role_block = json.loads(conf['assume_role_policy'][0])
                   if 'Statement' in assume_role_block.keys():
  -                    if 'Principal' in assume_role_block['Statement'][0]:
  -                        if 'AWS' in assume_role_block['Statement'][0]['Principal']:
  -                            if assume_role_block['Statement'][0]['Principal']['AWS'] == '*':
  -                                    return CheckResult.FAILED
  +                    for statement in assume_role_block['Statement']:
  +                        if 'AWS' in statement['Principal']:
  +                            if statement['Principal']['AWS'] == '*':
  +                                return CheckResult.FAILED
               except: # nosec
                   pass
           return CheckResult.PASSED
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py b/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py\n--- a/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py\n+++ b/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py\n@@ -17,10 +17,10 @@\n             try:\n                 assume_role_block = json.loads(conf['assume_role_policy'][0])\n                 if 'Statement' in assume_role_block.keys():\n-                    if 'Principal' in assume_role_block['Statement'][0]:\n-                        if 'AWS' in assume_role_block['Statement'][0]['Principal']:\n-                            if assume_role_block['Statement'][0]['Principal']['AWS'] == '*':\n-                                    return CheckResult.FAILED\n+                    for statement in assume_role_block['Statement']:\n+                        if 'AWS' in statement['Principal']:\n+                            if statement['Principal']['AWS'] == '*':\n+                                return CheckResult.FAILED\n             except: # nosec\n                 pass\n         return CheckResult.PASSED\n", "issue": "Scanning IAM Role Public Access\nDescribe the bug\r\nIt seems when specifying more than one  json, the policy does not scan all principals, rather it looks at the first one. \r\n\r\nTo Reproduce\r\nSteps to reproduce the behavior:\r\n\r\nCreate policy with more than one SID\r\n`resource \"aws_iam_role\" \"lambdaRole\" {\r\n  name               = \"test-role\"\r\n  assume_role_policy = <<EOF\r\n{\r\n  \"Version\": \"2012-10-17\",\r\n  \"Statement\": [\r\n      {\r\n        \"Action\": \"sts:AssumeRole\",\r\n        \"Principal\" : {\"Service\": \"lambda.amazonaws.com\"},\r\n        \"Effect\": \"Allow\"\r\n      },\r\n      {\r\n        \"Action\": \"sts:AssumeRole\",\r\n        \"Principal\" : {\"AWS\": \"*\"},\r\n        \"Effect\": \"Allow\"\r\n      },\r\n      {\r\n        \"Action\": \"sts:AssumeRole\",\r\n        \"Principal\" : {\"Service\": \"events.amazonaws.com\"},\r\n        \"Effect\": \"Allow\"\r\n      },\r\n  ]\r\n}\r\n\r\nEOF\r\n}`\r\nRun Checkov against policy\r\nExpected behavior\r\nI would expect the scan to check each json within the policy rather than the first one\r\n\r\nDesktop (please complete the following information):\r\n\r\nOS: Mac\r\nCheckov Version: 1.0.459\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nimport json\n\n\nclass IAMRoleAllowsPublicAssume(BaseResourceCheck):\n\n    def __init__(self):\n        name = \"Ensure IAM role allows only specific services or principals to assume it\"\n        id = \"CKV_AWS_60\"\n        supported_resources = ['aws_iam_role']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if isinstance(conf['assume_role_policy'][0], str):\n            try:\n                assume_role_block = json.loads(conf['assume_role_policy'][0])\n                if 'Statement' in assume_role_block.keys():\n                    if 'Principal' in assume_role_block['Statement'][0]:\n                        if 'AWS' in assume_role_block['Statement'][0]['Principal']:\n                            if assume_role_block['Statement'][0]['Principal']['AWS'] == '*':\n                                    return CheckResult.FAILED\n            except: # nosec\n                pass\n        return CheckResult.PASSED\n\n\ncheck = IAMRoleAllowsPublicAssume()\n", "path": "checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py"}]}