prompt: You will be provided with a partial code base and an issue statement explaining a problem to resolve.
  <issue>
  BC_AWS_PUBLIC_1 does not take Conditions into account
  **Describe the bug**
  BC_AWS_PUBLIC_1 seems to only look for the principal in a ECR Resource Policy. If you want to control access to a repo based on the pricipals AWS Organization ID, you have to do this using a condition instead of a Principal. It seems like checkov does not take this into account.
  
  Example:
  
  ``` yaml
    Repository:
      Type: AWS::ECR::Repository
      Properties:
        RepositoryName: !Ref RepoName
        RepositoryPolicyText:
          Version: "2012-10-17"
          Statement:
            - Sid: OrgRead
              Effect: Allow
              Principal: "*"
              Action:
                - ecr:GetAuthorizationToken
                - ecr:BatchCheckLayerAvailability
                - ecr:GetDownloadUrlForLayer
                - ecr:GetRepositoryPolicy
                - ecr:DescribeRepositories
                - ecr:ListImages
                - ecr:DescribeImages
                - ecr:BatchGetImage
                - ecr:DescribeImageScanFindings
              Condition:
                ForAllValues:StringEquals:
                  aws:PrincipalOrgID: "o-12345678"
  ```  
  
  **To Reproduce**
  Create the above mentioned resource in cloudformation and scan it with checkov
  
  **Expected behavior**
  I expect checkov to look for the usage of a PrincipalOrgID or similar global condition keys and not fail the check when they are used to make the repository non public.
  
  **Desktop (please complete the following information):**
   - OS: macOS 11.5.2
   - Checkov Version 2.0.390
  
  
  </issue>
  <code>
  [start of checkov/terraform/checks/resource/aws/ECRPolicy.py]
  1 
  2 from checkov.common.models.enums import CheckResult, CheckCategories
  3 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
  4 from typing import List
  5 
  6 
  7 class ECRPolicy(BaseResourceCheck):
  8     def __init__(self):
  9         name = "Ensure ECR policy is not set to public"
  10         id = "CKV_AWS_32"
  11         supported_resources = ['aws_ecr_repository_policy']
  12         categories = [CheckCategories.GENERAL_SECURITY]
  13         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  14 
  15     def scan_resource_conf(self, conf):
  16         """
  17             Looks for public * policy for ecr repository:
  18             https://www.terraform.io/docs/providers/aws/r/ecr_repository_policy.html
  19         :param conf: aws_ecr_repository configuration
  20         :return: <CheckResult>
  21         """
  22         if "policy" in conf.keys():
  23             policy = conf["policy"][0]
  24             if type(policy) is str:
  25                 return CheckResult.PASSED
  26             if policy['Statement'][0] and type(policy['Statement'][0]) is dict:
  27                 statement = policy['Statement'][0]
  28                 if statement['Principal'] and type(statement['Principal']) is str:
  29                     principal = statement['Principal']
  30                     if principal == "*":
  31                         self.evaluated_keys = ["policy/Statement/Principal"]
  32                         return CheckResult.FAILED
  33         return CheckResult.PASSED
  34 
  35     def get_evaluated_keys(self) -> List[str]:
  36         return ['policy']
  37 
  38 
  39 check = ECRPolicy()
  40
  [end of checkov/terraform/checks/resource/aws/ECRPolicy.py]
  [start of checkov/cloudformation/checks/resource/aws/ECRPolicy.py]
  1 import json
  2 from typing import List
  3 
  4 from checkov.common.parsers.node import StrNode
  5 from checkov.common.models.enums import CheckResult, CheckCategories
  6 from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck
  7 
  8 
  9 class ECRPolicy(BaseResourceCheck):
  10     def __init__(self):
  11         name = "Ensure ECR policy is not set to public"
  12         id = "CKV_AWS_32"
  13         supported_resources = ['AWS::ECR::Repository']
  14         categories = [CheckCategories.GENERAL_SECURITY]
  15         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  16 
  17     def scan_resource_conf(self, conf):
  18         """
  19             Looks for public * policy for ecr repository:
  20             https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecr-repository.html
  21         :param conf: aws_ecr_repository configuration
  22         :return: <CheckResult>
  23         """
  24         self.evaluated_keys = ["Properties/RepositoryPolicyText/Statement"]
  25         if 'Properties' in conf.keys():
  26             if 'RepositoryPolicyText' in conf['Properties'].keys():
  27                 policy_text = conf['Properties']['RepositoryPolicyText']
  28                 if type(policy_text) in (str, StrNode):
  29                     policy_text = json.loads(str(policy_text))
  30                 if 'Statement' in policy_text.keys():
  31                     for statement_index, statement in enumerate(policy_text['Statement']):
  32                         if 'Principal' in statement.keys():
  33                             for principal_index, principal in enumerate(statement['Principal']):
  34                                 if principal == "*":
  35                                     self.evaluated_keys = [f"Properties/RepositoryPolicyText/Statement/[{statement_index}]/Principal/[{principal_index}]"]
  36                                     return CheckResult.FAILED
  37         return CheckResult.PASSED
  38 
  39 check = ECRPolicy()
  40
  [end of checkov/cloudformation/checks/resource/aws/ECRPolicy.py]
  </code>
  
  I need you to solve this issue by generating a single patch file that I can apply directly to this repository using git apply. Please respond with a single patch file in the following format.
  <patch>
  diff --git a/file.py b/file.py
  --- a/file.py
  +++ b/file.py
  @@ -1,27 +1,35 @@
   def euclidean(a, b):
  -    while b:
  -        a, b = b, a % b
  -    return a
  +    if b == 0:
  +        return a
  +    return euclidean(b, a % b)
   
   
   def bresenham(x0, y0, x1, y1):
       points = []
       dx = abs(x1 - x0)
       dy = abs(y1 - y0)
  -    sx = 1 if x0 < x1 else -1
  -    sy = 1 if y0 < y1 else -1
  -    err = dx - dy
  +    x, y = x0, y0
  +    sx = -1 if x0 > x1 else 1
  +    sy = -1 if y0 > y1 else 1
   
  -    while True:
  -        points.append((x0, y0))
  -        if x0 == x1 and y0 == y1:
  -            break
  -        e2 = 2 * err
  -        if e2 > -dy:
  -            err -= dy
  -            x0 += sx
  -        if e2 < dx:
  -            err += dx
  -            y0 += sy
  +    if dx > dy:
  +        err = dx / 2.0
  +        while x != x1:
  +            points.append((x, y))
  +            err -= dy
  +            if err < 0:
  +                y += sy
  +                err += dx
  +            x += sx
  +    else:
  +        err = dy / 2.0
  +        while y != y1:
  +            points.append((x, y))
  +            err -= dx
  +            if err < 0:
  +                x += sx
  +                err += dy
  +            y += sy
  +
  +    points.append((x, y))
       return points
  
  </patch>
golden_diff: diff --git a/checkov/cloudformation/checks/resource/aws/ECRPolicy.py b/checkov/cloudformation/checks/resource/aws/ECRPolicy.py
  --- a/checkov/cloudformation/checks/resource/aws/ECRPolicy.py
  +++ b/checkov/cloudformation/checks/resource/aws/ECRPolicy.py
  @@ -31,9 +31,22 @@
                       for statement_index, statement in enumerate(policy_text['Statement']):
                           if 'Principal' in statement.keys():
                               for principal_index, principal in enumerate(statement['Principal']):
  -                                if principal == "*":
  +                                if principal == "*" and not self.check_for_constrained_condition(statement):
                                       self.evaluated_keys = [f"Properties/RepositoryPolicyText/Statement/[{statement_index}]/Principal/[{principal_index}]"]
                                       return CheckResult.FAILED
           return CheckResult.PASSED
   
  +    def check_for_constrained_condition(self, statement):
  +        """
  +        Checks to see if there is a constraint on a a wildcarded principal
  +        :param statement: statement from aws_repository_configuration
  +        :return: true if there is a constraint
  +        """
  +        if 'Condition' in statement.keys():
  +            condition = statement['Condition']
  +            if 'ForAllValues:StringEquals' in condition.keys():
  +                if 'aws:PrincipalOrgID' in condition['ForAllValues:StringEquals'].keys():
  +                    return True
  +        return False
  +
   check = ECRPolicy()
  diff --git a/checkov/terraform/checks/resource/aws/ECRPolicy.py b/checkov/terraform/checks/resource/aws/ECRPolicy.py
  --- a/checkov/terraform/checks/resource/aws/ECRPolicy.py
  +++ b/checkov/terraform/checks/resource/aws/ECRPolicy.py
  @@ -27,7 +27,7 @@
                   statement = policy['Statement'][0]
                   if statement['Principal'] and type(statement['Principal']) is str:
                       principal = statement['Principal']
  -                    if principal == "*":
  +                    if principal == "*"  and not self.check_for_constrained_condition(statement):
                           self.evaluated_keys = ["policy/Statement/Principal"]
                           return CheckResult.FAILED
           return CheckResult.PASSED
  @@ -35,5 +35,17 @@
       def get_evaluated_keys(self) -> List[str]:
           return ['policy']
   
  +    def check_for_constrained_condition(self, statement):
  +        """
  +        Checks to see if there is a constraint on a a wildcarded principal
  +        :param statement: statement from aws_repository_configuration
  +        :return: True if there is a constraint
  +        """
  +        if 'Condition' in statement and isinstance(statement['Condition'], dict):
  +            condition = statement['Condition']
  +            if 'ForAllValues:StringEquals' in condition and isinstance(condition['ForAllValues:StringEquals'], dict):
  +                if 'aws:PrincipalOrgID' in condition['ForAllValues:StringEquals']:
  +                    return True
  +        return False
   
   check = ECRPolicy()
  
verification_info: {"golden_diff": "diff --git a/checkov/cloudformation/checks/resource/aws/ECRPolicy.py b/checkov/cloudformation/checks/resource/aws/ECRPolicy.py\n--- a/checkov/cloudformation/checks/resource/aws/ECRPolicy.py\n+++ b/checkov/cloudformation/checks/resource/aws/ECRPolicy.py\n@@ -31,9 +31,22 @@\n                     for statement_index, statement in enumerate(policy_text['Statement']):\n                         if 'Principal' in statement.keys():\n                             for principal_index, principal in enumerate(statement['Principal']):\n-                                if principal == \"*\":\n+                                if principal == \"*\" and not self.check_for_constrained_condition(statement):\n                                     self.evaluated_keys = [f\"Properties/RepositoryPolicyText/Statement/[{statement_index}]/Principal/[{principal_index}]\"]\n                                     return CheckResult.FAILED\n         return CheckResult.PASSED\n \n+    def check_for_constrained_condition(self, statement):\n+        \"\"\"\n+        Checks to see if there is a constraint on a a wildcarded principal\n+        :param statement: statement from aws_repository_configuration\n+        :return: true if there is a constraint\n+        \"\"\"\n+        if 'Condition' in statement.keys():\n+            condition = statement['Condition']\n+            if 'ForAllValues:StringEquals' in condition.keys():\n+                if 'aws:PrincipalOrgID' in condition['ForAllValues:StringEquals'].keys():\n+                    return True\n+        return False\n+\n check = ECRPolicy()\ndiff --git a/checkov/terraform/checks/resource/aws/ECRPolicy.py b/checkov/terraform/checks/resource/aws/ECRPolicy.py\n--- a/checkov/terraform/checks/resource/aws/ECRPolicy.py\n+++ b/checkov/terraform/checks/resource/aws/ECRPolicy.py\n@@ -27,7 +27,7 @@\n                 statement = policy['Statement'][0]\n                 if statement['Principal'] and type(statement['Principal']) is str:\n                     principal = statement['Principal']\n-                    if principal == \"*\":\n+                    if principal == \"*\"  and not self.check_for_constrained_condition(statement):\n                         self.evaluated_keys = [\"policy/Statement/Principal\"]\n                         return CheckResult.FAILED\n         return CheckResult.PASSED\n@@ -35,5 +35,17 @@\n     def get_evaluated_keys(self) -> List[str]:\n         return ['policy']\n \n+    def check_for_constrained_condition(self, statement):\n+        \"\"\"\n+        Checks to see if there is a constraint on a a wildcarded principal\n+        :param statement: statement from aws_repository_configuration\n+        :return: True if there is a constraint\n+        \"\"\"\n+        if 'Condition' in statement and isinstance(statement['Condition'], dict):\n+            condition = statement['Condition']\n+            if 'ForAllValues:StringEquals' in condition and isinstance(condition['ForAllValues:StringEquals'], dict):\n+                if 'aws:PrincipalOrgID' in condition['ForAllValues:StringEquals']:\n+                    return True\n+        return False\n \n check = ECRPolicy()\n", "issue": "BC_AWS_PUBLIC_1 does not take Conditions into account\n**Describe the bug**\r\nBC_AWS_PUBLIC_1 seems to only look for the principal in a ECR Resource Policy. If you want to control access to a repo based on the pricipals AWS Organization ID, you have to do this using a condition instead of a Principal. It seems like checkov does not take this into account.\r\n\r\nExample:\r\n\r\n``` yaml\r\n  Repository:\r\n    Type: AWS::ECR::Repository\r\n    Properties:\r\n      RepositoryName: !Ref RepoName\r\n      RepositoryPolicyText:\r\n        Version: \"2012-10-17\"\r\n        Statement:\r\n          - Sid: OrgRead\r\n            Effect: Allow\r\n            Principal: \"*\"\r\n            Action:\r\n              - ecr:GetAuthorizationToken\r\n              - ecr:BatchCheckLayerAvailability\r\n              - ecr:GetDownloadUrlForLayer\r\n              - ecr:GetRepositoryPolicy\r\n              - ecr:DescribeRepositories\r\n              - ecr:ListImages\r\n              - ecr:DescribeImages\r\n              - ecr:BatchGetImage\r\n              - ecr:DescribeImageScanFindings\r\n            Condition:\r\n              ForAllValues:StringEquals:\r\n                aws:PrincipalOrgID: \"o-12345678\"\r\n```  \r\n\r\n**To Reproduce**\r\nCreate the above mentioned resource in cloudformation and scan it with checkov\r\n\r\n**Expected behavior**\r\nI expect checkov to look for the usage of a PrincipalOrgID or similar global condition keys and not fail the check when they are used to make the repository non public.\r\n\r\n**Desktop (please complete the following information):**\r\n - OS: macOS 11.5.2\r\n - Checkov Version 2.0.390\r\n\n", "before_files": [{"content": "\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom typing import List\n\n\nclass ECRPolicy(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure ECR policy is not set to public\"\n        id = \"CKV_AWS_32\"\n        supported_resources = ['aws_ecr_repository_policy']\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for public * policy for ecr repository:\n            https://www.terraform.io/docs/providers/aws/r/ecr_repository_policy.html\n        :param conf: aws_ecr_repository configuration\n        :return: <CheckResult>\n        \"\"\"\n        if \"policy\" in conf.keys():\n            policy = conf[\"policy\"][0]\n            if type(policy) is str:\n                return CheckResult.PASSED\n            if policy['Statement'][0] and type(policy['Statement'][0]) is dict:\n                statement = policy['Statement'][0]\n                if statement['Principal'] and type(statement['Principal']) is str:\n                    principal = statement['Principal']\n                    if principal == \"*\":\n                        self.evaluated_keys = [\"policy/Statement/Principal\"]\n                        return CheckResult.FAILED\n        return CheckResult.PASSED\n\n    def get_evaluated_keys(self) -> List[str]:\n        return ['policy']\n\n\ncheck = ECRPolicy()\n", "path": "checkov/terraform/checks/resource/aws/ECRPolicy.py"}, {"content": "import json\nfrom typing import List\n\nfrom checkov.common.parsers.node import StrNode\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass ECRPolicy(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure ECR policy is not set to public\"\n        id = \"CKV_AWS_32\"\n        supported_resources = ['AWS::ECR::Repository']\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for public * policy for ecr repository:\n            https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecr-repository.html\n        :param conf: aws_ecr_repository configuration\n        :return: <CheckResult>\n        \"\"\"\n        self.evaluated_keys = [\"Properties/RepositoryPolicyText/Statement\"]\n        if 'Properties' in conf.keys():\n            if 'RepositoryPolicyText' in conf['Properties'].keys():\n                policy_text = conf['Properties']['RepositoryPolicyText']\n                if type(policy_text) in (str, StrNode):\n                    policy_text = json.loads(str(policy_text))\n                if 'Statement' in policy_text.keys():\n                    for statement_index, statement in enumerate(policy_text['Statement']):\n                        if 'Principal' in statement.keys():\n                            for principal_index, principal in enumerate(statement['Principal']):\n                                if principal == \"*\":\n                                    self.evaluated_keys = [f\"Properties/RepositoryPolicyText/Statement/[{statement_index}]/Principal/[{principal_index}]\"]\n                                    return CheckResult.FAILED\n        return CheckResult.PASSED\n\ncheck = ECRPolicy()\n", "path": "checkov/cloudformation/checks/resource/aws/ECRPolicy.py"}]}