prompt: You will be provided with a partial code base and an issue statement explaining a problem to resolve.
  <issue>
  Add new check: IAM Policies should not be attached to a user
  Attach policies only to groups or roles 
  
  https://www.terraform.io/docs/providers/aws/r/iam_user_policy.html
  https://www.terraform.io/docs/providers/aws/r/iam_user_policy_attachment.html
  users: https://www.terraform.io/docs/providers/aws/r/iam_policy_attachment.html
  
  Policies / ManagedPolicyArns: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-user.html
  Users: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html
  
  
  
  </issue>
  <code>
  [start of checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py]
  1 from checkov.common.models.enums import CheckResult, CheckCategories
  2 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
  3 
  4 
  5 class IAMPolicyAttachedToGroupOrRoles(BaseResourceCheck):
  6     def __init__(self):
  7         name = "Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may " \
  8                "in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) "
  9         id = "CKV_AWS_40"
  10         supported_resources = ['aws_iam_user_policy_attachment', 'aws_iam_user_policy', 'aws_iam_policy_attachment']
  11         categories = [CheckCategories.IAM]
  12         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  13 
  14     def scan_resource_conf(self, conf):
  15         if 'user' in conf.keys() or 'users' in conf.keys():
  16             return CheckResult.FAILED
  17         return CheckResult.PASSED
  18 
  19 check = IAMPolicyAttachedToGroupOrRoles()
  20
  [end of checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py]
  </code>
  
  I need you to solve this issue by generating a single patch file that I can apply directly to this repository using git apply. Please respond with a single patch file in the following format.
  <patch>
  diff --git a/file.py b/file.py
  --- a/file.py
  +++ b/file.py
  @@ -1,27 +1,35 @@
   def euclidean(a, b):
  -    while b:
  -        a, b = b, a % b
  -    return a
  +    if b == 0:
  +        return a
  +    return euclidean(b, a % b)
   
   
   def bresenham(x0, y0, x1, y1):
       points = []
       dx = abs(x1 - x0)
       dy = abs(y1 - y0)
  -    sx = 1 if x0 < x1 else -1
  -    sy = 1 if y0 < y1 else -1
  -    err = dx - dy
  +    x, y = x0, y0
  +    sx = -1 if x0 > x1 else 1
  +    sy = -1 if y0 > y1 else 1
   
  -    while True:
  -        points.append((x0, y0))
  -        if x0 == x1 and y0 == y1:
  -            break
  -        e2 = 2 * err
  -        if e2 > -dy:
  -            err -= dy
  -            x0 += sx
  -        if e2 < dx:
  -            err += dx
  -            y0 += sy
  +    if dx > dy:
  +        err = dx / 2.0
  +        while x != x1:
  +            points.append((x, y))
  +            err -= dy
  +            if err < 0:
  +                y += sy
  +                err += dx
  +            x += sx
  +    else:
  +        err = dy / 2.0
  +        while y != y1:
  +            points.append((x, y))
  +            err -= dx
  +            if err < 0:
  +                x += sx
  +                err += dy
  +            y += sy
  +
  +    points.append((x, y))
       return points
  
  </patch>
golden_diff: diff --git a/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py b/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py
  --- a/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py
  +++ b/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py
  @@ -12,8 +12,9 @@
           super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
   
       def scan_resource_conf(self, conf):
  -        if 'user' in conf.keys() or 'users' in conf.keys():
  +        if 'user' in conf.keys() or ('users' in conf.keys() and len(conf['users'][0]) > 0):
               return CheckResult.FAILED
           return CheckResult.PASSED
   
  +
   check = IAMPolicyAttachedToGroupOrRoles()
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py b/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py\n--- a/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py\n+++ b/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py\n@@ -12,8 +12,9 @@\n         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n \n     def scan_resource_conf(self, conf):\n-        if 'user' in conf.keys() or 'users' in conf.keys():\n+        if 'user' in conf.keys() or ('users' in conf.keys() and len(conf['users'][0]) > 0):\n             return CheckResult.FAILED\n         return CheckResult.PASSED\n \n+\n check = IAMPolicyAttachedToGroupOrRoles()\n", "issue": "Add new check: IAM Policies should not be attached to a user\nAttach policies only to groups or roles \r\n\r\nhttps://www.terraform.io/docs/providers/aws/r/iam_user_policy.html\r\nhttps://www.terraform.io/docs/providers/aws/r/iam_user_policy_attachment.html\r\nusers: https://www.terraform.io/docs/providers/aws/r/iam_policy_attachment.html\r\n\r\nPolicies / ManagedPolicyArns: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-user.html\r\nUsers: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html\r\n\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass IAMPolicyAttachedToGroupOrRoles(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may \" \\\n               \"in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) \"\n        id = \"CKV_AWS_40\"\n        supported_resources = ['aws_iam_user_policy_attachment', 'aws_iam_user_policy', 'aws_iam_policy_attachment']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if 'user' in conf.keys() or 'users' in conf.keys():\n            return CheckResult.FAILED\n        return CheckResult.PASSED\n\ncheck = IAMPolicyAttachedToGroupOrRoles()\n", "path": "checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py"}]}