CKV2_AWS_38 - Check not evaluating correctly for private hosted zone

[stevec1980]

Describe the issue CKV2_AWS_38 - This cehck should only faile in the route53 hosted zone is public, however it also fails for private too.

Examples

resource "aws_route53_zone" "ses_private_hosted_zone" { comment = "phz for ses vpc endpoint" lifecycle { ignore_changes = [vpc] } name = "email-smtp.${local.aws_region_name}.amazonaws.com" vpc { vpc_id = aws_vpc.shared_services_vpc.id } }

The presence of vpc config in the resource shows it is a private zone, but the check still fails.

Version (please complete the following information):

• Checkov Version 3.2.3

Additional context none

[JamesWoolfenden]

it's missing the execution of it's test case:

def test_Route53ZoneEnableDNSSECSigning(self):
        self.go("Route53ZoneEnableDNSSECSigning")

from https://github.com/bridgecrewio/checkov/blob/7f2c6865985e940fb43b967dfea73c7a5374529d/tests/terraform/graph/checks/test_yaml_policies.py

and so its test is never running, which fails for your case.

[Saarett]

@JamesWoolfenden Good catch 💪 @stevec1980 How do you feel about contributing the fix? 😄

[stale[bot]]

Thanks for contributing to Checkov! We've automatically marked this issue as stale to keep our issues list tidy, because it has not had any activity for 6 months. It will be closed in 14 days if no further activity occurs. Commenting on this issue will remove the stale tag. If you want to talk through the issue or help us understand the priority and context, feel free to add a comment or join us in the Checkov slack channel at codifiedsecurity.slack.com Thanks!

[aayushsrivastava]

I faced this same problem today. I'll look into contributing a fix when ever I have some free time.