Bicep join() function causes checkov to fail to parse entire file

[briantkatch]

Describe the issue

Using join() in a value anywhere in a Bicep file causes checkov to fail to parse the entire file.

Also, there does not seem to be any way to get more detail on why checkov failed to parse a file, making debugging/issue identification difficult.

Example Value Please share an example check / use case that this issue will allow checkov to support.

Minimal example: this is valid Bicep and will deploy if you change the tenant ID to your own, and the keyVault name to one that is not already taken:

param keyVaultName array = ['m','y','v','a','u','l','t']

resource connectionStringVault 'Microsoft.KeyVault/vaults@2023-07-01' = {
  name: join(keyVaultName, '') 
  location: 'canadacentral'
  properties: {
    enableRbacAuthorization: true
    sku: {
      family: 'A'
      name: 'standard'
    }
    tenantId: '12345678-9012-4567-8900-abcdefabcdef'
    enablePurgeProtection: true
    enableSoftDelete: true
  }
}

Checkov fails to parse this file.

Of course, we are not using join() for a resource name but rather the value of an environment variable of a Function App, join()ing an array of parameters into a comma-separated list.

If join() cannot be fully supported, it would be better if it was just treated as an un-resolvable parameter so checkov can validate what it understands - checkov does not seem to support Bicep parameter files at the moment anyway (unlike Terraform variable files).

[gruebel]

hey @briantkatch I fixed it in the parser library a while ago, but I can see checkov is pinned to the version before the fix. In general I added support for quite a lot more new Bicep syntax, but haven't released it yet.

[briantkatch]

Hey @gruebel, that's awesome. Is there a separate repo for parser issues?

Is there a way to get a more verbose error/line position when checkov fails to parse a file?

[gruebel]

Yeah, here it is https://github.com/gruebel/pycep

I'm not 100% sure, but if you enable debug logs, then it should be visible, but it is typically very cryptic.