diff --git a/checkov/arm/checks/resource/VMEncryptionAtHostEnabled.py b/checkov/arm/checks/resource/VMEncryptionAtHostEnabled.py index 3541deacf5b..3b1fd40b61c 100644 --- a/checkov/arm/checks/resource/VMEncryptionAtHostEnabled.py +++ b/checkov/arm/checks/resource/VMEncryptionAtHostEnabled.py @@ -28,7 +28,7 @@ def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: input_dict=conf, key_path="properties/virtualMachineProfile/securityProfile/encryptionAtHost" ) - if encryption == "true": + if str(encryption).lower() == "true": return CheckResult.PASSED return CheckResult.FAILED diff --git a/tests/bicep/checks/resource/azure/example_VMEncryptionAtHostEnabled/main.bicep b/tests/bicep/checks/resource/azure/example_VMEncryptionAtHostEnabled/main.bicep new file mode 100644 index 00000000000..98f0dc0c4f0 --- /dev/null +++ b/tests/bicep/checks/resource/azure/example_VMEncryptionAtHostEnabled/main.bicep @@ -0,0 +1,23 @@ +// pass + +resource enabled 'Microsoft.Compute/virtualMachines@2021-11-01' = { + name: virtualMachineName + location: location + properties: { + securityProfile: { + encryptionAtHost: true + } + } +} + +// fail + +resource disabled 'Microsoft.Compute/virtualMachines@2021-11-01' = { + name: virtualMachineName + location: location + properties: { + securityProfile: { + encryptionAtHost: false + } + } +} diff --git a/tests/bicep/checks/resource/azure/test_VMEncryptionAtHostEnabled.py b/tests/bicep/checks/resource/azure/test_VMEncryptionAtHostEnabled.py new file mode 100644 index 00000000000..2be34c14ec6 --- /dev/null +++ b/tests/bicep/checks/resource/azure/test_VMEncryptionAtHostEnabled.py @@ -0,0 +1,35 @@ +from pathlib import Path + +from checkov.bicep.runner import Runner +from checkov.arm.checks.resource.VMEncryptionAtHostEnabled import check +from checkov.runner_filter import RunnerFilter + + +def test_examples(): + # given + test_files_dir = Path(__file__).parent / "example_VMEncryptionAtHostEnabled" + + # when + report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) + + # then + summary = report.get_summary() + + passing_resources = { + "Microsoft.Compute/virtualMachines.enabled", + } + + failing_resources = { + "Microsoft.Compute/virtualMachines.disabled", + } + + passed_check_resources = {c.resource for c in report.passed_checks} + failed_check_resources = {c.resource for c in report.failed_checks} + + assert summary["passed"] == len(passing_resources) + assert summary["failed"] == len(failing_resources) + assert summary["skipped"] == 0 + assert summary["parsing_errors"] == 0 + + assert passed_check_resources == passing_resources + assert failed_check_resources == failing_resources