fix(bicep): enforce encryption flag to be string for CKV_AZURE_97

checkov/arm/checks/resource/VMEncryptionAtHostEnabled.py

@@ -28,7 +28,7 @@ def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
                 input_dict=conf, key_path="properties/virtualMachineProfile/securityProfile/encryptionAtHost"
             )
 
-        if encryption == "true":
+        if str(encryption).lower() == "true":
             return CheckResult.PASSED
 
         return CheckResult.FAILED

tests/bicep/checks/resource/azure/example_VMEncryptionAtHostEnabled/main.bicep

@@ -0,0 +1,23 @@
+// pass
+
+resource enabled 'Microsoft.Compute/virtualMachines@2021-11-01' = {
+  name: virtualMachineName
+  location: location
+  properties: {
+    securityProfile: {
+      encryptionAtHost: true
+    }
+  }
+}
+
+// fail
+
+resource disabled 'Microsoft.Compute/virtualMachines@2021-11-01' = {
+  name: virtualMachineName
+  location: location
+  properties: {
+    securityProfile: {
+      encryptionAtHost: false
+    }
+  }
+}

tests/bicep/checks/resource/azure/test_VMEncryptionAtHostEnabled.py

@@ -0,0 +1,35 @@
+from pathlib import Path
+
+from checkov.bicep.runner import Runner
+from checkov.arm.checks.resource.VMEncryptionAtHostEnabled import check
+from checkov.runner_filter import RunnerFilter
+
+
+def test_examples():
+    # given
+    test_files_dir = Path(__file__).parent / "example_VMEncryptionAtHostEnabled"
+
+    # when
+    report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id]))
+
+    # then
+    summary = report.get_summary()
+
+    passing_resources = {
+        "Microsoft.Compute/virtualMachines.enabled",
+    }
+
+    failing_resources = {
+        "Microsoft.Compute/virtualMachines.disabled",
+    }
+
+    passed_check_resources = {c.resource for c in report.passed_checks}
+    failed_check_resources = {c.resource for c in report.failed_checks}
+
+    assert summary["passed"] == len(passing_resources)
+    assert summary["failed"] == len(failing_resources)
+    assert summary["skipped"] == 0
+    assert summary["parsing_errors"] == 0
+
+    assert passed_check_resources == passing_resources
+    assert failed_check_resources == failing_resources