Switch from regex to sharing logic from parser_var_blocks for var identification
MODIFY
checkov/terraform/checks/resource/base_resource_value_check.py
checkov/terraform/checks/resource/base_resource_value_check.py
@@ -5,8 +5,7 @@ from checkov.terraform.checks.resource.base_resource_check import BaseResourceCh
from checkov.common.models.enums import CheckResult
from checkov.common.models.consts import ANY_VALUE
from checkov.common.util.type_forcers import force_list
-
-VARIABLE_DEPENDANT_REGEX = re.compile(r'\${([^{}]+?)}')
+from checkov.terraform.parser_var_blocks import find_var_blocks
class BaseResourceValueCheck(BaseResourceCheck):
@@ -27,8 +26,10 @@ class BaseResourceValueCheck(BaseResourceCheck):
def _is_variable_dependant(value):
if not isinstance(value, str):
return False
+ if "${" not in value:
+ return False
- if VARIABLE_DEPENDANT_REGEX.search(value):
+ if find_var_blocks(value):
return True
return False

Switch from regex to sharing logic from parser_var_blocks for var identification