fix(terraform): Lambda images don't have code signing

checkov/terraform/checks/resource/aws/LambdaCodeSigningConfigured.py

@@ -1,6 +1,9 @@
+from __future__ import annotations
+
+from typing import Any
 from checkov.common.models.consts import ANY_VALUE
 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
-from checkov.common.models.enums import CheckCategories
+from checkov.common.models.enums import CheckCategories, CheckResult
 
 
 class LambdaCodeSigningConfigured(BaseResourceValueCheck):
@@ -11,6 +14,12 @@ def __init__(self):
         categories = [CheckCategories.SUPPLY_CHAIN]
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
+    def scan_resource_conf(self, conf: dict[str, Any], entity_type: str = None):
+        # Code signing only applies to Zip package type, not Image (container)
+        if conf.get("package_type") == "Image":
+            return CheckResult.PASSED
+        return super().scan_resource_conf(conf, entity_type)
+
     def get_inspected_key(self):
         return "code_signing_config_arn"
 

tests/terraform/checks/resource/aws/example_LambdaCodeSigningConfigured/main.tf

@@ -14,3 +14,12 @@ resource "aws_lambda_function" "fail" {
   role          = ""
   runtime       = "python3.9"
 }
+
+# pass (Image package type - code signing not applicable)
+
+resource "aws_lambda_function" "image_pass" {
+  function_name = "test-image"
+  role          = ""
+  package_type  = "Image"
+  image_uri     = "123456789012.dkr.ecr.us-east-1.amazonaws.com/myimage:latest"
+}

tests/terraform/checks/resource/aws/test_LambdaCodeSigningConfigured.py

@@ -6,7 +6,7 @@
 from checkov.terraform.runner import Runner
 
 
-class TestWafHasAnyRules(unittest.TestCase):
+class TestLambdaCodeSigningConfigured(unittest.TestCase):
     def test(self):
         # given
         test_files_dir = Path(__file__).parent / "example_LambdaCodeSigningConfigured"
@@ -17,18 +17,21 @@ def test(self):
         # then
         summary = report.get_summary()
 
+        # pass: has code_signing_config_arn; image_pass: package_type=Image (check skipped, passes)
         passing_resources = {
-            "aws_lambda_function.pass"
+            "aws_lambda_function.pass",
+            "aws_lambda_function.image_pass",
         }
 
+        # fail: Zip package type (default) without code_signing_config_arn
         failing_resources = {
             "aws_lambda_function.fail"
         }
 
         passed_check_resources = {c.resource for c in report.passed_checks}
         failed_check_resources = {c.resource for c in report.failed_checks}
 
-        self.assertEqual(summary["passed"], 1)
+        self.assertEqual(summary["passed"], 2)
         self.assertEqual(summary["failed"], 1)
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)