CKV_AWS_111 - cloudformation check cloudwatch:PutMetricData

Describe the bug When running checkov against a cloudformation template with an IAM policy including the action cloudwatch:PutMetricData and a condition limiting the action to a specific namepace, the CKV_AWS_111 rule is triggered. Since PutMetricData doesn’t support limiting by a resource, the condition seems like it should be a sufficient control to limit write access.

To Reproduce Steps to reproduce the behavior:

1. Create a Cloudformation template containing a policy that looks like:

- Sid: AllowPutMetricData
  Effect: Allow
  Action:
    - cloudwatch:PutMetricData
  Resource: "*"
  Condition:
    StringEquals:
      cloudwatch:namespace: Namespace

1. Run checkov -d </path/to/cloudformation> --quiet
2. You should see checkov flag the policy as a violation of CKV_AWS_111

Expected behavior I expect checkov to consider that policy valid for the CKV_AWS_111 rule.

Desktop (please complete the following information):

• OS: MacOS
• Checkov Version 1.0.844

Thanks ahead of time for reviewing this and thanks for the awesome tool!

[kmcquade]

@schosterbarak I like that idea from @yi2020 too. If you want to contribute that to Cloudsplaining, we can fix it in both places!

[yi2020]

@kmcquade our approach with Cloudrail has been to assume that if there are conditions, it’s not really *. We do in some cases dig through the condition to see if it really limits anything, but the amount of logic required was insane.