False positive for CKV_AZURE_43: check storage account name

I’m building my Storage Account names like this

name                = "${local.saname_prefix}diagnostics${module.tf-var-project.random_id}

With https://github.com/bridgecrewio/checkov/pull/429 merged I now get a Check failure on the SA name:

Check: CKV_AZURE_43: "Ensure the Storage Account naming rules"
	FAILED for resource: azurerm_storage_account.diagnostics
	File: /az_diag_sa.tf:8-22

		8  | resource "azurerm_storage_account" "diagnostics" {
		9  |   #checkov:skip=CKV_AZURE_35:Public access is allowed
		10 |   name                = "${local.saname_prefix}diagnostics${module.tf-var-project.random_id}"

[daviddob]

Can confirm the same behavior with the false positive. I have the following variable for name which ensures the same regex validation

variable "name" {
  description = "Storage account name"
  type = string
  validation {
    condition     = can(regex("^[a-z0-9]{3,24}$", var.name))
    error_message = "Storage account names must be between 3 and 24 characters in length and may contain numbers and lowercase letters only and must be globally unique."
  }
}

however when passing it in as follows, CKV_AZURE_43 is raised

resource "azurerm_storage_account" "stg" {
  name                      = var.name
...
}

though hardcoding it to something that passes the regex satisfies the condition.

resource "azurerm_storage_account" "stg" {
  name                      = "foo"
 ...
 }

It is likely validating the literal var.name instead of a potential variable and as such because var.name the literal has a . it will fail to satisfy the regex and raise the error. Ideally the check would have to evaluate variables (and determine what do if no default exists) and see if they satisfy the constraint, however that may be a bit much to ask.

[JamesWoolfenden]

i can replicate this one @metahertz ill show u test code tomox