如何用Checkov检查Terraform后端credentials是否以#{开头？

我刚开始使用Checkov为Terraform编写自定义策略，希望强制检查Terraform后端配置中credentials属性的值是否以#{开头。相关代码及问题说明如下：

• backend.tf 内容

terraform {
  backend "gcs" {
    bucket = "odeploy"
    prefix = "dev"
    credentials = "#{gcpcred.JsonKey | FromBase64 | JsonEscape}"
  }
}

• 自定义检查策略 Customcheck.yaml 内容

metadata:
  name: "Check that the credentials in backend block starts with #{"
  id: "CKV2_GOOGLE_3"
  category: "GENERAL_SECURITY"
definition:
  cond_type: "attribute"
  resource_types:
  - terraform.backend # 尝试过"terraform"、"backend.gcs"等其他写法
  attribute: "backend.*.credentials" # 也尝试过"backend.gcs.credentials"/"credentials"
  operator: starting_with
  value: "#{"

该策略未生效，但针对provider块的类似策略（customcheck2.yaml）却能正常工作：

• customcheck2.yaml 内容

metadata:
  name: "Check that the credentials in provider block starts with #{"
  id: "CKV2_GOOGLE_1"
  category: "GENERAL_SECURITY"
scope:
  provider: google
definition:
  cond_type: "attribute"
  resource_types: 
    - provider.google
  attribute: "credentials"
  operator: starting_with
  value: "#{"

• provider.tf 内容

provider "google" {
  project = "some-project"
  region  = "us-east4"
  zone    = "us-east4-c"
  credentials = "#{gcpcred.JsonKey | FromBase64 | JsonEscape}"
}

请问如何让针对Terraform后端的检查策略生效？

Terraform后端在Checkov中的资源类型和属性路径与provider不同，需调整自定义策略配置，具体修改如下：

修改后的Customcheck.yaml：

metadata:
  name: "Check that the credentials in backend block starts with #{"
  id: "CKV2_GOOGLE_3"
  category: "GENERAL_SECURITY"
definition:
  cond_type: "attribute"
  resource_types:
    - terraform_backend
  attribute: "config.credentials"
  operator: starting_with
  value: "#{"

关键修改点：

• resource_types：使用terraform_backend作为资源类型，这是Checkov识别Terraform后端块的正确标识
• attribute：后端的所有配置字段都嵌套在config节点下，因此需要通过config.credentials定位到目标属性

调整后，Checkov即可正确识别并检查Terraform后端的credentials值是否符合要求。

内容的提问来源于stack exchange，提问作者rin2025