feat(terraform): add CKV_AWS_394 for unconstrained aws_availability_zones data source

[madhavvishnubhatta]

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

Adds a new check, CKV_AWS_394, that flags a Terraform aws_availability_zones data source when it does not constrain which zones are returned. An unconstrained data source (e.g. data "aws_availability_zones" "available" {}) returns every AZ in the region, so configuration that relied on a fixed AZ count silently changes behavior when AWS adds a new AZ to the region — with no code change on the user's side.

This is the same class of risk as the existing WhoAMI check (CKV_AWS_386), which flags an under-constrained aws_ami data source, so there is precedent for scanning data blocks this way. The check targets the root cause (the unconstrained data source) rather than downstream count/for_each usage.

Fixes #7657

New/Edited policies

Description

The check fails an aws_availability_zones data block unless it pins zone
identity. Identity-pinning arguments are:

• exclude_names
• exclude_zone_ids
• a filter on zone-name or zone-id

Arguments that constrain zone attributes rather than identity do NOT prevent
a newly-added zone from appearing and therefore do NOT satisfy the check on
their own: state, all_availability_zones, a filter on opt-in-status,
and grouping filters such as group-name / group-long-name (a new AZ joins
the existing group and still appears).

Docs:

• Terraform data source: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones
• AWS DescribeAvailabilityZones filters: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAvailabilityZones.html

Fix

Constrain the data source so its result set is deterministic, e.g.:

data "aws_availability_zones" "available" {
  exclude_names = ["us-east-1e"]
}

or filter on zone identity:

data "aws_availability_zones" "available" {
  filter {
    name   = "zone-name"
    values = ["us-east-1a", "us-east-1b", "us-east-1c"]
  }
}

Users with a verified downstream mitigation (e.g. a length-guarded
count/for_each) can suppress per-block:

# checkov:skip=CKV_AWS_394: <reason>

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my feature, policy, or fix is effective and works
• New and existing tests pass locally with my changes

[Saarett]

Hello @madhavvishnubhatta , thank you for the contribution. Please pull latest dev and push it so we can re-run the tests.