CKV_AWS_192 crashes on AWS::WAFv2::WebACL with conditional Rules (Fn::If)

[sir-sigurd]

Describe the issue
CKV_AWS_192 (WAFACLCVE202144228) crashes when a WebACL declares Rules via Fn::If (e.g. selecting rule sets per environment). The parsed value is a dict, so the check iterates its string keys and calls .get() on the string "Fn::If". The registry downgrades the crash to UNKNOWN, so the report is unaffected — but every scan logs the traceback below. Expected: the check returns UNKNOWN for a Rules value it can't resolve statically, without the error noise.

Examples

Conditions:
  ExtraProtection: !Equals [!Ref 'AWS::Region', us-east-1]
Resources:
  WebACL:
    Type: AWS::WAFv2::WebACL
    Properties:
      DefaultAction:
        Allow: {}
      Scope: REGIONAL
      Rules: !If
        - ExtraProtection
        - - Name: rule-1
            Priority: 1
            Statement:
              ManagedRuleGroupStatement:
                VendorName: AWS
                Name: AWSManagedRulesKnownBadInputsRuleSet
            OverrideAction:
              None: {}
        - []

checkov --framework cloudformation -c CKV_AWS_192 -f webacl.yaml

Exception Trace

[ERROR] Failed to run check CKV_AWS_192 on /webacl.yaml:AWS::WAFv2::WebACL.WebACL
Traceback (most recent call last):
  File "checkov/common/checks/base_check.py", line 68, in run
    check_result["result"] = self.scan_entity_conf(entity_configuration, entity_type)
  File "checkov/cloudformation/checks/resource/base_resource_check.py", line 33, in scan_entity_conf
    return self.scan_resource_conf(conf)
  File "checkov/cloudformation/checks/resource/aws/WAFACLCVE202144228.py", line 22, in scan_resource_conf
    statement = rule.get("Statement")
AttributeError: 'str' object has no attribute 'get'

Version

• Checkov 3.3.8; reproduces on current main

Additional context
PR with a fix + regression test follows.

Written with AI assistance (Claude Code), human-reviewed.