fix(terraform): resolve graph edges for count/for_each indexed resource references

checkov/terraform/graph_builder/local_graph.py

@@ -592,7 +592,18 @@ def _get_possible_vertices(self, module_dependency_by_name_key: TFModule | None,
         possible_vertices = self.vertices_by_module_dependency_by_name.get(module_dependency_by_name_key, {}).get(block_type, {}).get(name, [])
         if possible_vertices:
             return possible_vertices
-        return self.vertices_by_module_dependency_by_name.get(module_dependency_by_name_key, {}).get(block_type, {}).get(name.replace(LEFT_BRACKET_WITH_QUOTATION, LEFT_BRACKET).replace(RIGHT_BRACKET_WITH_QUOTATION, RIGHT_BRACKET), [])
+        possible_vertices = self.vertices_by_module_dependency_by_name.get(module_dependency_by_name_key, {}).get(block_type, {}).get(name.replace(LEFT_BRACKET_WITH_QUOTATION, LEFT_BRACKET).replace(RIGHT_BRACKET_WITH_QUOTATION, RIGHT_BRACKET), [])
+        if possible_vertices:
+            return possible_vertices
+        # Fallback for count/for_each indexed resources: when the index was stripped
+        # from the reference (e.g. "s3_default" from "s3_default[0]"), try matching
+        # vertices whose name starts with the base name followed by "["
+        block_map = self.vertices_by_module_dependency_by_name.get(module_dependency_by_name_key, {}).get(block_type, {})
+        indexed_prefix = f"{name}["
+        for key, indices in block_map.items():
+            if key.startswith(indexed_prefix):
+                return indices
+        return []
 
     def _find_vertex_with_best_match(self, relevant_vertices_indexes: List[int], origin_path: str,
                                      origin_vertex_index: Optional[int] = None) -> int:

tests/terraform/graph/checks/resources/S3BucketLifecycle/expected.yaml

@@ -1,5 +1,6 @@
 pass:
   - "aws_s3_bucket.pass"
   - "aws_s3_bucket.pass_v3"
+  - "aws_s3_bucket.pass_count[0]"
 fail:
   - "aws_s3_bucket.fail"

tests/terraform/graph/checks/resources/S3BucketLifecycle/main.tf

@@ -26,3 +26,28 @@ resource "aws_s3_bucket" "pass_v3" {
     abort_incomplete_multipart_upload_days = 7
   }
 }
+
+# count-based resources
+
+variable "create_bucket" {
+  default = true
+}
+
+resource "aws_s3_bucket" "pass_count" {
+  count  = var.create_bucket ? 1 : 0
+  bucket = "bucket_with_count"
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "pass_count" {
+  count  = var.create_bucket ? 1 : 0
+  bucket = aws_s3_bucket.pass_count[0].id
+
+  rule {
+    id     = "expire-old-objects"
+    status = "Enabled"
+
+    expiration {
+      days = 90
+    }
+  }
+}