Motivation

Terraform aws_iam_policy_document data sources can contain values that are unknown during static analysis. Previously, a single unknown value caused JSON serialization to fail, which dropped the whole policy document from analysis and emitted noisy error logs.

Changes

Treat unknown cty values as null before serializing Terraform data source policies, preserving the statically-known portions of the policy instead of dropping the whole document. The remaining serialization failure log is downgraded because routine unknown Terraform values are now handled explicitly.

A regression test covers a policy with an unknown scalar field while preserving known statement fields.

Author Checklist

• I have reviewed my own PR.
• I have added or updated relevant unit tests where necessary. If no tests are added, I've explained why.
• All new and existing tests pass.
• I have tested my changes on staging (if applicable).
• I have updated any relevant documentation (if applicable).

QA Instruction

1. go test ./pkg/parser/terraform/... -run Test_getDataSourcePolicy -v
2. Confirm the unknown-value fixture still emits the known IAM policy statement instead of an empty policy.

Blast Radius

This PR affects Terraform data source policy parsing in the IaC scanner. It only changes handling of unknown values while decoding aws_iam_policy_document data sources.

Additional Notes

I submit this contribution under the Apache-2.0 license.