False positive on CKV2_AWS_28: "Ensure public facing ALB are protected by WAF"

[rutomo-humi]

Describe the issue
We use terragrunt/terraform for our IaC. We structured our module into an app module consisted of multiple sub modules like Load Balancer and WAFv2

When we run checkov, it flags CKV2_AWS_28 on module.loadbalancer because we don't have our Load Balancer attached to a WAF, however, it does have. aws_wafregional_web_acl_association resource exists within our WAF module.

Examples

module "loadbalancer" {
  source = "s3:::https://s3.amazonaws.com/loadbalancer.tgz"
  name                = "loadbalancer"
}

module "waf" {
  source = "s3:::https://s3.amazonaws.com/waf.tgz"
  resource_arns                  = [module.loadbalancer.arn]
}

Version (please complete the following information):
3.2.60

Additional context
I'm aware that checkov does not support modules in s3. Would this false positive be caused by that? or does checkov expectaws_wafregional_web_acl_association to be in our loadbalancer module?