Repository: bridgecrewio/checkov

Issue:
CKV2_AWS_52 Wrong/incomplete definition
**Describe the issue**
The check https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-52 doesn't accept the following configuration as "fine-grained access control enabled": 

```
advanced_security_options {
    enabled                        = true
    internal_user_database_enabled = false

    master_user_options {
        master_user_arn = var.cognito_authenticated_role
    }
}
```

**Examples**
See example above, this configuration should not fail the check. When applied, you can see fine-grained access control is enabled in the AWS Console:
![Image](https://github.com/user-attachments/assets/9d71a4f9-fcdd-42a7-a1e4-30cd30daed40)


**Version (please complete the following information):**
 - Checkov Version [3.2.369](https://github.com/bridgecrewio/checkov/releases/tag/3.2.369)

**Additional context**


Contributing.md python version conda command doesn't seem to work
`conda create -n python310 --m python=Python 3.10.14` is not working for me.
I used `conda create -n python310 --m python=3.10.14` instead.

I'm using Windows 10.



Discussion:

Patch:
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 54b5c571ef..98d74ecf6e 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -64,7 +64,7 @@ Results will appear under [actions](https://github.com/bridgecrewio/checkov/acti
 To run tests locally use the following commands (install dev dependencies, run tests and compute tests coverage):
 If you are using conda, create a new environment with Python 3.10.14 version:
 ```sh
-conda create -n python310 --m python=Python 3.10.14
+conda create -n python310 python=3.10.17
 conda activate python310
 ```
 Then, we need pipenv installation and run the tests and coverage modules 
diff --git a/checkov/terraform/checks/graph_checks/aws/OpenSearchDomainHasFineGrainedControl.yaml b/checkov/terraform/checks/graph_checks/aws/OpenSearchDomainHasFineGrainedControl.yaml
index fa8ac74517..1a9f9f9c1a 100644
--- a/checkov/terraform/checks/graph_checks/aws/OpenSearchDomainHasFineGrainedControl.yaml
+++ b/checkov/terraform/checks/graph_checks/aws/OpenSearchDomainHasFineGrainedControl.yaml
@@ -3,7 +3,7 @@ metadata:
   name: "Ensure AWS ElasticSearch/OpenSearch Fine-grained access control is enabled"
   category: "IAM"
 definition:
-  and:
+  or:
     - cond_type: "attribute"
       resource_types:
       - "aws_opensearch_domain"


Test patch:
diff --git a/tests/terraform/graph/checks/resources/OpenSearchDomainHasFineGrainedControl/expected.yaml b/tests/terraform/graph/checks/resources/OpenSearchDomainHasFineGrainedControl/expected.yaml
index b04b2c4b1b..78341a8551 100644
--- a/tests/terraform/graph/checks/resources/OpenSearchDomainHasFineGrainedControl/expected.yaml
+++ b/tests/terraform/graph/checks/resources/OpenSearchDomainHasFineGrainedControl/expected.yaml
@@ -1,8 +1,8 @@
 pass:
   - "aws_elasticsearch_domain.es_pass"
   - "aws_opensearch_domain.os_pass"
+  - "aws_opensearch_domain.os_pass1"
 fail:
-  - "aws_opensearch_domain.os_fail_1"
   - "aws_opensearch_domain.os_fail_2"
   - "aws_elasticsearch_domain.es_fail_2"
   - "aws_elasticsearch_domain.es_fail_1"
diff --git a/tests/terraform/graph/checks/resources/OpenSearchDomainHasFineGrainedControl/main.tf b/tests/terraform/graph/checks/resources/OpenSearchDomainHasFineGrainedControl/main.tf
index fcc3ba8aa5..11604c8999 100644
--- a/tests/terraform/graph/checks/resources/OpenSearchDomainHasFineGrainedControl/main.tf
+++ b/tests/terraform/graph/checks/resources/OpenSearchDomainHasFineGrainedControl/main.tf
@@ -1,4 +1,4 @@
-resource "aws_opensearch_domain" "os_fail_1" {
+resource "aws_opensearch_domain" "os_pass1" {
   domain_name    = "ggkitty"
   engine_version = "Elasticsearch_7.1"
 
@@ -44,7 +44,7 @@ resource "aws_opensearch_domain" "os_fail_2" {
   }
 
   advanced_security_options {
-    enabled                        = true
+    enabled                        = false
     anonymous_auth_enabled         = true
     internal_user_database_enabled = false
     master_user_options {
@@ -118,7 +118,7 @@ resource "aws_elasticsearch_domain" "es_fail_1" {
   }
 
   advanced_security_options {
-    enabled                        = true
+    enabled                        = false
     anonymous_auth_enabled         = true
     internal_user_database_enabled = false
     master_user_options {
@@ -164,7 +164,7 @@ resource "aws_elasticsearch_domain" "es_pass" {
   }
 
   advanced_security_options {
-    enabled                        = true
+    enabled                        = false
     anonymous_auth_enabled         = true
     internal_user_database_enabled = true
     master_user_options {