Repository: bridgecrewio/checkov (Python)

Issue:
Azure SQL Database - Ensure that the Ledger feature is enabled on database that requires cryptographic proof and nonrepudiation of data integrity
**Describe the issue**
It seems that there are no checks in regard to using a "[Ledger](https://learn.microsoft.com/en-us/sql/relational-databases/security/ledger/ledger-overview?view=sql-server-ver16&viewFallbackFrom=azuresql)" within Azure SQL Database.
[azurerm_mssql_database](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/mssql_database)

**Examples**

````hcl
resource "azurerm_mssql_database" "test" {
  name           = "acctest-db-d"
  server_id      = azurerm_mssql_server.example.id
  collation      = "SQL_Latin1_General_CP1_CI_AS"
  license_type   = "LicenseIncluded"
  max_size_gb    = 4
  read_scale     = true
  sku_name       = "S0"
  ledger_enabled = true

  tags = {
    foo = "bar"
  }
}

````

**Version (please complete the following information):**
 - N/A

**Additional context**

Ledger helps protect data from any attacker or high-privileged user, including database administrators (DBAs), system administrators, and cloud administrators. As with a traditional ledger, the feature preserves historical data. If a row is updated in the database, its previous value is maintained and protected in a history table. Ledger provides a chronicle of all changes made to the database over time.

Ledger and the historical data are managed transparently, offering protection without any application changes. The feature maintains historical data in a relational form to support SQL queries for auditing, forensics, and other purposes. It provides guarantees of cryptographic data integrity while maintaining the power, flexibility, and performance of the SQL database.

**Note that**:
- **Ledger needs to be enabled at the deployment of the database and can't be removed once enabled**
![image](https://github.com/bridgecrewio/checkov/assets/36169753/9373fc60-966a-44d8-9856-f06399b3e8da)
- **Ledger may come with performance impact, which means that it is advise to closely monitor the database performance in order to ensure that the database meets the performance objectives**
- **Ledger comes with an additional cost, due to the data being stored**


Discussion:

Patch:
diff --git a/checkov/terraform/checks/resource/azure/SQLDatabaseLedgerEnabled.py b/checkov/terraform/checks/resource/azure/SQLDatabaseLedgerEnabled.py
new file mode 100644
index 0000000000..d4c974b449
--- /dev/null
+++ b/checkov/terraform/checks/resource/azure/SQLDatabaseLedgerEnabled.py
@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
+
+
+class SQLDatabaseLedgerEnabled(BaseResourceValueCheck):
+    def __init__(self) -> None:
+        """
+        Ledger helps protect data from any attacker or high-privileged user, including database administrators (DBAs),
+        system administrators, and cloud administrators. As with a traditional ledger, the feature preserves
+        historical data.
+        If a row is updated in the database, its previous value is maintained and protected
+        in a history table. Ledger provides a chronicle of all changes made to the database over time.
+        Ledger and the historical data are managed transparently, offering protection without any application changes.
+        The feature maintains historical data in a relational form to support SQL queries for auditing,
+        forensics, and other purposes.
+        It provides guarantees of cryptographic data integrity while maintaining the power, flexibility,
+        and performance of the SQL database.
+
+        Note that:
+        - Ledger needs to be enabled at the deployment of the database and can't be removed once enabled
+        - Ledger may come with performance impact, which means that it is advise to closely monitor
+          the database performance in order to ensure that the database meets the performance objectives
+        - Ledger comes with an additional cost, due to the data being stored
+
+        """
+        name = "Ensure that the Ledger feature is enabled on database that "
+        name += "requires cryptographic proof and nonrepudiation of data integrity"
+        id = "CKV_AZURE_224"
+        supported_resources = ("azurerm_mssql_database",)
+        categories = (CheckCategories.LOGGING,)
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_inspected_key(self) -> str:
+        return "ledger_enabled"
+
+
+check = SQLDatabaseLedgerEnabled()


Test patch:
diff --git a/tests/terraform/checks/resource/azure/example_SQLDatabaseLedgerEnabled/main.tf b/tests/terraform/checks/resource/azure/example_SQLDatabaseLedgerEnabled/main.tf
new file mode 100644
index 0000000000..937fcafbe2
--- /dev/null
+++ b/tests/terraform/checks/resource/azure/example_SQLDatabaseLedgerEnabled/main.tf
@@ -0,0 +1,44 @@
+resource "azurerm_mssql_database" "pass" {
+  name           = "example-database"
+  server_id      = azurerm_mssql_server.example.id
+  collation      = "SQL_Latin1_General_CP1_CI_AS"
+  license_type   = "LicenseIncluded"
+  max_size_gb    = 4
+  read_scale     = true
+  sku_name       = "S0"
+  ledger_enabled = true
+
+  tags = {
+    environment = "Production"
+  }
+}
+
+resource "azurerm_mssql_database" "fail2" {
+    name           = "example-database"
+    server_id      = azurerm_mssql_server.example.id
+    collation      = "SQL_Latin1_General_CP1_CI_AS"
+    license_type   = "LicenseIncluded"
+    max_size_gb    = 4
+    read_scale     = true
+    sku_name       = "S0"
+    ledger_enabled = false
+
+    tags = {
+        environment = "Production"
+    }
+}
+
+resource "azurerm_mssql_database" "fail" {
+    name           = "example-database"
+    server_id      = azurerm_mssql_server.example.id
+    collation      = "SQL_Latin1_General_CP1_CI_AS"
+    license_type   = "LicenseIncluded"
+    max_size_gb    = 4
+    read_scale     = true
+    sku_name       = "S0"
+
+    tags = {
+        environment = "Production"
+    }
+
+}
\ No newline at end of file
diff --git a/tests/terraform/checks/resource/azure/test_SQLDatabaseLedgerEnabled.py b/tests/terraform/checks/resource/azure/test_SQLDatabaseLedgerEnabled.py
new file mode 100644
index 0000000000..bd8f19f9f5
--- /dev/null
+++ b/tests/terraform/checks/resource/azure/test_SQLDatabaseLedgerEnabled.py
@@ -0,0 +1,42 @@
+import os
+import unittest
+
+from checkov.runner_filter import RunnerFilter
+from checkov.terraform.runner import Runner
+from checkov.terraform.checks.resource.azure.SQLDatabaseLedgerEnabled import check
+
+
+class SQLDatabaseLedgerEnabled(unittest.TestCase):
+
+    def test(self):
+        runner = Runner()
+        current_dir = os.path.dirname(os.path.realpath(__file__))
+
+        test_files_dir = os.path.join(current_dir, "example_SQLDatabaseLedgerEnabled")
+        report = runner.run(root_folder=test_files_dir,
+                            runner_filter=RunnerFilter(checks=[check.id]))
+        summary = report.get_summary()
+
+        passing_resources = {
+            'azurerm_mssql_database.pass',
+        }
+        failing_resources = {
+            'azurerm_mssql_database.fail',
+            'azurerm_mssql_database.fail2',
+        }
+        skipped_resources = {}
+
+        passed_check_resources = set([c.resource for c in report.passed_checks])
+        failed_check_resources = set([c.resource for c in report.failed_checks])
+
+        self.assertEqual(summary['passed'], len(passing_resources))
+        self.assertEqual(summary['failed'], len(failing_resources))
+        self.assertEqual(summary['skipped'], len(skipped_resources))
+        self.assertEqual(summary['parsing_errors'], 0)
+
+        self.assertEqual(passing_resources, passed_check_resources)
+        self.assertEqual(failing_resources, failed_check_resources)
+
+
+if __name__ == '__main__':
+    unittest.main()