Repository: bridgecrewio/checkov

Issue:
CKV_AZURE_226: error in check and testcase
**Describe the issue**
CKV_AZURE_226 checks for ephemeral disks within the "main resource" azurerm_kubernetes_cluster but the cluster itself doesn't have any argument called os_disk_type. The argument os_disk_type is part of the node pool. 
The testcase [here](https://github.com/bridgecrewio/checkov/pull/5584/files#diff-c0b8f08537766f6eff2a5d10b9439d227fdaaebe6ff7903008825c5f9d51c22dR1) is misleading and the check itself [here](https://github.com/bridgecrewio/checkov/pull/5584/files#diff-c9248390aa120f7af4643f1908d3d824fb903fd3c6cd63e9e77fe8e9ecd59289R28) too. 

In my opinion this must be something like 
```
    def get_inspected_key(self) -> str:
        return "default_node_pool/[0]/os_disk_type"
```
otherwise it won't work?

Same for CKV_AZURE_227.

**Examples**
```
[root] # head -30 aks.tf
resource "azurerm_kubernetes_cluster" "this" {
  name                = local.name_prefix
  location            = var.resource_group.location
  resource_group_name = var.resource_group.name
  node_resource_group = "${local.name_prefix}-node-pool"
  dns_prefix          = local.name_prefix
  kubernetes_version  = local.kubernetes_version
  sku_tier            = var.sku_tier

  api_server_access_profile {
    authorized_ip_ranges = var.api_server_authorized_ip_ranges
  }

  default_node_pool {
    name = "default"

    enable_host_encryption       = true
    vm_size                      = "Standard_E4ads_v5"
    os_disk_type                 = "Ephemeral"
    zones                        = [1, 2, 3]
    only_critical_addons_enabled = true

    type                 = "VirtualMachineScaleSets"
    vnet_subnet_id       = var.subnet_id
    enable_auto_scaling  = true
    max_count            = 6
    min_count            = 2
    orchestrator_version = local.kubernetes_version

    upgrade_settings {
```

results in
```
[root] # checkov --skip-framework kubernetes --skip-framework helm --quiet --compact -o junitxml -o cli --directory .
2023-10-02 11:58:47,399 [MainThread  ] [WARNI]  The framework "sca_image" is part of the "SCA" module, which is not enabled in the platform
2023-10-02 11:58:47,399 [MainThread  ] [WARNI]  The framework "sca_package" is part of the "SCA" module, which is not enabled in the platform
terraform scan results:

Passed checks: 6, Failed checks: 11, Skipped checks: 0

[...]
Check: CKV_AZURE_226: "Ensure ephemeral disks are used for OS disks"
        FAILED for resource: azurerm_kubernetes_cluster.this
        File: /aks.tf:1-64
Check: CKV_AZURE_227: "Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources"
        FAILED for resource: azurerm_kubernetes_cluster.this
        File: /aks.tf:1-64
[...]
```

Please also see https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster for code example.

**Version (please complete the following information):**
 - Checkov Version 2.4.58

**Additional context**
This is related to https://github.com/bridgecrewio/checkov/pull/5584 and https://github.com/bridgecrewio/checkov/pull/5588.



Discussion:
hey @tberreis thanks for reaching out.

Nice catch, are you interested in contributing the needed change and adjusting the test cases?

Resolving patch:
diff --git a/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py b/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py
--- a/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py
+++ b/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py
@@ -1,4 +1,3 @@
-
 from checkov.common.models.enums import CheckCategories, CheckResult
 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
 
@@ -18,11 +17,19 @@ def __init__(self) -> None:
         id = "CKV_AZURE_227"
         supported_resources = ("azurerm_kubernetes_cluster", "azurerm_kubernetes_cluster_node_pool")
         categories = (CheckCategories.KUBERNETES,)
-        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,
-                         missing_block_result=CheckResult.FAILED)
+        super().__init__(
+            name=name,
+            id=id,
+            categories=categories,
+            supported_resources=supported_resources,
+            missing_block_result=CheckResult.FAILED,
+        )
 
     def get_inspected_key(self) -> str:
-        return "enable_host_encryption"
+        if self.entity_type == "azurerm_kubernetes_cluster":
+            return "default_node_pool/[0]/enable_host_encryption"
+        else:
+            return "enable_host_encryption"
 
 
 check = AKSEncryptionAtHostEnabled()
diff --git a/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py b/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py
--- a/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py
+++ b/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py
@@ -25,7 +25,7 @@ def __init__(self) -> None:
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
     def get_inspected_key(self) -> str:
-        return "os_disk_type"
+        return "default_node_pool/[0]/os_disk_type"
 
     def get_expected_value(self) -> Any:
         return "Ephemeral"


Test patch:
diff --git a/tests/terraform/checks/resource/azure/example_AKSEncryptionAtHostEnabled/main.tf b/tests/terraform/checks/resource/azure/example_AKSEncryptionAtHostEnabled/main.tf
--- a/tests/terraform/checks/resource/azure/example_AKSEncryptionAtHostEnabled/main.tf
+++ b/tests/terraform/checks/resource/azure/example_AKSEncryptionAtHostEnabled/main.tf
@@ -1,23 +1,26 @@
 resource "azurerm_kubernetes_cluster" "pass" {
-  name                = "example-aks1"
-  location            = azurerm_resource_group.example.location
-  resource_group_name = azurerm_resource_group.example.name
-  dns_prefix          = "exampleaks1"
-  enable_host_encryption  = true
+  name                  = "internal"
+  kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id
+  vm_size               = "Standard_DS2_v2"
+  node_count            = 1
 
   default_node_pool {
-    name       = "default"
-    node_count = 1
-    vm_size    = "Standard_D2_v2"
+    name = "default"
+
+    enable_host_encryption       = true
+    vm_size                      = "Standard_E4ads_v5"
+    os_disk_type                 = "Ephemeral"
+    zones                        = [1, 2, 3]
+    only_critical_addons_enabled = true
+
+    type                 = "VirtualMachineScaleSets"
+    vnet_subnet_id       = var.subnet_id
+    enable_auto_scaling  = true
+    max_count            = 6
+    min_count            = 2
+    orchestrator_version = local.kubernetes_version
   }
 
-  identity {
-    type = "SystemAssigned"
-  }
-
-  tags = {
-    Environment = "Production"
-  }
 }
 
 resource "azurerm_kubernetes_cluster_node_pool" "pass" {
@@ -25,72 +28,84 @@ resource "azurerm_kubernetes_cluster_node_pool" "pass" {
   kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id
   vm_size               = "Standard_DS2_v2"
   node_count            = 1
-  enable_host_encryption  = true
+  enable_host_encryption = true
 
   tags = {
     Environment = "Production"
   }
 }
 
-resource "azurerm_kubernetes_cluster" "fail" {
-  name                = "example-aks1"
-  location            = azurerm_resource_group.example.location
-  resource_group_name = azurerm_resource_group.example.name
-  dns_prefix          = "exampleaks1"
 
-  default_node_pool {
-    name       = "default"
-    node_count = 1
-    vm_size    = "Standard_D2_v2"
-  }
-
-  identity {
-    type = "SystemAssigned"
-  }
+resource "azurerm_kubernetes_cluster" "fail1" {
+  name                  = "internal"
+  kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id
+  vm_size               = "Standard_DS2_v2"
+  node_count            = 1
 
   tags = {
     Environment = "Production"
   }
+
+  default_node_pool {
+    name = "default"
+
+    enable_host_encryption       = false
+    vm_size                      = "Standard_E4ads_v5"
+    zones                        = [1, 2, 3]
+    only_critical_addons_enabled = true
+
+    type                 = "VirtualMachineScaleSets"
+    vnet_subnet_id       = var.subnet_id
+    enable_auto_scaling  = true
+    max_count            = 6
+    min_count            = 2
+    orchestrator_version = local.kubernetes_version
+  }
+
 }
 
-resource "azurerm_kubernetes_cluster_node_pool" "fail" {
+resource "azurerm_kubernetes_cluster_node_pool" "fail1" {
   name                  = "internal"
   kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id
   vm_size               = "Standard_DS2_v2"
   node_count            = 1
+  enable_host_encryption = false
+
   tags = {
     Environment = "Production"
   }
 }
 
-resource "azurerm_kubernetes_cluster" "fail1" {
-  name                = "example-aks1"
-  location            = azurerm_resource_group.example.location
-  resource_group_name = azurerm_resource_group.example.name
-  dns_prefix          = "exampleaks1"
-  enable_host_encryption  = false
 
-  default_node_pool {
-    name       = "default"
-    node_count = 1
-    vm_size    = "Standard_D2_v2"
-  }
+resource "azurerm_kubernetes_cluster" "fail2" {
+  name                  = "internal"
+  kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id
+  vm_size               = "Standard_DS2_v2"
+  node_count            = 1
 
-  identity {
-    type = "SystemAssigned"
+  default_node_pool {
+    name = "default"
+
+    vm_size                      = "Standard_E4ads_v5"
+    os_disk_type                 = "Ephemeral"
+    zones                        = [1, 2, 3]
+    only_critical_addons_enabled = true
+
+    type                 = "VirtualMachineScaleSets"
+    vnet_subnet_id       = var.subnet_id
+    enable_auto_scaling  = true
+    max_count            = 6
+    min_count            = 2
+    orchestrator_version = local.kubernetes_version
   }
 
-  tags = {
-    Environment = "Production"
-  }
 }
 
-resource "azurerm_kubernetes_cluster_node_pool" "fail1" {
+resource "azurerm_kubernetes_cluster_node_pool" "fail2" {
   name                  = "internal"
   kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id
   vm_size               = "Standard_DS2_v2"
   node_count            = 1
-  enable_host_encryption  = false
 
   tags = {
     Environment = "Production"
diff --git a/tests/terraform/checks/resource/azure/example_AKSEphemeralOSDisks/main.tf b/tests/terraform/checks/resource/azure/example_AKSEphemeralOSDisks/main.tf
--- a/tests/terraform/checks/resource/azure/example_AKSEphemeralOSDisks/main.tf
+++ b/tests/terraform/checks/resource/azure/example_AKSEphemeralOSDisks/main.tf
@@ -3,11 +3,24 @@ resource "azurerm_kubernetes_cluster" "pass" {
   kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id
   vm_size               = "Standard_DS2_v2"
   node_count            = 1
-  os_disk_type          = "Ephemeral"
 
-  tags = {
-    Environment = "Production"
+  default_node_pool {
+    name = "default"
+
+    enable_host_encryption       = true
+    vm_size                      = "Standard_E4ads_v5"
+    os_disk_type                 = "Ephemeral"
+    zones                        = [1, 2, 3]
+    only_critical_addons_enabled = true
+
+    type                 = "VirtualMachineScaleSets"
+    vnet_subnet_id       = var.subnet_id
+    enable_auto_scaling  = true
+    max_count            = 6
+    min_count            = 2
+    orchestrator_version = local.kubernetes_version
   }
+
 }
 
 resource "azurerm_kubernetes_cluster" "fail" {
@@ -19,6 +32,23 @@ resource "azurerm_kubernetes_cluster" "fail" {
   tags = {
     Environment = "Production"
   }
+
+  default_node_pool {
+    name = "default"
+
+    enable_host_encryption       = true
+    vm_size                      = "Standard_E4ads_v5"
+    zones                        = [1, 2, 3]
+    only_critical_addons_enabled = true
+
+    type                 = "VirtualMachineScaleSets"
+    vnet_subnet_id       = var.subnet_id
+    enable_auto_scaling  = true
+    max_count            = 6
+    min_count            = 2
+    orchestrator_version = local.kubernetes_version
+  }
+  
 }
 
 resource "azurerm_kubernetes_cluster" "fail2" {
@@ -31,4 +61,23 @@ resource "azurerm_kubernetes_cluster" "fail2" {
   tags = {
     Environment = "Production"
   }
+
+  default_node_pool {
+    name = "default"
+
+    enable_host_encryption       = true
+    vm_size                      = "Standard_E4ads_v5"
+    os_disk_type                 = "Managed"
+    zones                        = [1, 2, 3]
+    only_critical_addons_enabled = true
+
+    type                 = "VirtualMachineScaleSets"
+    vnet_subnet_id       = var.subnet_id
+    enable_auto_scaling  = true
+    max_count            = 6
+    min_count            = 2
+    orchestrator_version = local.kubernetes_version
+  }
+  
+
 }
\ No newline at end of file
diff --git a/tests/terraform/checks/resource/azure/test_AKSEncryptionAtHostEnabled.py b/tests/terraform/checks/resource/azure/test_AKSEncryptionAtHostEnabled.py
--- a/tests/terraform/checks/resource/azure/test_AKSEncryptionAtHostEnabled.py
+++ b/tests/terraform/checks/resource/azure/test_AKSEncryptionAtHostEnabled.py
@@ -22,15 +22,15 @@ def test(self):
             'azurerm_kubernetes_cluster_node_pool.pass'
         }
         failing_resources = {
-            'azurerm_kubernetes_cluster.fail',
             'azurerm_kubernetes_cluster.fail1',
-            'azurerm_kubernetes_cluster_node_pool.fail',
+            'azurerm_kubernetes_cluster.fail2',
             'azurerm_kubernetes_cluster_node_pool.fail1',
+            'azurerm_kubernetes_cluster_node_pool.fail2',
         }
         skipped_resources = {}
 
-        passed_check_resources = set([c.resource for c in report.passed_checks])
-        failed_check_resources = set([c.resource for c in report.failed_checks])
+        passed_check_resources = {c.resource for c in report.passed_checks}
+        failed_check_resources = {c.resource for c in report.failed_checks}
 
         self.assertEqual(summary['passed'], len(passing_resources))
         self.assertEqual(summary['failed'], len(failing_resources))