Repository: bridgecrewio/checkov

Issue:
CKV_AWS_157 False Positive on Aurora
**Describe the issue**
CKV_AWS_157 fails on Aurora instances even though the `MultiAZ` property is not applicable to Aurora

**Examples**
```
RDSinstance:
    Type: AWS::RDS::DBInstance
    Properties:
      DBClusterIdentifier: !Ref DBCluster
      DBInstanceClass: !Ref DbType
      DBInstanceIdentifier: !Sub ${AppName}-${EnvironmentName}
      DBParameterGroupName: !Ref DbParameterGroup
      DBSubnetGroupName: !Ref DBSubnetGroup
      Engine: aurora-mysql
      MonitoringInterval: "60"
      MonitoringRoleArn: !GetAtt RdsMonitoringRole.Arn
      PubliclyAccessible: 'false'
```

**Version (please complete the following information):**
 - Checkov Version 2.2.270

**Additional context**
- AWS docs: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbinstance.html#cfn-rds-dbinstance-multiaz

<img width="1377" alt="Screenshot 2023-01-19 at 1 25 49 PM" src="https://user-images.githubusercontent.com/1328683/213552592-4736b84a-3926-44b2-9dad-196b68f28daa.png">



Discussion:
hey @enzowritescode thanks for reaching out.
Yeah, you are right. Are you interested in contributing the needed change?
@gruebel I'm down.

Resolving patch:
diff --git a/checkov/cloudformation/checks/resource/aws/RDSMultiAZEnabled.py b/checkov/cloudformation/checks/resource/aws/RDSMultiAZEnabled.py
--- a/checkov/cloudformation/checks/resource/aws/RDSMultiAZEnabled.py
+++ b/checkov/cloudformation/checks/resource/aws/RDSMultiAZEnabled.py
@@ -1,5 +1,5 @@
+from checkov.common.models.enums import CheckResult, CheckCategories
 from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck
-from checkov.common.models.enums import CheckCategories
 
 
 class RDSMultiAZEnabled(BaseResourceValueCheck):
@@ -10,6 +10,16 @@ def __init__(self):
         categories = [CheckCategories.NETWORKING]
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
+    def scan_resource_conf(self, conf):
+        # Aurora is replicated across all AZs and doesn't require MultiAZ to be set
+        # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbinstance.html#cfn-rds-dbinstance-multiaz
+        if 'Properties' in conf.keys():
+            if 'Engine' in conf['Properties'].keys():
+                if 'aurora' in conf['Properties']['Engine']:
+                    return CheckResult.UNKNOWN
+        # Database is not Aurora; Use base class implementation
+        return super().scan_resource_conf(conf)
+            
     def get_inspected_key(self):
         return 'Properties/MultiAZ'
 


Test patch:
diff --git a/tests/cloudformation/checks/resource/aws/example_RDSMultiAZEnabled/RDSMultiAZEnabled-UNKNOWN.yaml b/tests/cloudformation/checks/resource/aws/example_RDSMultiAZEnabled/RDSMultiAZEnabled-UNKNOWN.yaml
new file mode 100644
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_RDSMultiAZEnabled/RDSMultiAZEnabled-UNKNOWN.yaml
@@ -0,0 +1,7 @@
+Resources:
+  MyDBAurora:
+    Type: 'AWS::RDS::DBInstance'
+    Properties:
+      DBName: 'mydb_enabled'
+      DBInstanceClass: 'db.r3.2xlarge'
+      Engine: 'aurora-mysql'