Repository: bridgecrewio/checkov

Issue:
CKV_AWS_78 misreported
**Describe the bug**
Checkov is returning as vulnerability CKV_AWS_78, but the solution breaks Terraform validation.

Accordigly to Checkov if `encryption_disabled = false` is not set in the main block it can be considered a vulnerability

```
resource "aws_codebuild_project" "project-with-cache" {
  name           = "test-project-cache"
  description    = "test_codebuild_project_cache"
  build_timeout  = "5"
  queued_timeout = "5"
+ encryption_disabled = false
} 
```
as described here: https://docs.bridgecrew.io/docs/bc_aws_general_30

Unfortunately in Terraform v1.0.3 `encryption_disabled` is not available in that location but only in blocks `artifacts`, `secondary_artifacts` and `logs_config: s3_logs` as you can see here: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_project

So if not set it gives vulnerability, if set terraform fails during the validation.

**To Reproduce**
Steps to reproduce the behavior:
1. Set in **aws_codebuild_project**  **encryption_disabled = false**
```
resource "aws_codebuild_project" "project-with-cache" {
  name           = "test-project-cache"
  description    = "test_codebuild_project_cache"
  build_timeout  = "5"
  queued_timeout = "5"
+ encryption_disabled = false
} 
```
2. Run `terraform validate`
3. See error

**Expected behavior**
No vulnerability or vulnerability if not set the attribute in all the 3 blocks

**Desktop (please complete the following information):**
 - terraform --version: Terraform v1.0.3 on linux_amd64
 - checkov --version: 2.0.326




Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/CodeBuildProjectEncryption.py b/checkov/terraform/checks/resource/aws/CodeBuildProjectEncryption.py
--- a/checkov/terraform/checks/resource/aws/CodeBuildProjectEncryption.py
+++ b/checkov/terraform/checks/resource/aws/CodeBuildProjectEncryption.py
@@ -16,11 +16,13 @@ def scan_resource_conf(self, conf):
             return CheckResult.UNKNOWN
         artifact = conf['artifacts'][0]
         if isinstance(artifact, dict):
-            if artifact['type'] == "NO_ARTIFACTS":
+            if artifact['type'] == ["NO_ARTIFACTS"]:
                 self.evaluated_keys = 'artifacts/[0]/type'
-            elif 'encryption_disabled' in artifact and artifact['encryption_disabled']:
-                self.evaluated_keys = 'artifacts/[0]/encryption_disabled'
-                return CheckResult.FAILED
+                return CheckResult.UNKNOWN
+            if 'encryption_disabled' in artifact:   
+                if artifact['encryption_disabled'] == [True]:
+                   self.evaluated_keys = 'artifacts/[0]/encryption_disabled'
+                   return CheckResult.FAILED
         return CheckResult.PASSED
 
 


Test patch:
diff --git a/tests/terraform/checks/resource/aws/example_CodeBuildProjectEncryption/main.tf b/tests/terraform/checks/resource/aws/example_CodeBuildProjectEncryption/main.tf
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/example_CodeBuildProjectEncryption/main.tf
@@ -0,0 +1,31 @@
+resource "aws_codebuild_project" "fail" {
+  name = "fail-project"
+  artifacts {
+    type                = S3
+    encryption_disabled = true
+  }
+
+}
+
+resource "aws_codebuild_project" "no_artifacts_encryption_ignored" {
+  name = "no-art-project"
+  artifacts {
+    type                = "NO_ARTIFACTS"
+    encryption_disabled = true
+  }
+}
+
+resource "aws_codebuild_project" "success_no_encryption_disabled" {
+  name = "default-project"
+  artifacts {
+    type = "S3"
+  }
+}
+
+resource "aws_codebuild_project" "success" {
+  name = "success-project"
+  artifacts {
+    type                = "S3"
+    encryption_disabled = false
+  }
+}
diff --git a/tests/terraform/checks/resource/aws/test_CodeBuildEncrypted.py b/tests/terraform/checks/resource/aws/test_CodeBuildEncrypted.py
--- a/tests/terraform/checks/resource/aws/test_CodeBuildEncrypted.py
+++ b/tests/terraform/checks/resource/aws/test_CodeBuildEncrypted.py
@@ -5,7 +5,7 @@
 from checkov.common.models.enums import CheckResult
 
 
-class TestRDSClusterEncrypted(unittest.TestCase):
+class TestCodeBuildEncrypted(unittest.TestCase):
     def test_failure(self):
         hcl_res = hcl2.loads("""
             resource "aws_codebuild_project" "example" {
diff --git a/tests/terraform/checks/resource/aws/test_CodeBuildProjectEncryption.py b/tests/terraform/checks/resource/aws/test_CodeBuildProjectEncryption.py
--- a/tests/terraform/checks/resource/aws/test_CodeBuildProjectEncryption.py
+++ b/tests/terraform/checks/resource/aws/test_CodeBuildProjectEncryption.py
@@ -1,62 +1,39 @@
+import os
 import unittest
 
-from checkov.common.models.enums import CheckResult
+from checkov.runner_filter import RunnerFilter
 from checkov.terraform.checks.resource.aws.CodeBuildProjectEncryption import check
+from checkov.terraform.runner import Runner
 
 
 class TestCodeBuildProjectEncryption(unittest.TestCase):
+    def test(self):
+        runner = Runner()
+        current_dir = os.path.dirname(os.path.realpath(__file__))
 
-    def test_failure(self):
-        resource_conf = {
-            "name": "test-project",
-            "artifacts": [
-                {
-                    "type": "S3",
-                    "encryption_disabled": True,
-                }
-            ],
-        }
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.FAILED, scan_result)
-
-    def test_success_type_no_artifacts_encryption_ignored(self):
-        resource_conf = {
-            "name": "test-project",
-            "artifacts": [
-                {
-                    "type": "NO_ARTIFACTS",
-                    "encryption_disabled": True,
-                }
-            ],
-        }
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.PASSED, scan_result)
-
-    def test_success_no_encryption_disabled(self):
-        resource_conf = {
-            "name": "test-project",
-            "artifacts": [
-                {
-                    "type": "S3",
-                }
-            ],
+        test_files_dir = current_dir + "/example_CodeBuildProjectEncryption"
+        report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]))
+        summary = report.get_summary()
+
+        passing_resources = {
+            "aws_codebuild_project.success_no_encryption_disabled",
+            "aws_codebuild_project.success"
         }
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.PASSED, scan_result)
-
-    def test_success(self):
-        resource_conf = {
-            "name": "test-project",
-            "artifacts": [
-                {
-                    "type": "S3",
-                    "encryption_disabled": False,
-                }
-            ],
+        failing_resources = {
+            "aws_codebuild_project.fail",
         }
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.PASSED, scan_result)
+
+        passed_check_resources = set([c.resource for c in report.passed_checks])
+        failed_check_resources = set([c.resource for c in report.failed_checks])
+
+
+        self.assertEqual(summary["passed"], 2)
+        self.assertEqual(summary["failed"], 1)
+        self.assertEqual(summary["parsing_errors"], 0)
+
+        self.assertEqual(passing_resources, passed_check_resources)
+        self.assertEqual(failing_resources, failed_check_resources)
 
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     unittest.main()