Repository: bridgecrewio/checkov

Issue:
Azure Kubernetes Service - Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources
**Describe the issue**
It seems that there are no checks in order to ensure that "Encryption at Host" is enabled or not.

**Examples**

````hcl
resource "azurerm_kubernetes_cluster" "example" {
  name                = "example-aks1"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  dns_prefix          = "exampleaks1"
  enable_host_encryption  = true

  default_node_pool {
    name       = "default"
    node_count = 1
    vm_size    = "Standard_D2_v2"
  }

  identity {
    type = "SystemAssigned"
  }

  tags = {
    Environment = "Production"
  }
}

resource "azurerm_kubernetes_cluster_node_pool" "example" {
  name                  = "internal"
  kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id
  vm_size               = "Standard_DS2_v2"
  node_count            = 1
  enable_host_encryption  = true

  tags = {
    Environment = "Production"
  }
}

````

**Version (please complete the following information):**
 - Checkov Version [e.g. 22]

**Additional context**

With host-based encryption, the data stored on the VM host of your AKS agent nodes' VMs is encrypted at rest and flows encrypted to the Storage service. This means the temp disks are encrypted at rest with platform-managed keys. The cache of OS and data disks is encrypted at rest with either platform-managed keys or customer-managed keys depending on the encryption type set on those disks.

By default, when using AKS, OS and data disks use server-side encryption with platform-managed keys. The caches for these disks are encrypted at rest with platform-managed keys. You can specify your own managed keys following [Bring your own keys (BYOK) with Azure disks in Azure Kubernetes Service](https://learn.microsoft.com/en-us/azure/aks/azure-disk-customer-managed-keys). The caches for these disks are also encrypted using the key you specify.

Host-based encryption is different than server-side encryption (SSE), which is used by Azure Storage. Azure-managed disks use Azure Storage to automatically encrypt data at rest when saving data. Host-based encryption uses the host of the VM to handle encryption before the data flows through Azure Storage.

Note that on the documentation of Terraform, it is seens as "Preview".

![image](https://github.com/bridgecrewio/checkov/assets/36169753/54d1bce1-c867-4fe0-bb56-e644c8edf1d2)

However, it has been set as "General availability" on May 25, 2021

![image](https://github.com/bridgecrewio/checkov/assets/36169753/69e77141-c25e-4a9d-8df2-c896197cb086)




Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py b/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py
@@ -0,0 +1,28 @@
+
+from checkov.common.models.enums import CheckCategories, CheckResult
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
+
+
+class AKSEncryptionAtHostEnabled(BaseResourceValueCheck):
+    def __init__(self) -> None:
+        """
+        With host-based encryption, the data stored on the VM host of
+        your AKS agent nodes' VMs is encrypted at rest and flows encrypted to the Storage service.
+
+        This means the temp disks are encrypted at rest with platform-managed keys.
+        The cache of OS and data disks is encrypted at rest with either platform-managed keys
+        or customer-managed keys depending on the encryption type set on those disks.
+        """
+        name = "Ensure that the AKS cluster encrypt temp disks, caches, and data flows "
+        name += "between Compute and Storage resources"
+        id = "CKV_AZURE_227"
+        supported_resources = ("azurerm_kubernetes_cluster", "azurerm_kubernetes_cluster_node_pool")
+        categories = (CheckCategories.KUBERNETES,)
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,
+                         missing_block_result=CheckResult.FAILED)
+
+    def get_inspected_key(self) -> str:
+        return "enable_host_encryption"
+
+
+check = AKSEncryptionAtHostEnabled()


Test patch:
diff --git a/tests/terraform/checks/resource/azure/example_AKSEncryptionAtHostEnabled/main.tf b/tests/terraform/checks/resource/azure/example_AKSEncryptionAtHostEnabled/main.tf
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/azure/example_AKSEncryptionAtHostEnabled/main.tf
@@ -0,0 +1,98 @@
+resource "azurerm_kubernetes_cluster" "pass" {
+  name                = "example-aks1"
+  location            = azurerm_resource_group.example.location
+  resource_group_name = azurerm_resource_group.example.name
+  dns_prefix          = "exampleaks1"
+  enable_host_encryption  = true
+
+  default_node_pool {
+    name       = "default"
+    node_count = 1
+    vm_size    = "Standard_D2_v2"
+  }
+
+  identity {
+    type = "SystemAssigned"
+  }
+
+  tags = {
+    Environment = "Production"
+  }
+}
+
+resource "azurerm_kubernetes_cluster_node_pool" "pass" {
+  name                  = "internal"
+  kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id
+  vm_size               = "Standard_DS2_v2"
+  node_count            = 1
+  enable_host_encryption  = true
+
+  tags = {
+    Environment = "Production"
+  }
+}
+
+resource "azurerm_kubernetes_cluster" "fail" {
+  name                = "example-aks1"
+  location            = azurerm_resource_group.example.location
+  resource_group_name = azurerm_resource_group.example.name
+  dns_prefix          = "exampleaks1"
+
+  default_node_pool {
+    name       = "default"
+    node_count = 1
+    vm_size    = "Standard_D2_v2"
+  }
+
+  identity {
+    type = "SystemAssigned"
+  }
+
+  tags = {
+    Environment = "Production"
+  }
+}
+
+resource "azurerm_kubernetes_cluster_node_pool" "fail" {
+  name                  = "internal"
+  kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id
+  vm_size               = "Standard_DS2_v2"
+  node_count            = 1
+  tags = {
+    Environment = "Production"
+  }
+}
+
+resource "azurerm_kubernetes_cluster" "fail1" {
+  name                = "example-aks1"
+  location            = azurerm_resource_group.example.location
+  resource_group_name = azurerm_resource_group.example.name
+  dns_prefix          = "exampleaks1"
+  enable_host_encryption  = false
+
+  default_node_pool {
+    name       = "default"
+    node_count = 1
+    vm_size    = "Standard_D2_v2"
+  }
+
+  identity {
+    type = "SystemAssigned"
+  }
+
+  tags = {
+    Environment = "Production"
+  }
+}
+
+resource "azurerm_kubernetes_cluster_node_pool" "fail1" {
+  name                  = "internal"
+  kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id
+  vm_size               = "Standard_DS2_v2"
+  node_count            = 1
+  enable_host_encryption  = false
+
+  tags = {
+    Environment = "Production"
+  }
+}
\ No newline at end of file
diff --git a/tests/terraform/checks/resource/azure/test_AKSEncryptionAtHostEnabled.py b/tests/terraform/checks/resource/azure/test_AKSEncryptionAtHostEnabled.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/azure/test_AKSEncryptionAtHostEnabled.py
@@ -0,0 +1,45 @@
+import os
+import unittest
+
+from checkov.runner_filter import RunnerFilter
+from checkov.terraform.runner import Runner
+from checkov.terraform.checks.resource.azure.AKSEncryptionAtHostEnabled import check
+
+
+class AKSEncryptionAtHostEnabled(unittest.TestCase):
+
+    def test(self):
+        runner = Runner()
+        current_dir = os.path.dirname(os.path.realpath(__file__))
+
+        test_files_dir = os.path.join(current_dir, "example_AKSEncryptionAtHostEnabled")
+        report = runner.run(root_folder=test_files_dir,
+                            runner_filter=RunnerFilter(checks=[check.id]))
+        summary = report.get_summary()
+
+        passing_resources = {
+            'azurerm_kubernetes_cluster.pass',
+            'azurerm_kubernetes_cluster_node_pool.pass'
+        }
+        failing_resources = {
+            'azurerm_kubernetes_cluster.fail',
+            'azurerm_kubernetes_cluster.fail1',
+            'azurerm_kubernetes_cluster_node_pool.fail',
+            'azurerm_kubernetes_cluster_node_pool.fail1',
+        }
+        skipped_resources = {}
+
+        passed_check_resources = set([c.resource for c in report.passed_checks])
+        failed_check_resources = set([c.resource for c in report.failed_checks])
+
+        self.assertEqual(summary['passed'], len(passing_resources))
+        self.assertEqual(summary['failed'], len(failing_resources))
+        self.assertEqual(summary['skipped'], len(skipped_resources))
+        self.assertEqual(summary['parsing_errors'], 0)
+
+        self.assertEqual(passing_resources, passed_check_resources)
+        self.assertEqual(failing_resources, failed_check_resources)
+
+
+if __name__ == '__main__':
+    unittest.main()