Repository: bridgecrewio/checkov

Issue:
Missing AWS RDS CA in CKV_AWS_211
**Describe the issue**
In check CKV_AWS_211, checkov currently only checks for one possible CA on AWS RDS instances, namely `rds-ca-2019` (see [associated code](https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py#L24)) whereas RDS supports several (see [AWS docs](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.RegionCertificateAuthorities)). The check should accept those CAs: `rds-ca-rsa2048-g1`, `rds-ca-rsa4096-g1` and `rds-ca-ecc384-g1`.

**Examples**
Terraform code on which the check should pass:
```terraform
resource "aws_db_instance" "pass3" {
  allocated_storage                   = 20
  storage_type                        = "gp2"
  engine                              = "mysql"
  engine_version                      = "5.7"
  instance_class                      = "db.t2.micro"
  db_name                             = "mydb"
  username                            = "foo"
  password                            = "foobarbaz"
  iam_database_authentication_enabled = true
  storage_encrypted                   = true
  ca_cert_identifier                  = "rds-ca-rsa2048-g1"
}
```
When I run checkov on this Terraform example, I get an error whereas the test should pass:

```
Check: CKV_AWS_211: "Ensure RDS uses a modern CaCert"
	FAILED for resource: aws_db_instance.pass3
	File: /main.tf:43-55
	Guide: https://docs.paloaltonetworks.com/content/techdocs/en_US/prisma/prisma-cloud/prisma-cloud-code-security-policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-uses-a-modern-cacert.html

		43 | resource "aws_db_instance" "pass3" {
		44 |   allocated_storage                   = 20
		45 |   storage_type                        = "gp2"
		46 |   engine                              = "mysql"
		47 |   engine_version                      = "5.7"
		48 |   instance_class                      = "db.t2.micro"
		49 |   db_name                             = "mydb"
		50 |   username                            = "foo"
		51 |   password                            = "foobarbaz"
		52 |   iam_database_authentication_enabled = true
		53 |   storage_encrypted                   = true
		54 |   ca_cert_identifier                  = "rds-ca-rsa2048-g1"
		55 | }
```

**Version (please complete the following information):**
 - Checkov Version 2.0.930



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py b/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py
--- a/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py
+++ b/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py
@@ -21,7 +21,7 @@ def get_inspected_key(self) -> str:
         return "ca_cert_identifier"
 
     def get_expected_values(self) -> List[Any]:
-        return ["rds-ca-2019"]
+        return ["rds-ca-rsa2048-g1", "rds-ca-rsa4096-g1", "rds-ca-ecc384-g1"]
 
 
 check = RDSCACertIsRecent()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/example_RDSCACertIsRecent/main.tf b/tests/terraform/checks/resource/aws/example_RDSCACertIsRecent/main.tf
--- a/tests/terraform/checks/resource/aws/example_RDSCACertIsRecent/main.tf
+++ b/tests/terraform/checks/resource/aws/example_RDSCACertIsRecent/main.tf
@@ -5,7 +5,7 @@ resource "aws_db_instance" "fail" {
   engine                              = "mysql"
   engine_version                      = "5.7"
   instance_class                      = "db.t2.micro"
-  name                                = "mydb"
+  db_name                             = "mydb"
   username                            = "foo"
   password                            = "foobarbaz"
   iam_database_authentication_enabled = true
@@ -13,29 +13,25 @@ resource "aws_db_instance" "fail" {
   ca_cert_identifier                  = "rds-ca-2015"
 }
 
-resource "aws_db_instance" "pass" {
-  allocated_storage                   = 20
-  storage_type                        = "gp2"
-  engine                              = "mysql"
-  engine_version                      = "5.7"
-  instance_class                      = "db.t2.micro"
-  name                                = "mydb"
-  username                            = "foo"
-  password                            = "foobarbaz"
-  iam_database_authentication_enabled = true
-  storage_encrypted                   = true
-  ca_cert_identifier                  = "rds-ca-2019"
+locals {
+  passing_ca_cert_identifiers = [
+    "rds-ca-rsa2048-g1",
+    "rds-ca-rsa4096-g1",
+    "rds-ca-ecc384-g1",
+  ]
 }
 
-resource "aws_db_instance" "pass2" {
+resource "aws_db_instance" "pass" {
+  for_each                            = local.passing_ca_cert_identifiers
   allocated_storage                   = 20
   storage_type                        = "gp2"
   engine                              = "mysql"
   engine_version                      = "5.7"
   instance_class                      = "db.t2.micro"
-  name                                = "mydb"
+  db_name                             = "mydb"
   username                            = "foo"
   password                            = "foobarbaz"
   iam_database_authentication_enabled = true
   storage_encrypted                   = true
+  ca_cert_identifier                  = each.key
 }
diff --git a/tests/terraform/checks/resource/aws/test_RDSCACertIsRecent.py b/tests/terraform/checks/resource/aws/test_RDSCACertIsRecent.py
--- a/tests/terraform/checks/resource/aws/test_RDSCACertIsRecent.py
+++ b/tests/terraform/checks/resource/aws/test_RDSCACertIsRecent.py
@@ -14,8 +14,9 @@ def test(self):
         summary = report.get_summary()
 
         passing_resources = {
-            "aws_db_instance.pass",
-            "aws_db_instance.pass2",
+            "aws_db_instance.pass[\"rds-ca-rsa2048-g1\"]",
+            "aws_db_instance.pass[\"rds-ca-rsa4096-g1\"]",
+            "aws_db_instance.pass[\"rds-ca-ecc384-g1\"]",
         }
         failing_resources = {
             "aws_db_instance.fail",
@@ -24,7 +25,7 @@ def test(self):
         passed_check_resources = set([c.resource for c in report.passed_checks])
         failed_check_resources = set([c.resource for c in report.failed_checks])
 
-        self.assertEqual(summary["passed"], 2)
+        self.assertEqual(summary["passed"], 3)
         self.assertEqual(summary["failed"], 1)
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)