Repository: bridgecrewio/checkov

Issue:
CKV_AWS_338 does not account for 0 (keep forever) & has insufficient error message
**Describe the issue**
CKV_AWS_338 is a check for the number of retention days for a Cloudwatch log group. However, the actual check source code requires not just being specified, but also to be at least 1 year.

1 - The message "Ensure that CloudWatch Log Group specifies retention days" does not reflect the need to not only be specified, but also be of sufficient length (or provide ref to web page providing more detail on the check)

2 - 0 is a valid value and means that logs are always retained and never expire, which should result in passing the "must retain for at least 1 year" rule.

**Examples**
Please share an example code sample (in the IaC of your choice) + the expected outcomes.

**Version (please complete the following information):**
2.3.212


Discussion:
Not sure if this is the same issue, but as of 2.3.112, CKV_AWS_338 requires a list value; however, upon an apply, Terraform complains:

```
Inappropriate value for attribute "retention_in_days": number required.
```
This one got me this morning too,

The CKV_AWS_338 check in https://www.checkov.io/5.Policy%20Index/terraform.html references a check script (https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py) which seems to be validating the retention is at least 1 year, NOT that it is set as the name of the check would imply.

Faced the same issue this morning.. even though retention period is specified (less than 1 year), this is a hard check and failing when it is not at least more than 1 Year

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py b/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py
--- a/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py
+++ b/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py
@@ -3,7 +3,8 @@
 from typing import Any
 
 from checkov.common.models.enums import CheckCategories, CheckResult
-from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+from checkov.terraform.checks.resource.base_resource_check import \
+    BaseResourceCheck
 
 
 class CloudWatchLogGroupRetentionYear(BaseResourceCheck):
@@ -13,7 +14,7 @@ def __init__(self) -> None:
         NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-12
         CloudWatch log groups should be retained for at least 1 year
         """
-        name = "Ensure that CloudWatch Log Group specifies retention days"
+        name = "Ensure CloudWatch log groups retains logs for at least 1 year"
         id = "CKV_AWS_338"
         supported_resource = ("aws_cloudwatch_log_group",)
         categories = (CheckCategories.LOGGING,)
@@ -26,8 +27,8 @@ def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:
             if not isinstance(retention, int):
                 # probably a dependent variable
                 return CheckResult.UNKNOWN
-
-            if retention >= 365:
+            # If you select 0, the events in the log group are always retained and never expire.
+            if retention == 0 or retention >= 365:
                 return CheckResult.PASSED
 
         return CheckResult.FAILED


Test patch:
diff --git a/tests/terraform/checks/resource/aws/example_CloudWatchLogGroupRetentionYear/main.tf b/tests/terraform/checks/resource/aws/example_CloudWatchLogGroupRetentionYear/main.tf
--- a/tests/terraform/checks/resource/aws/example_CloudWatchLogGroupRetentionYear/main.tf
+++ b/tests/terraform/checks/resource/aws/example_CloudWatchLogGroupRetentionYear/main.tf
@@ -1,7 +1,11 @@
-resource "aws_cloudwatch_log_group" "pass" {
+resource "aws_cloudwatch_log_group" "pass_365" {
   retention_in_days = 365
 }
 
+resource "aws_cloudwatch_log_group" "pass_0" {
+  retention_in_days = 0
+}
+
 resource "aws_cloudwatch_log_group" "fail" {
   retention_in_days = 5
 }
diff --git a/tests/terraform/checks/resource/aws/test_CloudWatchLogGroupRetentionYear.py b/tests/terraform/checks/resource/aws/test_CloudWatchLogGroupRetentionYear.py
--- a/tests/terraform/checks/resource/aws/test_CloudWatchLogGroupRetentionYear.py
+++ b/tests/terraform/checks/resource/aws/test_CloudWatchLogGroupRetentionYear.py
@@ -1,4 +1,3 @@
-import os
 import unittest
 from pathlib import Path
 
@@ -19,7 +18,8 @@ def test(self):
         summary = report.get_summary()
 
         passing_resources = {
-            "aws_cloudwatch_log_group.pass",
+            "aws_cloudwatch_log_group.pass_365",
+            "aws_cloudwatch_log_group.pass_0",
         }
         failing_resources = {
             "aws_cloudwatch_log_group.fail",
@@ -32,7 +32,7 @@ def test(self):
         self.assertEqual(summary["failed"], len(failing_resources))
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)
-        self.assertEqual(summary["resource_count"], 3)  # 1 unknown
+        self.assertEqual(summary["resource_count"], 4)  # 1 unknown
 
         self.assertEqual(passing_resources, passed_check_resources)
         self.assertEqual(failing_resources, failed_check_resources)