Repository: bridgecrewio/checkov

Issue:
CKV_AWS_4 is an invalid check
**Describe the bug**
CKV_AWS_4 for terraform resource `aws_ebs_snapshot` is invalid. There is not an argument for encryption. Please remove this check.

**To Reproduce**
Steps to reproduce the behavior:
1. create tf file ckv_aws_4_test.tf:
```
resource "aws_ebs_volume" "example" {
  availability_zone = "us-west-2a"
  encrypted = true
  size              = 40

  tags = {
    Name = "HelloWorld"
  }
}

resource "aws_ebs_snapshot" "example_snapshot" {
  volume_id = "${aws_ebs_volume.example.id}"

  tags = {
    Name = "HelloWorld_snap"
  }
}
```

2. Run cli command  'checkov -f ckv_aws_4_test.tf'
3. Failed when should have passed

**Expected behavior**
Passing check

**Screenshots**
![image](https://user-images.githubusercontent.com/15948264/85431230-dd199180-b546-11ea-824f-b763481a3bfe.png)



**Desktop (please complete the following information):**
 - OS: [MacOS]
 - Checkov Version [1.0.391]

**Additional context**
- [link to resource doc](https://www.terraform.io/docs/providers/aws/r/ebs_snapshot.html)
As you can see, there is not an argument for encryption listed.  Only a computed artifact named encryption.
![image](https://user-images.githubusercontent.com/15948264/85432245-4c43b580-b548-11ea-8b5f-9b663364bb52.png)

- [TF SourceCode shows encryption as being computed](https://github.com/terraform-providers/terraform-provider-aws/blob/master/aws/resource_aws_ebs_snapshot.go)
![image](https://user-images.githubusercontent.com/15948264/85432117-1d2d4400-b548-11ea-9378-2dcb88c98cb2.png)

- The docs from AWS explain that snapshots that are taken from encrypted volumes are automatically encrypted. [link](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html) 

False positive for CKV_AWS_17
Checkov `1.0.391` will fail CKV_AWS_17 for a Terraform file defining any value for `publicly_accessible`, even false, because the check is for any value rather the actual security goal which should be a test for true:

https://github.com/bridgecrewio/checkov/blob/b906298b4a26135b7ee6b58f1aa4c54fc04ead20/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py

It should probably also say “RDS instance” rather than “RDS bucket”


Discussion:
you are right @jare19 . thank you for reporting this.  removing. cc: @nimrodkor can you please help with that?


Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/EBSSnapshotEncryption.py b/checkov/terraform/checks/resource/aws/EBSSnapshotEncryption.py
deleted file mode 100644
--- a/checkov/terraform/checks/resource/aws/EBSSnapshotEncryption.py
+++ /dev/null
@@ -1,17 +0,0 @@
-from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
-from checkov.common.models.enums import CheckCategories
-
-
-class EBSSnapshotEncryption(BaseResourceValueCheck):
-    def __init__(self):
-        name = "Ensure all data stored in the EBS Snapshot is securely encrypted"
-        id = "CKV_AWS_4"
-        supported_resources = ['aws_ebs_snapshot']
-        categories = [CheckCategories.ENCRYPTION]
-        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
-
-    def get_inspected_key(self):
-        return "encrypted"
-
-
-check = EBSSnapshotEncryption()
diff --git a/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py b/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py
--- a/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py
+++ b/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py
@@ -15,7 +15,7 @@ def get_inspected_key(self):
         return 'publicly_accessible'
 
     def get_forbidden_values(self):
-        return [ANY_VALUE]
+        return [True]
 
 
 check = RDSPubliclyAccessible()


Test patch:
diff --git a/tests/common/runner_registry/example_multi_iac/tf/example.tf b/tests/common/runner_registry/example_multi_iac/tf/example.tf
--- a/tests/common/runner_registry/example_multi_iac/tf/example.tf
+++ b/tests/common/runner_registry/example_multi_iac/tf/example.tf
@@ -24,3 +24,11 @@ resource "aws_s3_bucket" "foo-bucket" {
   acl           = "private"
 }
 data "aws_caller_identity" "current" {}
+
+resource aws_rds_cluster "rds_cluster" {}
+
+resource aws_rds_cluster_instance "rds_cluster_public" {
+  cluster_identifier = "id"
+  instance_class = "foo-bar"
+  publicly_accessible = false
+}
diff --git a/tests/terraform/checks/resource/aws/test_EBSSnapshotEncryption.py b/tests/terraform/checks/resource/aws/test_EBSSnapshotEncryption.py
deleted file mode 100644
--- a/tests/terraform/checks/resource/aws/test_EBSSnapshotEncryption.py
+++ /dev/null
@@ -1,21 +0,0 @@
-import unittest
-
-from checkov.terraform.checks.resource.aws.EBSSnapshotEncryption import check
-from checkov.common.models.enums import CheckResult
-
-
-class TestEBSSnapshotEncryption(unittest.TestCase):
-
-    def test_failure(self):
-        resource_conf = {'availability_zone': ['us-west-2a'], 'size': [40]}
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.FAILED, scan_result)
-
-    def test_success(self):
-        resource_conf =  {'availability_zone': ['us-west-2a'], 'size': [40],  'encrypted': [True]}
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.PASSED, scan_result)
-
-
-if __name__ == '__main__':
-    unittest.main()
diff --git a/tests/terraform/checks/resource/aws/test_RDSPubliclyAccessible.py b/tests/terraform/checks/resource/aws/test_RDSPubliclyAccessible.py
--- a/tests/terraform/checks/resource/aws/test_RDSPubliclyAccessible.py
+++ b/tests/terraform/checks/resource/aws/test_RDSPubliclyAccessible.py
@@ -1,6 +1,5 @@
-
-
 import unittest
+import hcl2
 
 from checkov.terraform.checks.resource.aws.RDSPubliclyAccessible import check
 from checkov.common.models.enums import CheckResult
@@ -9,12 +8,37 @@
 class TestRDSPubliclyAccessible(unittest.TestCase):
 
     def test_failure(self):
-        resource_conf =  {'engine': ['postgres'], 'engine_version': ['9.6.3'], 'multi_az': [False], 'backup_retention_period': [10], 'auto_minor_version_upgrade': [True], 'storage_encrypted': [False],'publicly_accessible':[True]}
+        hcl_res = hcl2.loads("""
+resource aws_rds_cluster_instance "rds_cluster_public" {
+  cluster_identifier = "id"
+  instance_class = "foo-bar"
+  publicly_accessible = true
+}
+        """)
+        resource_conf = hcl_res['resource'][0]['aws_rds_cluster_instance']['rds_cluster_public']
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
     def test_success(self):
-        resource_conf =  {'engine': ['postgres'], 'engine_version': ['9.6.3'], 'multi_az': [False], 'backup_retention_period': [10], 'auto_minor_version_upgrade': [True], 'storage_encrypted': [True]}
+        hcl_res = hcl2.loads("""
+        resource aws_rds_cluster_instance "rds_cluster_public" {
+          cluster_identifier = "id"
+          instance_class = "foo-bar"
+          publicly_accessible = false
+        }
+        """)
+        resource_conf = hcl_res['resource'][0]['aws_rds_cluster_instance']['rds_cluster_public']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_success2(self):
+        hcl_res = hcl2.loads("""
+           resource aws_rds_cluster_instance "rds_cluster_public" {
+             cluster_identifier = "id"
+             instance_class = "foo-bar"
+           }
+           """)
+        resource_conf = hcl_res['resource'][0]['aws_rds_cluster_instance']['rds_cluster_public']
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.PASSED, scan_result)
 
diff --git a/tests/terraform/runner/test_runner.py b/tests/terraform/runner/test_runner.py
--- a/tests/terraform/runner/test_runner.py
+++ b/tests/terraform/runner/test_runner.py
@@ -122,6 +122,9 @@ def test_no_missing_ids(self):
                 unique_checks.add(check.id)
         aws_checks = list(filter(lambda check_id: '_AWS_' in check_id, unique_checks))
         for i in range(1, len(aws_checks)):
+            if f'CKV_AWS_{i}' == 'CKV_AWS_4':
+                # CKV_AWS_4 was deleted due to https://github.com/bridgecrewio/checkov/issues/371
+                continue
             self.assertIn(f'CKV_AWS_{i}', aws_checks, msg=f'The new AWS violation should have the ID "CKV_AWS_{i}"')
 
         gcp_checks = list(filter(lambda check_id: '_GCP_' in check_id, unique_checks))