Repository: bridgecrewio/checkov

Issue:
Duplicate check
**Describe the bug**
The new check `CKV_AWS_125` popped up complaining about me not activating point in time recovery for a DynamoDB table, which is surprising, because I already acknowledged it in the past. After digging into the code I found out that check `CKV_AWS_125` and `CKV_AWS_28` are identical. It would be great to delete one of them, probably the new one.

**Additional context**
https://github.com/bridgecrewio/checkov/blob/caafcbb83d6901b57c9a39464673670c150f0a33/checkov/terraform/checks/resource/aws/DynamodbRecovery.py#L5-L14
https://github.com/bridgecrewio/checkov/blob/caafcbb83d6901b57c9a39464673670c150f0a33/checkov/terraform/checks/resource/aws/DynamodbPointInTimeRecoveryEnabled.py#L5-L17



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/DynamodbPointInTimeRecoveryEnabled.py b/checkov/terraform/checks/resource/aws/DynamodbPointInTimeRecoveryEnabled.py
deleted file mode 100644
--- a/checkov/terraform/checks/resource/aws/DynamodbPointInTimeRecoveryEnabled.py
+++ /dev/null
@@ -1,20 +0,0 @@
-from checkov.common.models.enums import CheckCategories, CheckResult
-from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
-
-
-class DynamodbPointInTimeRecoveryEnabled(BaseResourceValueCheck):
-    def __init__(self):
-        name = "Ensure that that point in time recovery is enabled for Amazon DynamoDB tables"
-        id = "CKV_AWS_125"
-        supported_resources = ['aws_dynamodb_table']
-        categories = [CheckCategories.BACKUP_AND_RECOVERY]
-        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
-
-    def get_inspected_key(self):
-        return "point_in_time_recovery/[0]/enabled"
-
-    def get_expected_value(self):
-        return True
-
-
-check = DynamodbPointInTimeRecoveryEnabled()
diff --git a/checkov/terraform/checks/resource/aws/KMSKeyRotation.py b/checkov/terraform/checks/resource/aws/KMSKeyRotation.py
deleted file mode 100644
--- a/checkov/terraform/checks/resource/aws/KMSKeyRotation.py
+++ /dev/null
@@ -1,18 +0,0 @@
-from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
-from checkov.common.models.enums import CheckCategories
-
-
-class KMSKeyRotation(BaseResourceValueCheck):
-
-    def __init__(self):
-        name = "Ensure KMS have rotation policy"
-        id = "CKV_AWS_132"
-        supported_resources = ['aws_kms_key']
-        categories = [CheckCategories.ENCRYPTION]
-        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
-
-    def get_inspected_key(self):
-        return "enable_key_rotation"
-
-
-check = KMSKeyRotation()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_DynamodbPointInTimeRecoveryEnabled.py b/tests/terraform/checks/resource/aws/test_DynamodbPointInTimeRecoveryEnabled.py
deleted file mode 100644
--- a/tests/terraform/checks/resource/aws/test_DynamodbPointInTimeRecoveryEnabled.py
+++ /dev/null
@@ -1,170 +0,0 @@
-import unittest
-
-from checkov.common.models.enums import CheckResult
-from checkov.terraform.checks.resource.aws.DynamodbPointInTimeRecoveryEnabled import check
-import hcl2
-
-
-class TestDynamodbPointInTimeRecoveryEnabled(unittest.TestCase):
-
-    def test_failure1(self):
-        hcl_res = hcl2.loads("""
-resource "aws_dynamodb_table" "basic-dynamodb-table" {
-  name           = "GameScores"
-  billing_mode   = "PROVISIONED"
-  read_capacity  = 20
-  write_capacity = 20
-  hash_key       = "UserId"
-  range_key      = "GameTitle"
-
-  attribute {
-    name = "UserId"
-    type = "S"
-  }
-
-  attribute {
-    name = "GameTitle"
-    type = "S"
-  }
-
-  attribute {
-    name = "TopScore"
-    type = "N"
-  }
-
-  ttl {
-    attribute_name = "TimeToExist"
-    enabled        = false
-  }
-
-  global_secondary_index {
-    name               = "GameTitleIndex"
-    hash_key           = "GameTitle"
-    range_key          = "TopScore"
-    write_capacity     = 10
-    read_capacity      = 10
-    projection_type    = "INCLUDE"
-    non_key_attributes = ["UserId"]
-  }
-
-  tags = {
-    Name        = "dynamodb-table-1"
-    Environment = "production"
-  }
-}
-        """)
-        resource_conf = hcl_res['resource'][0]['aws_dynamodb_table']['basic-dynamodb-table']
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.FAILED, scan_result)
-
-    def test_failure2(self):
-        hcl_res = hcl2.loads("""
-resource "aws_dynamodb_table" "basic-dynamodb-table" {
-  name           = "GameScores"
-  billing_mode   = "PROVISIONED"
-  read_capacity  = 20
-  write_capacity = 20
-  hash_key       = "UserId"
-  range_key      = "GameTitle"
-  
-  point_in_time_recovery {
-    enabled = false
-  }
-
-  attribute {
-    name = "UserId"
-    type = "S"
-  }
-
-  attribute {
-    name = "GameTitle"
-    type = "S"
-  }
-
-  attribute {
-    name = "TopScore"
-    type = "N"
-  }
-
-  ttl {
-    attribute_name = "TimeToExist"
-    enabled        = false
-  }
-
-  global_secondary_index {
-    name               = "GameTitleIndex"
-    hash_key           = "GameTitle"
-    range_key          = "TopScore"
-    write_capacity     = 10
-    read_capacity      = 10
-    projection_type    = "INCLUDE"
-    non_key_attributes = ["UserId"]
-  }
-
-  tags = {
-    Name        = "dynamodb-table-1"
-    Environment = "production"
-  }
-}
-        """)
-        resource_conf = hcl_res['resource'][0]['aws_dynamodb_table']['basic-dynamodb-table']
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.FAILED, scan_result)
-
-    def test_success(self):
-        hcl_res = hcl2.loads("""
-resource "aws_dynamodb_table" "basic-dynamodb-table" {
-  name           = "GameScores"
-  billing_mode   = "PROVISIONED"
-  read_capacity  = 20
-  write_capacity = 20
-  hash_key       = "UserId"
-  range_key      = "GameTitle"
-  
-  point_in_time_recovery {
-    enabled = true
-  }
-
-  attribute {
-    name = "UserId"
-    type = "S"
-  }
-
-  attribute {
-    name = "GameTitle"
-    type = "S"
-  }
-
-  attribute {
-    name = "TopScore"
-    type = "N"
-  }
-
-  ttl {
-    attribute_name = "TimeToExist"
-    enabled        = false
-  }
-
-  global_secondary_index {
-    name               = "GameTitleIndex"
-    hash_key           = "GameTitle"
-    range_key          = "TopScore"
-    write_capacity     = 10
-    read_capacity      = 10
-    projection_type    = "INCLUDE"
-    non_key_attributes = ["UserId"]
-  }
-
-  tags = {
-    Name        = "dynamodb-table-1"
-    Environment = "production"
-  }
-}
-        """)
-        resource_conf = hcl_res['resource'][0]['aws_dynamodb_table']['basic-dynamodb-table']
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.PASSED, scan_result)
-
-
-if __name__ == '__main__':
-    unittest.main()
diff --git a/tests/terraform/checks/resource/aws/test_KMSKeyRotation.py b/tests/terraform/checks/resource/aws/test_KMSKeyRotation.py
deleted file mode 100644
--- a/tests/terraform/checks/resource/aws/test_KMSKeyRotation.py
+++ /dev/null
@@ -1,32 +0,0 @@
-import unittest
-import hcl2
-
-from checkov.common.models.enums import CheckResult
-from checkov.terraform.checks.resource.aws.KMSKeyRotation import check
-
-
-class TestKMSKeyRotation(unittest.TestCase):
-
-    def test_failure(self):
-        hcl_res = hcl2.loads("""
-                    resource "aws_kms_key" "example" {                    
-                      name = "example"
-                    }
-                """)
-        resource_conf = hcl_res['resource'][0]['aws_kms_key']['example']
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.FAILED, scan_result)
-
-    def test_success(self):
-        hcl_res = hcl2.loads("""
-                    resource "aws_kms_key" "example" {                    
-                      name                = "example"
-                      enable_key_rotation = true
-                    }
-                """)
-        resource_conf = hcl_res['resource'][0]['aws_kms_key']['example']
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.PASSED, scan_result)
-
-if __name__ == '__main__':
-    unittest.main()
diff --git a/tests/terraform/runner/test_runner.py b/tests/terraform/runner/test_runner.py
--- a/tests/terraform/runner/test_runner.py
+++ b/tests/terraform/runner/test_runner.py
@@ -184,6 +184,9 @@ def test_no_missing_ids(self):
             if f'CKV_AWS_{i}' == 'CKV_AWS_4':
                 # CKV_AWS_4 was deleted due to https://github.com/bridgecrewio/checkov/issues/371
                 continue
+            if f'CKV_AWS_{i}' in ('CKV_AWS_132', 'CKV_AWS_125'):
+                # These checks were removed because they were duplicates
+                continue
             if f'CKV_AWS_{i}' == 'CKV_AWS_95':
                 # CKV_AWS_95 is currently implemented just on cfn
                 continue