Repository: bridgecrewio/checkov

Issue:
CKV_AWS_325 check might not be accurate for PostgreSQL RDS instances
**Describe the issue**
The CKV_AWS_325 check expects the 'audit' log type to be enabled for RDS Cluster audit logging. However, this log type may not be applicable for PostgreSQL RDS instances, which use the 'postgresql' log type instead.

**Examples**
For a PostgreSQL RDS instance with the following Terraform configuration:

**main.tf**

```
resource "aws_rds_cluster" "main" {
  # ... other configurations ...
  enabled_cloudwatch_logs_exports = var.enabled_cloudwatch_logs_exports
  # ... other configurations ...
}
```

**variables.tf**

```
variable "enabled_cloudwatch_logs_exports" {
  default = [
    "postgresql"
  ]
}
```

The CKV_AWS_325 check fails, even though the 'postgresql' log type is enabled for the RDS instance.

**Expected outcome**
The CKV_AWS_325 check should either not be applicable or should pass for PostgreSQL RDS instances with the 'postgresql' log type enabled.

**Version**

**Checkov Version:** Lastest

**Additional context**
This issue was discovered while analyzing a Terraform configuration for an AWS PostgreSQL RDS instance. The CKV_AWS_325 check might need to be updated to accommodate different log types for different RDS engines.

https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterAuditLogging.py


Discussion:
I've noticed this as well, I tried enabling audit logs but the API returns:

```
InvalidParameterCombination: You cannot use the log types 'audit' with engine version aurora-postgresql 14.5. For supported log types, see the documentation.
```
hey @rajien2 thanks for reaching out.

yeah, it makes sense to treat the engines differently and I will disable it for `postgresql`, because to enable actual audit logging is a bit more complicated.

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/RDSClusterAuditLogging.py b/checkov/terraform/checks/resource/aws/RDSClusterAuditLogging.py
--- a/checkov/terraform/checks/resource/aws/RDSClusterAuditLogging.py
+++ b/checkov/terraform/checks/resource/aws/RDSClusterAuditLogging.py
@@ -5,6 +5,12 @@
 from checkov.common.models.enums import CheckCategories, CheckResult
 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
 
+SUPPORTED_ENGINES = {
+    "aurora",
+    "aurora-mysql",
+    "mysql"
+}
+
 
 class RDSClusterAuditLogging(BaseResourceCheck):
     def __init__(self) -> None:
@@ -15,13 +21,18 @@ def __init__(self) -> None:
         NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8)
         Database logging should be enabled
         """
-        name = "Ensure that RDS Cluster audit logging is enabled"
+        name = "Ensure that RDS Cluster audit logging is enabled for MySQL engine"
         id = "CKV_AWS_325"
         supported_resources = ("aws_rds_cluster",)
         categories = (CheckCategories.LOGGING,)
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
     def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:
+        engine = conf.get("engine")
+        if engine and isinstance(engine, list) and engine[0] not in SUPPORTED_ENGINES:
+            # only MySQL cluster support easy audit logging export
+            return CheckResult.UNKNOWN
+
         logs_exports = conf.get("enabled_cloudwatch_logs_exports")
         if (
             logs_exports


Test patch:
diff --git a/tests/terraform/checks/resource/aws/example_RDSClusterAuditLogging/main.tf b/tests/terraform/checks/resource/aws/example_RDSClusterAuditLogging/main.tf
--- a/tests/terraform/checks/resource/aws/example_RDSClusterAuditLogging/main.tf
+++ b/tests/terraform/checks/resource/aws/example_RDSClusterAuditLogging/main.tf
@@ -12,6 +12,7 @@ resource "aws_rds_cluster" "pass2" {
   master_password = "password"
   enabled_cloudwatch_logs_exports = ["general", "audit"]
   iam_database_authentication_enabled = true
+  engine = "aurora-mysql"
 }
 
 resource "aws_rds_cluster" "fail" {
@@ -25,3 +26,12 @@ resource "aws_rds_cluster" "fail2" {
   enabled_cloudwatch_logs_exports = ["error", "general", "slowquery"]
   iam_database_authentication_enabled = false
 }
+
+# unknown
+
+resource "aws_rds_cluster" "unknown" {
+  master_username = "username"
+  master_password = "password"
+
+  engine = "aurora-postgresql"
+}
diff --git a/tests/terraform/checks/resource/aws/test_RDSClusterAuditLogging.py b/tests/terraform/checks/resource/aws/test_RDSClusterAuditLogging.py
--- a/tests/terraform/checks/resource/aws/test_RDSClusterAuditLogging.py
+++ b/tests/terraform/checks/resource/aws/test_RDSClusterAuditLogging.py
@@ -10,7 +10,7 @@ class TestRDSClusterAuditLogging(unittest.TestCase):
     def test(self):
         test_files_dir = Path(__file__).parent / "example_RDSClusterAuditLogging"
 
-        report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]))
+        report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id]))
         summary = report.get_summary()
 
         passing_resources = {
@@ -29,6 +29,7 @@ def test(self):
         self.assertEqual(summary["failed"], len(failing_resources))
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)
+        self.assertEqual(summary["resource_count"], 5)
 
         self.assertEqual(passing_resources, passed_check_resources)
         self.assertEqual(failing_resources, failed_check_resources)