internlm/SWE-Fixer-Train-110K huggingface dataset:
Repository: bridgecrewio/checkov

Issue:
Add new check: Athena Database Encryption at rest 
Athena Database should have encryption at rest enabled: 

encryption_configuration / encryption_option: https://www.terraform.io/docs/providers/aws/r/athena_database.html

Note I cannot find an AWS::Athena::Database resource.  It appears only Glue database which will be covered separately


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/AthenaDatabaseEncryption.py b/checkov/terraform/checks/resource/aws/AthenaDatabaseEncryption.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/AthenaDatabaseEncryption.py
@@ -0,0 +1,21 @@
+from checkov.common.models.consts import ANY_VALUE
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
+
+
+class AthenaDatabaseEncryption(BaseResourceValueCheck):
+    def __init__(self):
+        name = "Ensure Athena Database is encrypted at rest (default is unencrypted)"
+        id = "CKV_AWS_77"
+        supported_resources = ['aws_athena_database']
+        categories = [CheckCategories.ENCRYPTION]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_inspected_key(self):
+        return "encryption_configuration/[0]/encryption_option"
+
+    def get_expected_value(self):
+        return ANY_VALUE
+
+
+check = AthenaDatabaseEncryption()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_AthenaDatabaseEncryption.py b/tests/terraform/checks/resource/aws/test_AthenaDatabaseEncryption.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_AthenaDatabaseEncryption.py
@@ -0,0 +1,31 @@
+import unittest
+
+from checkov.common.models.enums import CheckResult
+from checkov.terraform.checks.resource.aws.AthenaDatabaseEncryption import check
+
+
+class TestAthenaDatabaseEncryption(unittest.TestCase):
+
+    def test_failure(self):
+        resource_conf = {
+            "name": "Example",
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        resource_conf = {
+            "name": "Example",
+            "encryption_configuration": [
+                {
+                    "encryption_option": "SSE_S3"
+                }
+            ],
+        }
+
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()
Repository: bridgecrewio/checkov

Issue:
Add new check: Athena Workgroup should enforce configuration to prevent client disabling encryption 
Verify enforce Work Group Configuration is true has ‘EnforceWorkGroupConfiguration’ True

EnforceWorkGroupConfiguration: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-athena-workgroup.html
enforce_workgroup_configuration: https://www.terraform.io/docs/providers/aws/r/athena_workgroup.html



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/AthenaWorkgroupConfiguration.py b/checkov/terraform/checks/resource/aws/AthenaWorkgroupConfiguration.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/AthenaWorkgroupConfiguration.py
@@ -0,0 +1,19 @@
+from checkov.common.models.enums import CheckCategories, CheckResult
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
+
+
+class AthenaWorkgroupConfiguration(BaseResourceValueCheck):
+
+    def __init__(self):
+        name = "Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption"
+        id = "CKV_AWS_82"
+        supported_resources = ['aws_athena_workgroup']
+        categories = [CheckCategories.GENERAL_SECURITY]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,
+                         missing_block_result=CheckResult.PASSED)
+
+    def get_inspected_key(self):
+        return "configuration/[0]/enforce_workgroup_configuration"
+
+
+check = AthenaWorkgroupConfiguration()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_AthenaWorkgroupConfiguration.py b/tests/terraform/checks/resource/aws/test_AthenaWorkgroupConfiguration.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_AthenaWorkgroupConfiguration.py
@@ -0,0 +1,44 @@
+import unittest
+
+from checkov.common.models.enums import CheckResult
+from checkov.terraform.checks.resource.aws.AthenaWorkgroupConfiguration import check
+
+
+class TestAthenaWorkgroupConfiguration(unittest.TestCase):
+
+    def test_failure(self):
+        resource_conf = {
+            "name": "Example",
+            "configuration": [
+                {
+                    "enforce_workgroup_configuration": False,
+                }
+            ],
+        }
+
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        resource_conf = {
+            "name": "Example",
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_success_full(self):
+        resource_conf = {
+            "name": "Example",
+            "configuration": [
+                {
+                    "enforce_workgroup_configuration": True,
+                }
+            ],
+        }
+
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()
Repository: bridgecrewio/checkov

Issue:
Add new check: API Gateway V2 should have access logging enabled 
AccessLogSettings: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html

Terraform does not currently support this: https://github.com/terraform-providers/terraform-provider-aws/issues/7004


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/APIGatewayAccessLogging.py b/checkov/terraform/checks/resource/aws/APIGatewayAccessLogging.py
--- a/checkov/terraform/checks/resource/aws/APIGatewayAccessLogging.py
+++ b/checkov/terraform/checks/resource/aws/APIGatewayAccessLogging.py
@@ -8,7 +8,7 @@ class APIGatewayAccessLogging(BaseResourceValueCheck):
     def __init__(self):
         name = "Ensure API Gateway has Access Logging enabled"
         id = "CKV_AWS_76"
-        supported_resources = ['aws_api_gateway_stage']
+        supported_resources = ['aws_api_gateway_stage', 'aws_apigatewayv2_stage']
         categories = [CheckCategories.LOGGING]
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 


Test patch:
Repository: bridgecrewio/checkov

Issue:
Add new check: Elasticsearch enforce HTTPS
domain_endpoint_options - enforce_https: https://www.terraform.io/docs/providers/aws/r/elasticsearch_domain.html#domain_endpoint_options
This feature has not yet been added to CloudFormation.  It was originally announced October 2019 and is listed on their roadmap here: 
https://github.com/aws-cloudformation/aws-cloudformation-coverage-roadmap/issues/201


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py b/checkov/terraform/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py
@@ -0,0 +1,18 @@
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
+
+
+class ElasticsearchDomainEnforceHTTPS(BaseResourceValueCheck):
+
+    def __init__(self):
+        name = "Ensure Elasticsearch Domain enforces HTTPS"
+        id = "CKV_AWS_83"
+        supported_resources = ['elasticsearch_domain']
+        categories = [CheckCategories.GENERAL_SECURITY]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_inspected_key(self):
+        return "domain_endpoint_options/[0]/enforce_https"
+
+
+check = ElasticsearchDomainEnforceHTTPS()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_ElasticsearchDomainEnforceHTTPS.py b/tests/terraform/checks/resource/aws/test_ElasticsearchDomainEnforceHTTPS.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_ElasticsearchDomainEnforceHTTPS.py
@@ -0,0 +1,42 @@
+import unittest
+
+from checkov.common.models.enums import CheckResult
+from checkov.terraform.checks.resource.aws.ElasticsearchDomainEnforceHTTPS import check
+
+
+class TestElasticsearchDomainEnforceHTTPS(unittest.TestCase):
+
+    def test_failure(self):
+        resource_conf = {
+            "domain_name": "Example",
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_failure_explicit(self):
+        resource_conf = {
+            "domain_name": "Example",
+            "domain_endpoint_options": [
+                {
+                    "enforce_https": False
+                }
+            ],
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        resource_conf = {
+            "domain_name": "Example",
+            "domain_endpoint_options": [
+                {
+                    "enforce_https": True
+                }
+            ],
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()
Repository: bridgecrewio/checkov

Issue:
Add new check: Elasticsearch ensure logging enabled
log_publishing_options - cloudwatch_log_group… https://www.terraform.io/docs/providers/aws/r/elasticsearch_domain.html
LogPublishingOptions - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticsearch-domain.html



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/ElasticsearchDomainLogging.py b/checkov/terraform/checks/resource/aws/ElasticsearchDomainLogging.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/ElasticsearchDomainLogging.py
@@ -0,0 +1,22 @@
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
+from checkov.common.models.enums import CheckCategories
+from checkov.common.models.consts import ANY_VALUE
+
+
+class ElasticsearchDomainLogging(BaseResourceValueCheck):
+
+    def __init__(self):
+        name = "Ensure Elasticsearch Domain Logging is enabled"
+        id = "CKV_AWS_84"
+        supported_resources = ['elasticsearch_domain']
+        categories = [CheckCategories.LOGGING]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_inspected_key(self):
+        return "log_publishing_options/[0]/cloudwatch_log_group_arn"
+
+    def get_expected_value(self):
+        return ANY_VALUE
+
+
+check = ElasticsearchDomainLogging()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_ElasticsearchDomainLogging.py b/tests/terraform/checks/resource/aws/test_ElasticsearchDomainLogging.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_ElasticsearchDomainLogging.py
@@ -0,0 +1,30 @@
+import unittest
+
+from checkov.common.models.enums import CheckResult
+from checkov.terraform.checks.resource.aws.ElasticsearchDomainLogging import check
+
+
+class TestElasticsearchDomainLogging(unittest.TestCase):
+
+    def test_failure(self):
+        resource_conf = {
+            "domain_name": "Example",
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        resource_conf = {
+            "domain_name": "Example",
+            "log_publishing_options": [
+                {
+                    "cloudwatch_log_group_arn": "some-arn"
+                }
+            ],
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()
Repository: bridgecrewio/checkov

Issue:
Add new check: DocumentDB Enable Logging 
enabled_cloudwatch_logs_exports: https://www.terraform.io/docs/providers/aws/r/docdb_cluster.html
EnableCloudwatchLogsExports: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-docdb-dbcluster.html


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/DocDBLogging.py b/checkov/terraform/checks/resource/aws/DocDBLogging.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/DocDBLogging.py
@@ -0,0 +1,24 @@
+from checkov.common.models.enums import CheckCategories, CheckResult
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck
+
+
+class DocDBLogging(BaseResourceCheck):
+    def __init__(self):
+        name = "Ensure DocDB Logging is enabled"
+        id = "CKV_AWS_85"
+        supported_resources = ['aws_docdb_cluster']
+        categories = [CheckCategories.LOGGING]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def scan_resource_conf(self, conf):
+        log_types = ["profiler", "audit"]
+
+        if 'enabled_cloudwatch_logs_exports' in conf:
+            if all(elem in conf["enabled_cloudwatch_logs_exports"][0] for elem in log_types):
+                return CheckResult.PASSED
+            else:
+                return CheckResult.FAILED
+        return CheckResult.FAILED
+
+
+check = DocDBLogging()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_DocDBLogging.py b/tests/terraform/checks/resource/aws/test_DocDBLogging.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_DocDBLogging.py
@@ -0,0 +1,35 @@
+import unittest
+
+from checkov.common.models.enums import CheckResult
+from checkov.terraform.checks.resource.aws.DocDBLogging import check
+
+
+class TestDocDBLogging(unittest.TestCase):
+
+    def test_failure(self):
+        resource_conf = {
+            "cluster_identifier": "my-docdb-cluster",
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_failure_partial(self):
+        resource_conf = {
+            "cluster_identifier": "my-docdb-cluster",
+            "enabled_cloudwatch_logs_exports": ["audit"],
+        }
+
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        resource_conf = {
+            "cluster_identifier": "my-docdb-cluster",
+            "enabled_cloudwatch_logs_exports": ["audit", "profiler"],
+        }
+
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+if __name__ == '__main__':
+    unittest.main()
Repository: bridgecrewio/checkov

Issue:
Add new check: CloudFront Distribution - Access Logging Enabled
Access Logging should be enabled for CloudFront Distributions

logging_config: https://www.terraform.io/docs/providers/aws/r/cloudfront_distribution.html
Logging: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/CloudfrontDistributionLogging.py b/checkov/terraform/checks/resource/aws/CloudfrontDistributionLogging.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/CloudfrontDistributionLogging.py
@@ -0,0 +1,22 @@
+from checkov.common.models.consts import ANY_VALUE
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
+
+
+class CloudfrontDistributionLogging(BaseResourceValueCheck):
+
+    def __init__(self):
+        name = "Ensure Cloudfront distribution has Access Logging enabled"
+        id = "CKV_AWS_86"
+        supported_resources = ['aws_cloudfront_distribution']
+        categories = [CheckCategories.LOGGING]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_inspected_key(self):
+        return "logging_config/[0]/bucket"
+
+    def get_expected_value(self):
+        return ANY_VALUE
+
+
+check = CloudfrontDistributionLogging()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_CloudfrontDistributionLogging.py b/tests/terraform/checks/resource/aws/test_CloudfrontDistributionLogging.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_CloudfrontDistributionLogging.py
@@ -0,0 +1,30 @@
+import unittest
+
+from checkov.common.models.enums import CheckResult
+from checkov.terraform.checks.resource.aws.CloudfrontDistributionLogging import check
+
+
+class TestCloudfrontDistributionLogging(unittest.TestCase):
+
+    def test_failure(self):
+        resource_conf = {
+            "comment": "Example",
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        resource_conf = {
+            "comment": "Example",
+            "logging_config": [
+                {
+                    "bucket": "some-arn"
+                }
+            ],
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()
Repository: bridgecrewio/checkov

Issue:
Update urllib3: HTTP Header Injection vuln
**Describe the bug**
urllib3 needs to be updated to at least 1.25.9 to fix a high severity HTTP Header Injection vulnerability. Snyk info page [here](https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-1014645).


Discussion:
CVE: [CVE-2020-26137](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26137)

Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -59,7 +59,7 @@
             "sphinxcontrib-jsmath==1.0.1",
             "sphinxcontrib-qthelp==1.0.2",
             "sphinxcontrib-serializinghtml==1.1.3",
-            "urllib3==1.25.7",
+            "urllib3==1.25.10",
             "wcwidth==0.1.7",
             "zipp==0.6.0",
             "GitPython==3.1.7",
@@ -81,7 +81,7 @@
         "six==1.15.0",
         "tabulate==0.8.6",
         "termcolor==1.1.0",
-        "urllib3==1.25.7",
+        "urllib3==1.25.10",
         "dpath==1.5.0",
         "GitPython==3.1.7",
         "gitdb==4.0.5"


Test patch:
Repository: bridgecrewio/checkov

Issue:
No module named 'packaging'
**Describe the bug**
Since latest docker image v1.0.640. We got an issue when running checkov on our CI.

**To Reproduce**
```
$ checkov --quiet -d directory
Traceback (most recent call last):
  File "/usr/local/bin/checkov", line 2, in <module>
    from checkov.main import run
  File "/usr/local/lib/python3.8/site-packages/checkov/main.py", line 23, in <module>
    from checkov.terraform.runner import Runner as tf_runner
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/runner.py", line 20, in <module>
    from checkov.terraform.parser import Parser
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/parser.py", line 16, in <module>
    from checkov.terraform.module_loading.registry import ModuleLoaderRegistry
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/module_loading/__init__.py", line 1, in <module>
    from checkov.terraform.module_loading.loaders import *
  File "/usr/local/lib/python3.8/site-packages/checkov/terraform/module_loading/loaders/versions_parser.py", line 2, in <module>
    from packaging import version
ModuleNotFoundError: No module named 'packaging'
```

**Additional context**
Using Docker Image v1.0.640



Discussion:

Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -63,7 +63,8 @@
             "wcwidth==0.1.7",
             "zipp==0.6.0",
             "GitPython==3.1.7",
-            "gitdb==4.0.5"
+            "gitdb==4.0.5",
+            "packaging==20.4"
         ]
     },
     install_requires=[
@@ -88,7 +89,8 @@
         "urllib3==1.25.10",
         "dpath==1.5.0",
         "GitPython==3.1.7",
-        "gitdb==4.0.5"
+        "gitdb==4.0.5",
+        "packaging==20.4"
     ],
     license="Apache License 2.0",
     name="checkov",


Test patch:
Repository: bridgecrewio/checkov

Issue:
Checkov logs to stdout making the json un-parseable
**Describe the bug**
When you run checkov with the `-o json` and `LOG_LEVEL=WARNING` the logs are printed to `stdout` together with the json object. This way it's hard and error prone to parse the json output.

**Expected behavior**
At least in `-o json` (or any parseable output) mode It should use stderr to log to and use stdout only for the parseable  output and log everything else to stderr.



Discussion:

Resolving patch:
diff --git a/checkov/logging_init.py b/checkov/logging_init.py
--- a/checkov/logging_init.py
+++ b/checkov/logging_init.py
@@ -9,7 +9,7 @@ def init():
     logging.basicConfig(level=LOG_LEVEL)
     logFormatter = logging.Formatter("%(asctime)s [%(threadName)-12.12s] [%(levelname)-5.5s]  %(message)s")
     rootLogger = logging.getLogger()
-    consoleHandler = logging.StreamHandler(sys.stdout)
+    consoleHandler = logging.StreamHandler(sys.stderr)
     consoleHandler.setFormatter(logFormatter)
     consoleHandler.setLevel(LOG_LEVEL)
     rootLogger.addHandler(consoleHandler)


Test patch: