Repository: bridgecrewio/checkov

Issue:
CKV_AWS_265 false positive
**Describe the issue**
CKV_AWS_265 fails checks on KeySpaces not using a Customer Managed KMS key even though it is configured to do so

This is because the code is looking for ["CUSTOMER_MANAGED_KEY"](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KeyspacesTableUsesCMK.py#L17)

When the specification is listed as actually ["CUSTOMER_MANAGED_KMS_KEY"](https://docs.aws.amazon.com/keyspaces/latest/APIReference/API_EncryptionSpecification.html)

**Examples**
```
resource "aws_keyspaces_table" "keyspace_table" {
  keyspace_name = "foo"
  table_name    = "bar"
  encryption_specification {
   ## This should not fail the check CKV_AWS_265 but it does
    kms_key_identifier = var.kms_key_arn
    type               = "CUSTOMER_MANAGED_KMS_KEY"
  }
}
```

**Version (please complete the following information):**
 - 3.0.32

**Additional context**

```
~/Downloads> checkov -f ./keyspaces.tf --support
2023-11-10 09:21:38,953 [MainThread  ] [WARNI]  --bc-api-key argument is required when using --support
[ terraform framework ]: 100%|████████████████████|[1/1], Current File Scanned=keyspaces.tf
[ secrets framework ]: 100%|████████████████████|[1/1], Current File Scanned=./keyspaces.tf

       _               _
   ___| |__   ___  ___| | _______   __
  / __| '_ \ / _ \/ __| |/ / _ \ \ / /
 | (__| | | |  __/ (__|   < (_) \ V /
  \___|_| |_|\___|\___|_|\_\___/ \_/

By Prisma Cloud | version: 3.0.32

terraform scan results:

Passed checks: 0, Failed checks: 1, Skipped checks: 0

Check: CKV_AWS_265: "Ensure Keyspaces Table uses CMK"
	FAILED for resource: aws_keyspaces_table.keyspace_table
	File: /keyspaces.tf:1-9
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-keyspace-table-uses-customer-managed-keys-cmks

		1 | resource "aws_keyspaces_table" "keyspace_table" {
		2 |   keyspace_name = "foo"
		3 |   table_name    = "bar"
		4 |   encryption_specification {
		5 |    ## This should not fail the check CKV_AWS_265 but it does
		6 |     kms_key_identifier = var.kms_key_arn
		7 |     type               = "CUSTOMER_MANAGED_KMS_KEY"
		8 |   }
		9 | }
```




Discussion:
Hey @andyfase thanks for reaching out.

Great observation, are you interested in contributing the needed change?

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/KeyspacesTableUsesCMK.py b/checkov/terraform/checks/resource/aws/KeyspacesTableUsesCMK.py
--- a/checkov/terraform/checks/resource/aws/KeyspacesTableUsesCMK.py
+++ b/checkov/terraform/checks/resource/aws/KeyspacesTableUsesCMK.py
@@ -3,6 +3,10 @@
 
 
 class KeyspacesTableUsesCMK(BaseResourceCheck):
+    """
+    Valid values for encryption_specification type:
+    AWS_OWNED_KMS_KEY (default), CUSTOMER_MANAGED_KMS_KEY (requires kms_key_identifier:ARN)
+    """
     def __init__(self):
         name = "Ensure Keyspaces Table uses CMK"
         id = "CKV_AWS_265"
@@ -14,7 +18,7 @@ def scan_resource_conf(self, conf) -> CheckResult:
         if conf.get("encryption_specification") and isinstance(conf.get("encryption_specification"), list):
             encrypt = conf.get("encryption_specification")[0]
             if encrypt.get("kms_key_identifier") and isinstance(encrypt.get("kms_key_identifier"), list):
-                if encrypt.get("type") == ["CUSTOMER_MANAGED_KEY"]:
+                if encrypt.get("type") == ["CUSTOMER_MANAGED_KMS_KEY"]:
                     return CheckResult.PASSED
                 self.evaluated_keys = ["encryption_specification/[0]/type"]
             self.evaluated_keys = ["encryption_specification/[0]/kms_key_identifier"]


Test patch:
diff --git a/tests/terraform/checks/resource/aws/example_KeyspacesTableUsesCMK/main.tf b/tests/terraform/checks/resource/aws/example_KeyspacesTableUsesCMK/main.tf
--- a/tests/terraform/checks/resource/aws/example_KeyspacesTableUsesCMK/main.tf
+++ b/tests/terraform/checks/resource/aws/example_KeyspacesTableUsesCMK/main.tf
@@ -31,7 +31,6 @@ resource "aws_keyspaces_table" "fail2" {
   encryption_specification {
     type="AWS_OWNED_KMS_KEY"
   }
-
 }
 
 
@@ -53,7 +52,6 @@ resource "aws_keyspaces_table" "fail3" {
     kms_key_identifier=aws_kms_key.example.arn
     type="AWS_OWNED_KMS_KEY"
   }
-
 }
 
 resource "aws_keyspaces_table" "pass" {
@@ -72,7 +70,6 @@ resource "aws_keyspaces_table" "pass" {
   }
   encryption_specification {
     kms_key_identifier=aws_kms_key.example.arn
-    type="CUSTOMER_MANAGED_KEY"
+    type="CUSTOMER_MANAGED_KMS_KEY"
   }
-
-}
\ No newline at end of file
+}