Repository: bridgecrewio/checkov

Issue:
CKV_AWS_129 - RDS logs enabled
**Describe the bug**
I just want to verify, what this check really wants to check. Looking at the info message it complains about me not enabling logs for my database, which I'm doing `enabled_cloudwatch_logs_exports = ["general", "error", "slowquery"]`. Looking at the code of the check, it actually checks for the presence of the field `monitoring_role_arn`, which is ok to check, but has nothing to do with logging it is connected to enhanced monitoring.

I'm happy to provide a fix, I just want to know what you actually want to check here and I would also remove the second `that` 😉 

**To Reproduce**

```
resource "aws_db_instance" "this" {
  #checkov:skip=CKV_AWS_118: enhanced monitoring not needed

  allocated_storage = local.db_allocated_storage
  engine            = "mysql"
  instance_class    = var.instance_class
  password          = module.secret_database.secret
  username          = local.db_username

  backup_retention_period         = local.db_backup_retention_period
  db_subnet_group_name            = aws_db_subnet_group.this.name
  enabled_cloudwatch_logs_exports = ["general", "error", "slowquery"]
  engine_version                  = var.engine_version
  identifier                      = local.db_name
  final_snapshot_identifier       = "${local.db_name}-final"
  name                            = local.db_name
  port                            = local.db_port
  storage_encrypted               = true
  storage_type                    = "gp2"
  vpc_security_group_ids          = [aws_security_group.database.id]

  lifecycle {
    ignore_changes = [
      snapshot_identifier
    ]
  }
}
```

Outcome:
```
Check: CKV_AWS_129: "Ensure that that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
        FAILED for resource: module.matomo.aws_db_instance.this
        File: /../../../modules/xxx/rds.tf:1-27
        Calling File: /main.tf:1-15

                1  | resource "aws_db_instance" "this" {
                2  |   #checkov:skip=CKV_AWS_118: enhanced monitoring not needed
                3  | 
                4  |   allocated_storage = local.db_allocated_storage
                5  |   engine            = "mysql"
                6  |   instance_class    = var.instance_class
                7  |   password          = module.secret_database.secret
                8  |   username          = local.db_username
                9  | 
                10 |   backup_retention_period         = local.db_backup_retention_period
                11 |   db_subnet_group_name            = aws_db_subnet_group.this.name
                12 |   enabled_cloudwatch_logs_exports = ["general", "error", "slowquery"]
                13 |   engine_version                  = var.engine_version
                14 |   identifier                      = local.db_name
                15 |   final_snapshot_identifier       = "${local.db_name}-final"
                16 |   name                            = local.db_name
                17 |   port                            = local.db_port
                18 |   storage_encrypted               = true
                19 |   storage_type                    = "gp2"
                20 |   vpc_security_group_ids          = [aws_security_group.database.id]
                21 | 
                22 |   lifecycle {
                23 |     ignore_changes = [
                24 |       snapshot_identifier
                25 |     ]
                26 |   }
                27 | }

```

**Additional context**
https://github.com/bridgecrewio/checkov/blob/145866472a6bafc09073e43d14a8c8e6691e040e/checkov/terraform/checks/resource/aws/DBInstanceMonitoring.py#L6-L19



Discussion:
@livnoni can you please advise?
I'm disabling the rule, I can't figure out how to comply with it.
@gruebel You're right. A fix PR would be welcome!

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/DBInstanceLogging.py b/checkov/terraform/checks/resource/aws/DBInstanceLogging.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/DBInstanceLogging.py
@@ -0,0 +1,22 @@
+from checkov.common.models.enums import CheckCategories, CheckResult
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+
+
+class DBInstanceLogging(BaseResourceCheck):
+    def __init__(self):
+        name = "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
+        id = "CKV_AWS_129"
+        supported_resources = ["aws_db_instance"]
+        categories = [CheckCategories.LOGGING]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def scan_resource_conf(self, conf):
+        # which log types are chooseable depends on the engine and engine version and even region,
+        # therefore it is only checked, if something is enabled.
+        if conf.get("enabled_cloudwatch_logs_exports", [[]])[0]:
+            return CheckResult.PASSED
+
+        return CheckResult.FAILED
+
+
+check = DBInstanceLogging()
diff --git a/checkov/terraform/checks/resource/aws/DBInstanceMonitoring.py b/checkov/terraform/checks/resource/aws/DBInstanceMonitoring.py
deleted file mode 100644
--- a/checkov/terraform/checks/resource/aws/DBInstanceMonitoring.py
+++ /dev/null
@@ -1,21 +0,0 @@
-from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
-from checkov.common.models.enums import CheckCategories
-from checkov.common.models.consts import ANY_VALUE
-
-
-class DBInstanceMonitoring(BaseResourceValueCheck):
-
-    def __init__(self):
-        name = "Ensure that that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
-        id = "CKV_AWS_129"
-        supported_resources = ['aws_db_instance']
-        categories = [CheckCategories.IAM]
-        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
-
-    def get_inspected_key(self):
-        return "monitoring_role_arn"
-
-    def get_expected_value(self):
-        return ANY_VALUE
-
-check = DBInstanceMonitoring()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/example_DBInstanceLogging/main.tf b/tests/terraform/checks/resource/aws/example_DBInstanceLogging/main.tf
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/example_DBInstanceLogging/main.tf
@@ -0,0 +1,41 @@
+# pass
+
+resource "aws_db_instance" "postgres" {
+  allocated_storage = 5
+  engine            = "postgres"
+  instance_class    = "db.t3.small"
+  password          = "postgres"
+  username          = "postgres"
+
+  enabled_cloudwatch_logs_exports = ["postgresql", "upgrade"]
+}
+
+resource "aws_db_instance" "mysql" {
+  allocated_storage = 5
+  engine            = "mysql"
+  instance_class    = "db.t3.small"
+  password          = "mysql"
+  username          = "mysql"
+
+  enabled_cloudwatch_logs_exports = ["general", "error", "slowquery"]
+}
+
+# failure
+
+resource "aws_db_instance" "default" {
+  allocated_storage = 5
+  engine            = "mysql"
+  instance_class    = "db.t3.small"
+  password          = "mysql"
+  username          = "mysql"
+}
+
+resource "aws_db_instance" "empty" {
+  allocated_storage = 5
+  engine            = "mysql"
+  instance_class    = "db.t3.small"
+  password          = "mysql"
+  username          = "mysql"
+
+  enabled_cloudwatch_logs_exports = []
+}
diff --git a/tests/terraform/checks/resource/aws/test_DBInstanceLogging.py b/tests/terraform/checks/resource/aws/test_DBInstanceLogging.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_DBInstanceLogging.py
@@ -0,0 +1,40 @@
+import os
+import unittest
+
+from checkov.runner_filter import RunnerFilter
+from checkov.terraform.checks.resource.aws.DBInstanceLogging import check
+from checkov.terraform.runner import Runner
+
+
+class TestDBInstanceLogging(unittest.TestCase):
+    def test(self):
+        runner = Runner()
+        current_dir = os.path.dirname(os.path.realpath(__file__))
+
+        test_files_dir = current_dir + "/example_DBInstanceLogging"
+        report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]))
+        summary = report.get_summary()
+
+        passing_resources = {
+            "aws_db_instance.mysql",
+            "aws_db_instance.postgres",
+        }
+        failing_resources = {
+            "aws_db_instance.default",
+            "aws_db_instance.empty",
+        }
+
+        passed_check_resources = set([c.resource for c in report.passed_checks])
+        failed_check_resources = set([c.resource for c in report.failed_checks])
+
+        self.assertEqual(summary["passed"], 2)
+        self.assertEqual(summary["failed"], 2)
+        self.assertEqual(summary["skipped"], 0)
+        self.assertEqual(summary["parsing_errors"], 0)
+
+        self.assertEqual(passing_resources, passed_check_resources)
+        self.assertEqual(failing_resources, failed_check_resources)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/terraform/checks/resource/aws/test_DBInstanceMonitoring.py b/tests/terraform/checks/resource/aws/test_DBInstanceMonitoring.py
deleted file mode 100644
--- a/tests/terraform/checks/resource/aws/test_DBInstanceMonitoring.py
+++ /dev/null
@@ -1,33 +0,0 @@
-import unittest
-import hcl2
-
-from checkov.terraform.checks.resource.aws.DBInstanceMonitoring import check
-from checkov.common.models.enums import CheckResult
-
-
-class TestDBInstanceMonitoring(unittest.TestCase):
-
-    def test_failure(self):
-        hcl_res = hcl2.loads("""
-                    resource "aws_db_instance" "example" {                    
-                      allocated_storage = 10
-                    }
-                """)
-        resource_conf = hcl_res['resource'][0]['aws_db_instance']['example']
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.FAILED, scan_result)
-
-    def test_success(self):
-        hcl_res = hcl2.loads("""
-                    resource "aws_db_instance" "example" {                    
-                      allocated_storage = 10
-                      monitoring_role_arn = "iam_role_arn"
-                    }
-                """)
-        resource_conf = hcl_res['resource'][0]['aws_db_instance']['example']
-        scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.PASSED, scan_result)
-
-
-if __name__ == '__main__':
-    unittest.main()