Repository: bridgecrewio/checkov

Issue:
LaunchConfigurationEBSEncryption gives false-positives, due to not checking snapshot_id
In the relevant `aws_launch_configuration` Terraform docs https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration

```
encrypted - (Optional) Whether the volume should be encrypted or not. 
Do not use this option if you are using snapshot_id as the encrypted flag will be determined by the snapshot.
(Default: false).
```
The relevant part is **Do not use this option if you are using snapshot_id as the encrypted flag will be determined by the snapshot.** `snapshot_id` is not taken into account in the current check:

https://github.com/bridgecrewio/checkov/blob/d67ec380daf81b889e83d4d7c7d33f490525e899/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py#L16-L34

Discussion:

Patch:
diff --git a/checkov/common/runners/runner_registry.py b/checkov/common/runners/runner_registry.py
index 9805499f7..e8b1f64b2 100644
--- a/checkov/common/runners/runner_registry.py
+++ b/checkov/common/runners/runner_registry.py
@@ -29,7 +29,11 @@ class RunnerRegistry(object):
         return self.scan_reports
 
     def print_reports(self, scan_reports, args):
-        if args.output != "json" and args.output != "junitxml" and args.output != "github_failed_only":
+        if args.output not in (
+            "github_failed_only",
+            "json",
+            "junitxml",
+        ):
             print(f"{self.banner}\n")
         exit_codes = []
         report_jsons = []
diff --git a/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py b/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py
index b94e43aa6..c8f2bd97f 100644
--- a/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py
+++ b/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py
@@ -20,15 +20,25 @@ class LaunchConfigurationEBSEncryption(BaseResourceValueCheck):
         :param conf: aws_launch_configuration configuration
         :return: <CheckResult>
         """
-        have_root_block = 0
         for key in conf.keys():
-            if "block_device" in key and "ephemeral" not in key:
-                if isinstance(conf[key][0], dict) and conf[key][0].get("encrypted") != [True]:
+            if (
+                "block_device" in key
+                and
+                "ephemeral" not in key
+            ):
+                if (
+                    isinstance(conf[key][0], dict)
+                    and
+                    conf[key][0].get("encrypted") != [True]
+                    and
+                    # If present, the encrypted flag will be determined by the snapshot
+                    # Note: checkov does not know if snapshot is encrypted, so we default to PASSED
+                    not conf[key][0].get("snapshot_id")
+                ):
                     return CheckResult.FAILED
-            if "root_block_device" in key:
-                # Issue 496 - TF will create unencrypted EBS root by default if whole root_block_device block is omitted.
-                have_root_block = 1
-        if have_root_block == 0: 
+
+        # Issue 496 - TF will create unencrypted EBS root by default if whole root_block_device block is omitted.
+        if "root_block_device" not in conf.keys():
             return CheckResult.FAILED
 
         return CheckResult.PASSED
diff --git a/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py b/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py
index d1a375f8b..c82526c79 100644
--- a/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py
+++ b/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py
@@ -6,8 +6,13 @@ class SecurityGroupRuleDescription(BaseResourceCheck):
     def __init__(self):
         name = "Ensure every security groups rule has a description"
         id = "CKV_AWS_23"
-        supported_resource = ['aws_security_group', 'aws_security_group_rule', 'aws_db_security_group',
-                              'aws_elasticache_security_group', 'aws_redshift_security_group']
+        supported_resource = [
+            'aws_security_group',
+            'aws_security_group_rule',
+            'aws_db_security_group',
+            'aws_elasticache_security_group',
+            'aws_redshift_security_group',
+        ]
         categories = [CheckCategories.NETWORKING]
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource)
 


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_LaunchConfigurationEBSEncryption.py b/tests/terraform/checks/resource/aws/test_LaunchConfigurationEBSEncryption.py
index 095ba42c8..f38bf0f21 100644
--- a/tests/terraform/checks/resource/aws/test_LaunchConfigurationEBSEncryption.py
+++ b/tests/terraform/checks/resource/aws/test_LaunchConfigurationEBSEncryption.py
@@ -78,6 +78,24 @@ class TestLaunchConfigurationEBSEncryption(unittest.TestCase):
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)    
 
+    def test_success_with_snapshot_id(self):
+        hcl_res = hcl2.loads("""
+                        resource "aws_instance" "test" {
+                              ami                  = var.ami_id
+                              instance_type        = var.instance_type
+                              key_name             = var.key_name
+
+                              root_block_device {
+                                volume_type = "gp2"
+                                volume_size = var.root_volume_size
+                                snapshot_id = "snap-1234"
+                              }
+                            }
+                        """)
+        resource_conf = hcl_res['resource'][0]['aws_instance']['test']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
     def test_success(self):
         hcl_res = hcl2.loads("""
                         resource "aws_instance" "test" {