prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  CKV_AWS_338 does not account for 0 (keep forever) & has insufficient error message
  **Describe the issue**
  CKV_AWS_338 is a check for the number of retention days for a Cloudwatch log group. However, the actual check source code requires not just being specified, but also to be at least 1 year.
  
  1 - The message "Ensure that CloudWatch Log Group specifies retention days" does not reflect the need to not only be specified, but also be of sufficient length (or provide ref to web page providing more detail on the check)
  
  2 - 0 is a valid value and means that logs are always retained and never expire, which should result in passing the "must retain for at least 1 year" rule.
  
  **Examples**
  Please share an example code sample (in the IaC of your choice) + the expected outcomes.
  
  **Version (please complete the following information):**
  2.3.212
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py`
  Content:
  ```
  1 from __future__ import annotations
  2 
  3 from typing import Any
  4 
  5 from checkov.common.models.enums import CheckCategories, CheckResult
  6 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
  7 
  8 
  9 class CloudWatchLogGroupRetentionYear(BaseResourceCheck):
  10     def __init__(self) -> None:
  11         """
  12         NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-11, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4),
  13         NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-12
  14         CloudWatch log groups should be retained for at least 1 year
  15         """
  16         name = "Ensure that CloudWatch Log Group specifies retention days"
  17         id = "CKV_AWS_338"
  18         supported_resource = ("aws_cloudwatch_log_group",)
  19         categories = (CheckCategories.LOGGING,)
  20         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource)
  21 
  22     def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:
  23         retention = conf.get("retention_in_days")
  24         if retention and isinstance(retention, list):
  25             retention = retention[0]
  26             if not isinstance(retention, int):
  27                 # probably a dependent variable
  28                 return CheckResult.UNKNOWN
  29 
  30             if retention >= 365:
  31                 return CheckResult.PASSED
  32 
  33         return CheckResult.FAILED
  34 
  35 
  36 check = CloudWatchLogGroupRetentionYear()
  37
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py b/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py
  --- a/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py
  +++ b/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py
  @@ -3,7 +3,8 @@
   from typing import Any
   
   from checkov.common.models.enums import CheckCategories, CheckResult
  -from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
  +from checkov.terraform.checks.resource.base_resource_check import \
  +    BaseResourceCheck
   
   
   class CloudWatchLogGroupRetentionYear(BaseResourceCheck):
  @@ -13,7 +14,7 @@
           NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-12
           CloudWatch log groups should be retained for at least 1 year
           """
  -        name = "Ensure that CloudWatch Log Group specifies retention days"
  +        name = "Ensure CloudWatch log groups retains logs for at least 1 year"
           id = "CKV_AWS_338"
           supported_resource = ("aws_cloudwatch_log_group",)
           categories = (CheckCategories.LOGGING,)
  @@ -26,8 +27,8 @@
               if not isinstance(retention, int):
                   # probably a dependent variable
                   return CheckResult.UNKNOWN
  -
  -            if retention >= 365:
  +            # If you select 0, the events in the log group are always retained and never expire.
  +            if retention == 0 or retention >= 365:
                   return CheckResult.PASSED
   
           return CheckResult.FAILED
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py b/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py\n--- a/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py\n+++ b/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py\n@@ -3,7 +3,8 @@\n from typing import Any\n \n from checkov.common.models.enums import CheckCategories, CheckResult\n-from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n+from checkov.terraform.checks.resource.base_resource_check import \\\n+    BaseResourceCheck\n \n \n class CloudWatchLogGroupRetentionYear(BaseResourceCheck):\n@@ -13,7 +14,7 @@\n         NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-12\n         CloudWatch log groups should be retained for at least 1 year\n         \"\"\"\n-        name = \"Ensure that CloudWatch Log Group specifies retention days\"\n+        name = \"Ensure CloudWatch log groups retains logs for at least 1 year\"\n         id = \"CKV_AWS_338\"\n         supported_resource = (\"aws_cloudwatch_log_group\",)\n         categories = (CheckCategories.LOGGING,)\n@@ -26,8 +27,8 @@\n             if not isinstance(retention, int):\n                 # probably a dependent variable\n                 return CheckResult.UNKNOWN\n-\n-            if retention >= 365:\n+            # If you select 0, the events in the log group are always retained and never expire.\n+            if retention == 0 or retention >= 365:\n                 return CheckResult.PASSED\n \n         return CheckResult.FAILED\n", "issue": "CKV_AWS_338 does not account for 0 (keep forever) & has insufficient error message\n**Describe the issue**\r\nCKV_AWS_338 is a check for the number of retention days for a Cloudwatch log group. However, the actual check source code requires not just being specified, but also to be at least 1 year.\r\n\r\n1 - The message \"Ensure that CloudWatch Log Group specifies retention days\" does not reflect the need to not only be specified, but also be of sufficient length (or provide ref to web page providing more detail on the check)\r\n\r\n2 - 0 is a valid value and means that logs are always retained and never expire, which should result in passing the \"must retain for at least 1 year\" rule.\r\n\r\n**Examples**\r\nPlease share an example code sample (in the IaC of your choice) + the expected outcomes.\r\n\r\n**Version (please complete the following information):**\r\n2.3.212\n", "before_files": [{"content": "from __future__ import annotations\n\nfrom typing import Any\n\nfrom checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass CloudWatchLogGroupRetentionYear(BaseResourceCheck):\n    def __init__(self) -> None:\n        \"\"\"\n        NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-11, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4),\n        NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-12\n        CloudWatch log groups should be retained for at least 1 year\n        \"\"\"\n        name = \"Ensure that CloudWatch Log Group specifies retention days\"\n        id = \"CKV_AWS_338\"\n        supported_resource = (\"aws_cloudwatch_log_group\",)\n        categories = (CheckCategories.LOGGING,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource)\n\n    def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:\n        retention = conf.get(\"retention_in_days\")\n        if retention and isinstance(retention, list):\n            retention = retention[0]\n            if not isinstance(retention, int):\n                # probably a dependent variable\n                return CheckResult.UNKNOWN\n\n            if retention >= 365:\n                return CheckResult.PASSED\n\n        return CheckResult.FAILED\n\n\ncheck = CloudWatchLogGroupRetentionYear()\n", "path": "checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py"}], "after_files": [{"content": "from __future__ import annotations\n\nfrom typing import Any\n\nfrom checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_check import \\\n    BaseResourceCheck\n\n\nclass CloudWatchLogGroupRetentionYear(BaseResourceCheck):\n    def __init__(self) -> None:\n        \"\"\"\n        NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-11, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4),\n        NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-12\n        CloudWatch log groups should be retained for at least 1 year\n        \"\"\"\n        name = \"Ensure CloudWatch log groups retains logs for at least 1 year\"\n        id = \"CKV_AWS_338\"\n        supported_resource = (\"aws_cloudwatch_log_group\",)\n        categories = (CheckCategories.LOGGING,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource)\n\n    def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:\n        retention = conf.get(\"retention_in_days\")\n        if retention and isinstance(retention, list):\n            retention = retention[0]\n            if not isinstance(retention, int):\n                # probably a dependent variable\n                return CheckResult.UNKNOWN\n            # If you select 0, the events in the log group are always retained and never expire.\n            if retention == 0 or retention >= 365:\n                return CheckResult.PASSED\n\n        return CheckResult.FAILED\n\n\ncheck = CloudWatchLogGroupRetentionYear()\n", "path": "checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py"}]}