prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  CKV_AZURE_226: error in check and testcase
  **Describe the issue**
  CKV_AZURE_226 checks for ephemeral disks within the "main resource" azurerm_kubernetes_cluster but the cluster itself doesn't have any argument called os_disk_type. The argument os_disk_type is part of the node pool. 
  The testcase [here](https://github.com/bridgecrewio/checkov/pull/5584/files#diff-c0b8f08537766f6eff2a5d10b9439d227fdaaebe6ff7903008825c5f9d51c22dR1) is misleading and the check itself [here](https://github.com/bridgecrewio/checkov/pull/5584/files#diff-c9248390aa120f7af4643f1908d3d824fb903fd3c6cd63e9e77fe8e9ecd59289R28) too. 
  
  In my opinion this must be something like 
  ```
      def get_inspected_key(self) -> str:
          return "default_node_pool/[0]/os_disk_type"
  ```
  otherwise it won't work?
  
  Same for CKV_AZURE_227.
  
  **Examples**
  ```
  [root] # head -30 aks.tf
  resource "azurerm_kubernetes_cluster" "this" {
    name                = local.name_prefix
    location            = var.resource_group.location
    resource_group_name = var.resource_group.name
    node_resource_group = "${local.name_prefix}-node-pool"
    dns_prefix          = local.name_prefix
    kubernetes_version  = local.kubernetes_version
    sku_tier            = var.sku_tier
  
    api_server_access_profile {
      authorized_ip_ranges = var.api_server_authorized_ip_ranges
    }
  
    default_node_pool {
      name = "default"
  
      enable_host_encryption       = true
      vm_size                      = "Standard_E4ads_v5"
      os_disk_type                 = "Ephemeral"
      zones                        = [1, 2, 3]
      only_critical_addons_enabled = true
  
      type                 = "VirtualMachineScaleSets"
      vnet_subnet_id       = var.subnet_id
      enable_auto_scaling  = true
      max_count            = 6
      min_count            = 2
      orchestrator_version = local.kubernetes_version
  
      upgrade_settings {
  ```
  
  results in
  ```
  [root] # checkov --skip-framework kubernetes --skip-framework helm --quiet --compact -o junitxml -o cli --directory .
  2023-10-02 11:58:47,399 [MainThread  ] [WARNI]  The framework "sca_image" is part of the "SCA" module, which is not enabled in the platform
  2023-10-02 11:58:47,399 [MainThread  ] [WARNI]  The framework "sca_package" is part of the "SCA" module, which is not enabled in the platform
  terraform scan results:
  
  Passed checks: 6, Failed checks: 11, Skipped checks: 0
  
  [...]
  Check: CKV_AZURE_226: "Ensure ephemeral disks are used for OS disks"
          FAILED for resource: azurerm_kubernetes_cluster.this
          File: /aks.tf:1-64
  Check: CKV_AZURE_227: "Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources"
          FAILED for resource: azurerm_kubernetes_cluster.this
          File: /aks.tf:1-64
  [...]
  ```
  
  Please also see https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster for code example.
  
  **Version (please complete the following information):**
   - Checkov Version 2.4.58
  
  **Additional context**
  This is related to https://github.com/bridgecrewio/checkov/pull/5584 and https://github.com/bridgecrewio/checkov/pull/5588.
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py`
  Content:
  ```
  1 from checkov.common.models.enums import CheckCategories
  2 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
  3 from typing import Any
  4 
  5 
  6 class AKSEphemeralOSDisks(BaseResourceValueCheck):
  7     def __init__(self) -> None:
  8         """
  9         Temporary data can contain sensitive data at some points, by using ephemeral disks,
  10         we ensure that data written to OS disk is stored on local VM storage and isn't persisted to Azure Storage
  11 
  12         Azure automatically replicates data stored in the managed OS disk of a virtual machine to Azure storage
  13         to avoid data loss in case the virtual machine needs to be relocated to another host.
  14         Generally speaking, containers are not designed to have local state persisted to the managed OS disk,
  15         hence this behavior offers limited value to AKS hosted while providing some drawbacks,
  16         including slower node provisioning and higher read/write latency.
  17 
  18         Ephemeral disks allow us also to have faster cluster operations like scale or upgrade
  19         due to faster re-imaging and boot times.
  20         """
  21         name = "Ensure ephemeral disks are used for OS disks"
  22         id = "CKV_AZURE_226"
  23         supported_resources = ("azurerm_kubernetes_cluster",)
  24         categories = (CheckCategories.KUBERNETES,)
  25         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  26 
  27     def get_inspected_key(self) -> str:
  28         return "os_disk_type"
  29 
  30     def get_expected_value(self) -> Any:
  31         return "Ephemeral"
  32 
  33 
  34 check = AKSEphemeralOSDisks()
  35
  ```
  
  Path: `checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py`
  Content:
  ```
  1 
  2 from checkov.common.models.enums import CheckCategories, CheckResult
  3 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
  4 
  5 
  6 class AKSEncryptionAtHostEnabled(BaseResourceValueCheck):
  7     def __init__(self) -> None:
  8         """
  9         With host-based encryption, the data stored on the VM host of
  10         your AKS agent nodes' VMs is encrypted at rest and flows encrypted to the Storage service.
  11 
  12         This means the temp disks are encrypted at rest with platform-managed keys.
  13         The cache of OS and data disks is encrypted at rest with either platform-managed keys
  14         or customer-managed keys depending on the encryption type set on those disks.
  15         """
  16         name = "Ensure that the AKS cluster encrypt temp disks, caches, and data flows "
  17         name += "between Compute and Storage resources"
  18         id = "CKV_AZURE_227"
  19         supported_resources = ("azurerm_kubernetes_cluster", "azurerm_kubernetes_cluster_node_pool")
  20         categories = (CheckCategories.KUBERNETES,)
  21         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,
  22                          missing_block_result=CheckResult.FAILED)
  23 
  24     def get_inspected_key(self) -> str:
  25         return "enable_host_encryption"
  26 
  27 
  28 check = AKSEncryptionAtHostEnabled()
  29
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py b/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py
  --- a/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py
  +++ b/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py
  @@ -1,4 +1,3 @@
  -
   from checkov.common.models.enums import CheckCategories, CheckResult
   from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
   
  @@ -18,11 +17,19 @@
           id = "CKV_AZURE_227"
           supported_resources = ("azurerm_kubernetes_cluster", "azurerm_kubernetes_cluster_node_pool")
           categories = (CheckCategories.KUBERNETES,)
  -        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,
  -                         missing_block_result=CheckResult.FAILED)
  +        super().__init__(
  +            name=name,
  +            id=id,
  +            categories=categories,
  +            supported_resources=supported_resources,
  +            missing_block_result=CheckResult.FAILED,
  +        )
   
       def get_inspected_key(self) -> str:
  -        return "enable_host_encryption"
  +        if self.entity_type == "azurerm_kubernetes_cluster":
  +            return "default_node_pool/[0]/enable_host_encryption"
  +        else:
  +            return "enable_host_encryption"
   
   
   check = AKSEncryptionAtHostEnabled()
  diff --git a/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py b/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py
  --- a/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py
  +++ b/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py
  @@ -25,7 +25,7 @@
           super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
   
       def get_inspected_key(self) -> str:
  -        return "os_disk_type"
  +        return "default_node_pool/[0]/os_disk_type"
   
       def get_expected_value(self) -> Any:
           return "Ephemeral"
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py b/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py\n--- a/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py\n+++ b/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py\n@@ -1,4 +1,3 @@\n-\n from checkov.common.models.enums import CheckCategories, CheckResult\n from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n \n@@ -18,11 +17,19 @@\n         id = \"CKV_AZURE_227\"\n         supported_resources = (\"azurerm_kubernetes_cluster\", \"azurerm_kubernetes_cluster_node_pool\")\n         categories = (CheckCategories.KUBERNETES,)\n-        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,\n-                         missing_block_result=CheckResult.FAILED)\n+        super().__init__(\n+            name=name,\n+            id=id,\n+            categories=categories,\n+            supported_resources=supported_resources,\n+            missing_block_result=CheckResult.FAILED,\n+        )\n \n     def get_inspected_key(self) -> str:\n-        return \"enable_host_encryption\"\n+        if self.entity_type == \"azurerm_kubernetes_cluster\":\n+            return \"default_node_pool/[0]/enable_host_encryption\"\n+        else:\n+            return \"enable_host_encryption\"\n \n \n check = AKSEncryptionAtHostEnabled()\ndiff --git a/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py b/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py\n--- a/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py\n+++ b/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py\n@@ -25,7 +25,7 @@\n         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n \n     def get_inspected_key(self) -> str:\n-        return \"os_disk_type\"\n+        return \"default_node_pool/[0]/os_disk_type\"\n \n     def get_expected_value(self) -> Any:\n         return \"Ephemeral\"\n", "issue": "CKV_AZURE_226: error in check and testcase\n**Describe the issue**\r\nCKV_AZURE_226 checks for ephemeral disks within the \"main resource\" azurerm_kubernetes_cluster but the cluster itself doesn't have any argument called os_disk_type. The argument os_disk_type is part of the node pool. \r\nThe testcase [here](https://github.com/bridgecrewio/checkov/pull/5584/files#diff-c0b8f08537766f6eff2a5d10b9439d227fdaaebe6ff7903008825c5f9d51c22dR1) is misleading and the check itself [here](https://github.com/bridgecrewio/checkov/pull/5584/files#diff-c9248390aa120f7af4643f1908d3d824fb903fd3c6cd63e9e77fe8e9ecd59289R28) too. \r\n\r\nIn my opinion this must be something like \r\n```\r\n    def get_inspected_key(self) -> str:\r\n        return \"default_node_pool/[0]/os_disk_type\"\r\n```\r\notherwise it won't work?\r\n\r\nSame for CKV_AZURE_227.\r\n\r\n**Examples**\r\n```\r\n[root] # head -30 aks.tf\r\nresource \"azurerm_kubernetes_cluster\" \"this\" {\r\n  name                = local.name_prefix\r\n  location            = var.resource_group.location\r\n  resource_group_name = var.resource_group.name\r\n  node_resource_group = \"${local.name_prefix}-node-pool\"\r\n  dns_prefix          = local.name_prefix\r\n  kubernetes_version  = local.kubernetes_version\r\n  sku_tier            = var.sku_tier\r\n\r\n  api_server_access_profile {\r\n    authorized_ip_ranges = var.api_server_authorized_ip_ranges\r\n  }\r\n\r\n  default_node_pool {\r\n    name = \"default\"\r\n\r\n    enable_host_encryption       = true\r\n    vm_size                      = \"Standard_E4ads_v5\"\r\n    os_disk_type                 = \"Ephemeral\"\r\n    zones                        = [1, 2, 3]\r\n    only_critical_addons_enabled = true\r\n\r\n    type                 = \"VirtualMachineScaleSets\"\r\n    vnet_subnet_id       = var.subnet_id\r\n    enable_auto_scaling  = true\r\n    max_count            = 6\r\n    min_count            = 2\r\n    orchestrator_version = local.kubernetes_version\r\n\r\n    upgrade_settings {\r\n```\r\n\r\nresults in\r\n```\r\n[root] # checkov --skip-framework kubernetes --skip-framework helm --quiet --compact -o junitxml -o cli --directory .\r\n2023-10-02 11:58:47,399 [MainThread  ] [WARNI]  The framework \"sca_image\" is part of the \"SCA\" module, which is not enabled in the platform\r\n2023-10-02 11:58:47,399 [MainThread  ] [WARNI]  The framework \"sca_package\" is part of the \"SCA\" module, which is not enabled in the platform\r\nterraform scan results:\r\n\r\nPassed checks: 6, Failed checks: 11, Skipped checks: 0\r\n\r\n[...]\r\nCheck: CKV_AZURE_226: \"Ensure ephemeral disks are used for OS disks\"\r\n        FAILED for resource: azurerm_kubernetes_cluster.this\r\n        File: /aks.tf:1-64\r\nCheck: CKV_AZURE_227: \"Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources\"\r\n        FAILED for resource: azurerm_kubernetes_cluster.this\r\n        File: /aks.tf:1-64\r\n[...]\r\n```\r\n\r\nPlease also see https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster for code example.\r\n\r\n**Version (please complete the following information):**\r\n - Checkov Version 2.4.58\r\n\r\n**Additional context**\r\nThis is related to https://github.com/bridgecrewio/checkov/pull/5584 and https://github.com/bridgecrewio/checkov/pull/5588.\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\nfrom typing import Any\n\n\nclass AKSEphemeralOSDisks(BaseResourceValueCheck):\n    def __init__(self) -> None:\n        \"\"\"\n        Temporary data can contain sensitive data at some points, by using ephemeral disks,\n        we ensure that data written to OS disk is stored on local VM storage and isn't persisted to Azure Storage\n\n        Azure automatically replicates data stored in the managed OS disk of a virtual machine to Azure storage\n        to avoid data loss in case the virtual machine needs to be relocated to another host.\n        Generally speaking, containers are not designed to have local state persisted to the managed OS disk,\n        hence this behavior offers limited value to AKS hosted while providing some drawbacks,\n        including slower node provisioning and higher read/write latency.\n\n        Ephemeral disks allow us also to have faster cluster operations like scale or upgrade\n        due to faster re-imaging and boot times.\n        \"\"\"\n        name = \"Ensure ephemeral disks are used for OS disks\"\n        id = \"CKV_AZURE_226\"\n        supported_resources = (\"azurerm_kubernetes_cluster\",)\n        categories = (CheckCategories.KUBERNETES,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self) -> str:\n        return \"os_disk_type\"\n\n    def get_expected_value(self) -> Any:\n        return \"Ephemeral\"\n\n\ncheck = AKSEphemeralOSDisks()\n", "path": "checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py"}, {"content": "\nfrom checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n\n\nclass AKSEncryptionAtHostEnabled(BaseResourceValueCheck):\n    def __init__(self) -> None:\n        \"\"\"\n        With host-based encryption, the data stored on the VM host of\n        your AKS agent nodes' VMs is encrypted at rest and flows encrypted to the Storage service.\n\n        This means the temp disks are encrypted at rest with platform-managed keys.\n        The cache of OS and data disks is encrypted at rest with either platform-managed keys\n        or customer-managed keys depending on the encryption type set on those disks.\n        \"\"\"\n        name = \"Ensure that the AKS cluster encrypt temp disks, caches, and data flows \"\n        name += \"between Compute and Storage resources\"\n        id = \"CKV_AZURE_227\"\n        supported_resources = (\"azurerm_kubernetes_cluster\", \"azurerm_kubernetes_cluster_node_pool\")\n        categories = (CheckCategories.KUBERNETES,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,\n                         missing_block_result=CheckResult.FAILED)\n\n    def get_inspected_key(self) -> str:\n        return \"enable_host_encryption\"\n\n\ncheck = AKSEncryptionAtHostEnabled()\n", "path": "checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\nfrom typing import Any\n\n\nclass AKSEphemeralOSDisks(BaseResourceValueCheck):\n    def __init__(self) -> None:\n        \"\"\"\n        Temporary data can contain sensitive data at some points, by using ephemeral disks,\n        we ensure that data written to OS disk is stored on local VM storage and isn't persisted to Azure Storage\n\n        Azure automatically replicates data stored in the managed OS disk of a virtual machine to Azure storage\n        to avoid data loss in case the virtual machine needs to be relocated to another host.\n        Generally speaking, containers are not designed to have local state persisted to the managed OS disk,\n        hence this behavior offers limited value to AKS hosted while providing some drawbacks,\n        including slower node provisioning and higher read/write latency.\n\n        Ephemeral disks allow us also to have faster cluster operations like scale or upgrade\n        due to faster re-imaging and boot times.\n        \"\"\"\n        name = \"Ensure ephemeral disks are used for OS disks\"\n        id = \"CKV_AZURE_226\"\n        supported_resources = (\"azurerm_kubernetes_cluster\",)\n        categories = (CheckCategories.KUBERNETES,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self) -> str:\n        return \"default_node_pool/[0]/os_disk_type\"\n\n    def get_expected_value(self) -> Any:\n        return \"Ephemeral\"\n\n\ncheck = AKSEphemeralOSDisks()\n", "path": "checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py"}, {"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n\n\nclass AKSEncryptionAtHostEnabled(BaseResourceValueCheck):\n    def __init__(self) -> None:\n        \"\"\"\n        With host-based encryption, the data stored on the VM host of\n        your AKS agent nodes' VMs is encrypted at rest and flows encrypted to the Storage service.\n\n        This means the temp disks are encrypted at rest with platform-managed keys.\n        The cache of OS and data disks is encrypted at rest with either platform-managed keys\n        or customer-managed keys depending on the encryption type set on those disks.\n        \"\"\"\n        name = \"Ensure that the AKS cluster encrypt temp disks, caches, and data flows \"\n        name += \"between Compute and Storage resources\"\n        id = \"CKV_AZURE_227\"\n        supported_resources = (\"azurerm_kubernetes_cluster\", \"azurerm_kubernetes_cluster_node_pool\")\n        categories = (CheckCategories.KUBERNETES,)\n        super().__init__(\n            name=name,\n            id=id,\n            categories=categories,\n            supported_resources=supported_resources,\n            missing_block_result=CheckResult.FAILED,\n        )\n\n    def get_inspected_key(self) -> str:\n        if self.entity_type == \"azurerm_kubernetes_cluster\":\n            return \"default_node_pool/[0]/enable_host_encryption\"\n        else:\n            return \"enable_host_encryption\"\n\n\ncheck = AKSEncryptionAtHostEnabled()\n", "path": "checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py"}]}