prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  AWS_CKV_7 False Positive on assymetric key check in Cloudformation
  **Describe the issue**
  In terraform, the check avoids false positives with an extra check against symmetric keys before checking whether rotation is enabled.  This same check hasn't been configured for cloudformation:
  
  ```
  def scan_resource_conf(self, conf):
          # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.
          spec = conf.get('customer_master_key_spec')
          if not spec or 'SYMMETRIC_DEFAULT' in spec:
              return super().scan_resource_conf(conf)
          else:
              return CheckResult.PASSED
  ```
  
  **Examples**
  
  ```
  RSASigningKey:
    Type: 'AWS::KMS::Key'
    Properties:
      Description: RSA-3072 asymmetric KMS key for signing and verification
      KeySpec: RSA_3072
      KeyUsage: SIGN_VERIFY
      KeyPolicy:
        Version: 2012-10-17
        Id: key-default-1
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS: 'arn:aws:iam::111122223333:root'
            Action: 'kms:*'
            Resource: '*'
          - Sid: Allow administration of the key
            Effect: Allow
            Principal:
              AWS: 'arn:aws:iam::111122223333:role/Admin'
            Action:
              - 'kms:Create*'
              - 'kms:Describe*'
              - 'kms:Enable*'
              - 'kms:List*'
              - 'kms:Put*'
              - 'kms:Update*'
              - 'kms:Revoke*'
              - 'kms:Disable*'
              - 'kms:Get*'
              - 'kms:Delete*'
              - 'kms:ScheduleKeyDeletion'
              - 'kms:CancelKeyDeletion'
            Resource: '*'
          - Sid: Allow use of the key
            Effect: Allow
            Principal:
              AWS: 'arn:aws:iam::111122223333:role/Developer'
            Action:
              - 'kms:Sign'
              - 'kms:Verify'
              - 'kms:DescribeKey'
            Resource: '*'
  ```
  
  **Version (please complete the following information):**
   - Checkov Version [e.g. 2.3.0]
  
  **Additional context**
  
  This blocks checkov working for assymetric keys in CFN.
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/cloudformation/checks/resource/aws/KMSRotation.py`
  Content:
  ```
  1 from checkov.common.models.enums import CheckCategories
  2 from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck
  3 
  4 
  5 class KMSRotation(BaseResourceValueCheck):
  6     def __init__(self) -> None:
  7         name = "Ensure rotation for customer created CMKs is enabled"
  8         id = "CKV_AWS_7"
  9         supported_resources = ("AWS::KMS::Key",)
  10         categories = (CheckCategories.ENCRYPTION,)
  11         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  12 
  13     def get_inspected_key(self) -> str:
  14         return "Properties/EnableKeyRotation"
  15 
  16 
  17 check = KMSRotation()
  18
  ```
  
  Path: `checkov/terraform/checks/resource/aws/KMSRotation.py`
  Content:
  ```
  1 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
  2 from checkov.common.models.enums import CheckCategories, CheckResult
  3 
  4 
  5 class KMSRotation(BaseResourceValueCheck):
  6     def __init__(self):
  7         name = "Ensure rotation for customer created CMKs is enabled"
  8         id = "CKV_AWS_7"
  9         supported_resources = ['aws_kms_key']
  10         categories = [CheckCategories.ENCRYPTION]
  11         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  12 
  13     def get_inspected_key(self):
  14         return "enable_key_rotation"
  15 
  16     def scan_resource_conf(self, conf):
  17         # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.
  18         spec = conf.get('customer_master_key_spec')
  19         if not spec or 'SYMMETRIC_DEFAULT' in spec:
  20             return super().scan_resource_conf(conf)
  21         else:
  22             return CheckResult.PASSED
  23 
  24 
  25 check = KMSRotation()
  26
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/cloudformation/checks/resource/aws/KMSRotation.py b/checkov/cloudformation/checks/resource/aws/KMSRotation.py
  --- a/checkov/cloudformation/checks/resource/aws/KMSRotation.py
  +++ b/checkov/cloudformation/checks/resource/aws/KMSRotation.py
  @@ -1,4 +1,4 @@
  -from checkov.common.models.enums import CheckCategories
  +from checkov.common.models.enums import CheckCategories, CheckResult
   from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck
   
   
  @@ -13,5 +13,15 @@
       def get_inspected_key(self) -> str:
           return "Properties/EnableKeyRotation"
   
  +    def scan_resource_conf(self, conf):
  +        # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.
  +        properties = conf.get("Properties")
  +        if properties and isinstance(properties, dict):
  +            spec = properties.get("KeySpec")
  +            if spec and isinstance(spec, str):
  +                if 'SYMMETRIC_DEFAULT' not in spec and 'HMAC' not in spec:
  +                    return CheckResult.UNKNOWN
  +        return super().scan_resource_conf(conf)
  +
   
   check = KMSRotation()
  diff --git a/checkov/terraform/checks/resource/aws/KMSRotation.py b/checkov/terraform/checks/resource/aws/KMSRotation.py
  --- a/checkov/terraform/checks/resource/aws/KMSRotation.py
  +++ b/checkov/terraform/checks/resource/aws/KMSRotation.py
  @@ -16,10 +16,10 @@
       def scan_resource_conf(self, conf):
           # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.
           spec = conf.get('customer_master_key_spec')
  -        if not spec or 'SYMMETRIC_DEFAULT' in spec:
  +        if not spec or 'SYMMETRIC_DEFAULT' in spec or 'HMAC' in spec:
               return super().scan_resource_conf(conf)
           else:
  -            return CheckResult.PASSED
  +            return CheckResult.UNKNOWN
   
   
   check = KMSRotation()
  
verification_info: {"golden_diff": "diff --git a/checkov/cloudformation/checks/resource/aws/KMSRotation.py b/checkov/cloudformation/checks/resource/aws/KMSRotation.py\n--- a/checkov/cloudformation/checks/resource/aws/KMSRotation.py\n+++ b/checkov/cloudformation/checks/resource/aws/KMSRotation.py\n@@ -1,4 +1,4 @@\n-from checkov.common.models.enums import CheckCategories\n+from checkov.common.models.enums import CheckCategories, CheckResult\n from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck\n \n \n@@ -13,5 +13,15 @@\n     def get_inspected_key(self) -> str:\n         return \"Properties/EnableKeyRotation\"\n \n+    def scan_resource_conf(self, conf):\n+        # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.\n+        properties = conf.get(\"Properties\")\n+        if properties and isinstance(properties, dict):\n+            spec = properties.get(\"KeySpec\")\n+            if spec and isinstance(spec, str):\n+                if 'SYMMETRIC_DEFAULT' not in spec and 'HMAC' not in spec:\n+                    return CheckResult.UNKNOWN\n+        return super().scan_resource_conf(conf)\n+\n \n check = KMSRotation()\ndiff --git a/checkov/terraform/checks/resource/aws/KMSRotation.py b/checkov/terraform/checks/resource/aws/KMSRotation.py\n--- a/checkov/terraform/checks/resource/aws/KMSRotation.py\n+++ b/checkov/terraform/checks/resource/aws/KMSRotation.py\n@@ -16,10 +16,10 @@\n     def scan_resource_conf(self, conf):\n         # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.\n         spec = conf.get('customer_master_key_spec')\n-        if not spec or 'SYMMETRIC_DEFAULT' in spec:\n+        if not spec or 'SYMMETRIC_DEFAULT' in spec or 'HMAC' in spec:\n             return super().scan_resource_conf(conf)\n         else:\n-            return CheckResult.PASSED\n+            return CheckResult.UNKNOWN\n \n \n check = KMSRotation()\n", "issue": "AWS_CKV_7 False Positive on assymetric key check in Cloudformation\n**Describe the issue**\r\nIn terraform, the check avoids false positives with an extra check against symmetric keys before checking whether rotation is enabled.  This same check hasn't been configured for cloudformation:\r\n\r\n```\r\ndef scan_resource_conf(self, conf):\r\n        # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.\r\n        spec = conf.get('customer_master_key_spec')\r\n        if not spec or 'SYMMETRIC_DEFAULT' in spec:\r\n            return super().scan_resource_conf(conf)\r\n        else:\r\n            return CheckResult.PASSED\r\n```\r\n\r\n**Examples**\r\n\r\n```\r\nRSASigningKey:\r\n  Type: 'AWS::KMS::Key'\r\n  Properties:\r\n    Description: RSA-3072 asymmetric KMS key for signing and verification\r\n    KeySpec: RSA_3072\r\n    KeyUsage: SIGN_VERIFY\r\n    KeyPolicy:\r\n      Version: 2012-10-17\r\n      Id: key-default-1\r\n      Statement:\r\n        - Sid: Enable IAM User Permissions\r\n          Effect: Allow\r\n          Principal:\r\n            AWS: 'arn:aws:iam::111122223333:root'\r\n          Action: 'kms:*'\r\n          Resource: '*'\r\n        - Sid: Allow administration of the key\r\n          Effect: Allow\r\n          Principal:\r\n            AWS: 'arn:aws:iam::111122223333:role/Admin'\r\n          Action:\r\n            - 'kms:Create*'\r\n            - 'kms:Describe*'\r\n            - 'kms:Enable*'\r\n            - 'kms:List*'\r\n            - 'kms:Put*'\r\n            - 'kms:Update*'\r\n            - 'kms:Revoke*'\r\n            - 'kms:Disable*'\r\n            - 'kms:Get*'\r\n            - 'kms:Delete*'\r\n            - 'kms:ScheduleKeyDeletion'\r\n            - 'kms:CancelKeyDeletion'\r\n          Resource: '*'\r\n        - Sid: Allow use of the key\r\n          Effect: Allow\r\n          Principal:\r\n            AWS: 'arn:aws:iam::111122223333:role/Developer'\r\n          Action:\r\n            - 'kms:Sign'\r\n            - 'kms:Verify'\r\n            - 'kms:DescribeKey'\r\n          Resource: '*'\r\n```\r\n\r\n**Version (please complete the following information):**\r\n - Checkov Version [e.g. 2.3.0]\r\n\r\n**Additional context**\r\n\r\nThis blocks checkov working for assymetric keys in CFN.\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckCategories\nfrom checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck\n\n\nclass KMSRotation(BaseResourceValueCheck):\n    def __init__(self) -> None:\n        name = \"Ensure rotation for customer created CMKs is enabled\"\n        id = \"CKV_AWS_7\"\n        supported_resources = (\"AWS::KMS::Key\",)\n        categories = (CheckCategories.ENCRYPTION,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self) -> str:\n        return \"Properties/EnableKeyRotation\"\n\n\ncheck = KMSRotation()\n", "path": "checkov/cloudformation/checks/resource/aws/KMSRotation.py"}, {"content": "from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\nfrom checkov.common.models.enums import CheckCategories, CheckResult\n\n\nclass KMSRotation(BaseResourceValueCheck):\n    def __init__(self):\n        name = \"Ensure rotation for customer created CMKs is enabled\"\n        id = \"CKV_AWS_7\"\n        supported_resources = ['aws_kms_key']\n        categories = [CheckCategories.ENCRYPTION]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self):\n        return \"enable_key_rotation\"\n\n    def scan_resource_conf(self, conf):\n        # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.\n        spec = conf.get('customer_master_key_spec')\n        if not spec or 'SYMMETRIC_DEFAULT' in spec:\n            return super().scan_resource_conf(conf)\n        else:\n            return CheckResult.PASSED\n\n\ncheck = KMSRotation()\n", "path": "checkov/terraform/checks/resource/aws/KMSRotation.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck\n\n\nclass KMSRotation(BaseResourceValueCheck):\n    def __init__(self) -> None:\n        name = \"Ensure rotation for customer created CMKs is enabled\"\n        id = \"CKV_AWS_7\"\n        supported_resources = (\"AWS::KMS::Key\",)\n        categories = (CheckCategories.ENCRYPTION,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self) -> str:\n        return \"Properties/EnableKeyRotation\"\n\n    def scan_resource_conf(self, conf):\n        # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.\n        properties = conf.get(\"Properties\")\n        if properties and isinstance(properties, dict):\n            spec = properties.get(\"KeySpec\")\n            if spec and isinstance(spec, str):\n                if 'SYMMETRIC_DEFAULT' not in spec and 'HMAC' not in spec:\n                    return CheckResult.UNKNOWN\n        return super().scan_resource_conf(conf)\n\n\ncheck = KMSRotation()\n", "path": "checkov/cloudformation/checks/resource/aws/KMSRotation.py"}, {"content": "from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\nfrom checkov.common.models.enums import CheckCategories, CheckResult\n\n\nclass KMSRotation(BaseResourceValueCheck):\n    def __init__(self):\n        name = \"Ensure rotation for customer created CMKs is enabled\"\n        id = \"CKV_AWS_7\"\n        supported_resources = ['aws_kms_key']\n        categories = [CheckCategories.ENCRYPTION]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self):\n        return \"enable_key_rotation\"\n\n    def scan_resource_conf(self, conf):\n        # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.\n        spec = conf.get('customer_master_key_spec')\n        if not spec or 'SYMMETRIC_DEFAULT' in spec or 'HMAC' in spec:\n            return super().scan_resource_conf(conf)\n        else:\n            return CheckResult.UNKNOWN\n\n\ncheck = KMSRotation()\n", "path": "checkov/terraform/checks/resource/aws/KMSRotation.py"}]}