prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  LaunchConfigurationEBSEncryption gives false-positives, due to not checking snapshot_id
  In the relevant `aws_launch_configuration` Terraform docs https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration
  
  ```
  encrypted - (Optional) Whether the volume should be encrypted or not. 
  Do not use this option if you are using snapshot_id as the encrypted flag will be determined by the snapshot.
  (Default: false).
  ```
  The relevant part is **Do not use this option if you are using snapshot_id as the encrypted flag will be determined by the snapshot.** `snapshot_id` is not taken into account in the current check:
  
  https://github.com/bridgecrewio/checkov/blob/d67ec380daf81b889e83d4d7c7d33f490525e899/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py#L16-L34
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py`
  Content:
  ```
  1 from checkov.common.models.enums import CheckResult, CheckCategories
  2 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
  3 
  4 
  5 class SecurityGroupRuleDescription(BaseResourceCheck):
  6     def __init__(self):
  7         name = "Ensure every security groups rule has a description"
  8         id = "CKV_AWS_23"
  9         supported_resource = ['aws_security_group', 'aws_security_group_rule', 'aws_db_security_group',
  10                               'aws_elasticache_security_group', 'aws_redshift_security_group']
  11         categories = [CheckCategories.NETWORKING]
  12         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource)
  13 
  14     def scan_resource_conf(self, conf):
  15         """
  16             Looks for description at security group  rules :
  17             https://www.terraform.io/docs/providers/aws/r/security_group.html
  18         :param conf: aws_security_group configuration
  19         :return: <CheckResult>
  20         """
  21         if 'description' in conf.keys():
  22             if conf['description']:
  23                 return CheckResult.PASSED
  24         egress_result = self.check_rule(rule_type='egress', conf=conf)
  25         ingress_result = self.check_rule(rule_type='ingress', conf=conf)
  26         if egress_result == CheckResult.PASSED and ingress_result == CheckResult.PASSED:
  27             return CheckResult.PASSED
  28         return CheckResult.FAILED
  29 
  30     def check_rule(self, rule_type, conf):
  31         if rule_type in conf.keys():
  32             for rule in conf[rule_type]:
  33                 if isinstance(rule, dict):
  34                     if 'description' not in rule.keys() or not rule['description']:
  35                         return CheckResult.FAILED
  36         return CheckResult.PASSED
  37 
  38 
  39 check = SecurityGroupRuleDescription()
  40
  ```
  
  Path: `checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py`
  Content:
  ```
  1 from checkov.common.models.enums import CheckResult, CheckCategories
  2 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
  3 
  4 
  5 class LaunchConfigurationEBSEncryption(BaseResourceValueCheck):
  6     def __init__(self):
  7         name = "Ensure all data stored in the Launch configuration EBS is securely encrypted"
  8         id = "CKV_AWS_8"
  9         supported_resources = ['aws_launch_configuration', 'aws_instance']
  10         categories = [CheckCategories.ENCRYPTION]
  11         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  12 
  13     def get_inspected_key(self):
  14         return "*_block_device/[0]/encrypted"
  15 
  16     def scan_resource_conf(self, conf):
  17         """
  18             Looks for encryption configuration at launch configuration:
  19             https://www.terraform.io/docs/providers/aws/r/launch_configuration.html or https://www.terraform.io/docs/providers/aws/d/instance.html
  20         :param conf: aws_launch_configuration configuration
  21         :return: <CheckResult>
  22         """
  23         have_root_block = 0
  24         for key in conf.keys():
  25             if "block_device" in key and "ephemeral" not in key:
  26                 if isinstance(conf[key][0], dict) and conf[key][0].get("encrypted") != [True]:
  27                     return CheckResult.FAILED
  28             if "root_block_device" in key:
  29                 # Issue 496 - TF will create unencrypted EBS root by default if whole root_block_device block is omitted.
  30                 have_root_block = 1
  31         if have_root_block == 0: 
  32             return CheckResult.FAILED
  33 
  34         return CheckResult.PASSED
  35 
  36 
  37 check = LaunchConfigurationEBSEncryption()
  38
  ```
  
  Path: `checkov/common/runners/runner_registry.py`
  Content:
  ```
  1 import json
  2 import logging
  3 from abc import abstractmethod
  4 
  5 
  6 class RunnerRegistry(object):
  7     runners = []
  8     scan_reports = []
  9     banner = ""
  10 
  11     def __init__(self, banner, runner_filter, *runners):
  12         self.logger = logging.getLogger(__name__)
  13         self.runner_filter = runner_filter
  14         self.runners = runners
  15         self.banner = banner
  16         self.filter_runner_framework()
  17         self.scan_reports = []
  18 
  19     @abstractmethod
  20     def extract_entity_details(self, entity):
  21         raise NotImplementedError()
  22 
  23     def run(self, root_folder=None, external_checks_dir=None, files=None, guidelines={}):
  24         for runner in self.runners:
  25             scan_report = runner.run(root_folder, external_checks_dir=external_checks_dir, files=files,
  26                                      runner_filter=self.runner_filter)
  27             RunnerRegistry.enrich_report_with_guidelines(scan_report, guidelines)
  28             self.scan_reports.append(scan_report)
  29         return self.scan_reports
  30 
  31     def print_reports(self, scan_reports, args):
  32         if args.output != "json" and args.output != "junitxml" and args.output != "github_failed_only":
  33             print(f"{self.banner}\n")
  34         exit_codes = []
  35         report_jsons = []
  36         for report in scan_reports:
  37             if not report.is_empty():
  38                 if args.output == "json":
  39                     report_jsons.append(report.get_dict())
  40                 elif args.output == "junitxml":
  41                     report.print_junit_xml()
  42                 elif args.output == 'github_failed_only':
  43                     report.print_failed_github_md()
  44                 else:
  45                     report.print_console(is_quiet=args.quiet)
  46             exit_codes.append(report.get_exit_code(args.soft_fail))
  47         if args.output == "json":
  48             if len(report_jsons) == 1:
  49                 print(json.dumps(report_jsons[0], indent=4))
  50             else:
  51                 print(json.dumps(report_jsons, indent=4))
  52         exit_code = 1 if 1 in exit_codes else 0
  53         exit(exit_code)
  54 
  55     def filter_runner_framework(self):
  56         if self.runner_filter.framework == 'all':
  57             return
  58         for runner in self.runners:
  59             if runner.check_type == self.runner_filter.framework:
  60                 self.runners = [runner]
  61                 return
  62 
  63     @staticmethod
  64     def enrich_report_with_guidelines(scan_report, guidelines):
  65         for record in scan_report.failed_checks + scan_report.passed_checks + scan_report.skipped_checks:
  66             if record.check_id in guidelines:
  67                 record.set_guideline(guidelines[record.check_id])
  68
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/common/runners/runner_registry.py b/checkov/common/runners/runner_registry.py
  --- a/checkov/common/runners/runner_registry.py
  +++ b/checkov/common/runners/runner_registry.py
  @@ -29,7 +29,11 @@
           return self.scan_reports
   
       def print_reports(self, scan_reports, args):
  -        if args.output != "json" and args.output != "junitxml" and args.output != "github_failed_only":
  +        if args.output not in (
  +            "github_failed_only",
  +            "json",
  +            "junitxml",
  +        ):
               print(f"{self.banner}\n")
           exit_codes = []
           report_jsons = []
  diff --git a/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py b/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py
  --- a/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py
  +++ b/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py
  @@ -20,15 +20,25 @@
           :param conf: aws_launch_configuration configuration
           :return: <CheckResult>
           """
  -        have_root_block = 0
           for key in conf.keys():
  -            if "block_device" in key and "ephemeral" not in key:
  -                if isinstance(conf[key][0], dict) and conf[key][0].get("encrypted") != [True]:
  +            if (
  +                "block_device" in key
  +                and
  +                "ephemeral" not in key
  +            ):
  +                if (
  +                    isinstance(conf[key][0], dict)
  +                    and
  +                    conf[key][0].get("encrypted") != [True]
  +                    and
  +                    # If present, the encrypted flag will be determined by the snapshot
  +                    # Note: checkov does not know if snapshot is encrypted, so we default to PASSED
  +                    not conf[key][0].get("snapshot_id")
  +                ):
                       return CheckResult.FAILED
  -            if "root_block_device" in key:
  -                # Issue 496 - TF will create unencrypted EBS root by default if whole root_block_device block is omitted.
  -                have_root_block = 1
  -        if have_root_block == 0: 
  +
  +        # Issue 496 - TF will create unencrypted EBS root by default if whole root_block_device block is omitted.
  +        if "root_block_device" not in conf.keys():
               return CheckResult.FAILED
   
           return CheckResult.PASSED
  diff --git a/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py b/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py
  --- a/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py
  +++ b/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py
  @@ -6,8 +6,13 @@
       def __init__(self):
           name = "Ensure every security groups rule has a description"
           id = "CKV_AWS_23"
  -        supported_resource = ['aws_security_group', 'aws_security_group_rule', 'aws_db_security_group',
  -                              'aws_elasticache_security_group', 'aws_redshift_security_group']
  +        supported_resource = [
  +            'aws_security_group',
  +            'aws_security_group_rule',
  +            'aws_db_security_group',
  +            'aws_elasticache_security_group',
  +            'aws_redshift_security_group',
  +        ]
           categories = [CheckCategories.NETWORKING]
           super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource)
  
verification_info: {"golden_diff": "diff --git a/checkov/common/runners/runner_registry.py b/checkov/common/runners/runner_registry.py\n--- a/checkov/common/runners/runner_registry.py\n+++ b/checkov/common/runners/runner_registry.py\n@@ -29,7 +29,11 @@\n         return self.scan_reports\n \n     def print_reports(self, scan_reports, args):\n-        if args.output != \"json\" and args.output != \"junitxml\" and args.output != \"github_failed_only\":\n+        if args.output not in (\n+            \"github_failed_only\",\n+            \"json\",\n+            \"junitxml\",\n+        ):\n             print(f\"{self.banner}\\n\")\n         exit_codes = []\n         report_jsons = []\ndiff --git a/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py b/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py\n--- a/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py\n+++ b/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py\n@@ -20,15 +20,25 @@\n         :param conf: aws_launch_configuration configuration\n         :return: <CheckResult>\n         \"\"\"\n-        have_root_block = 0\n         for key in conf.keys():\n-            if \"block_device\" in key and \"ephemeral\" not in key:\n-                if isinstance(conf[key][0], dict) and conf[key][0].get(\"encrypted\") != [True]:\n+            if (\n+                \"block_device\" in key\n+                and\n+                \"ephemeral\" not in key\n+            ):\n+                if (\n+                    isinstance(conf[key][0], dict)\n+                    and\n+                    conf[key][0].get(\"encrypted\") != [True]\n+                    and\n+                    # If present, the encrypted flag will be determined by the snapshot\n+                    # Note: checkov does not know if snapshot is encrypted, so we default to PASSED\n+                    not conf[key][0].get(\"snapshot_id\")\n+                ):\n                     return CheckResult.FAILED\n-            if \"root_block_device\" in key:\n-                # Issue 496 - TF will create unencrypted EBS root by default if whole root_block_device block is omitted.\n-                have_root_block = 1\n-        if have_root_block == 0: \n+\n+        # Issue 496 - TF will create unencrypted EBS root by default if whole root_block_device block is omitted.\n+        if \"root_block_device\" not in conf.keys():\n             return CheckResult.FAILED\n \n         return CheckResult.PASSED\ndiff --git a/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py b/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py\n--- a/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py\n+++ b/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py\n@@ -6,8 +6,13 @@\n     def __init__(self):\n         name = \"Ensure every security groups rule has a description\"\n         id = \"CKV_AWS_23\"\n-        supported_resource = ['aws_security_group', 'aws_security_group_rule', 'aws_db_security_group',\n-                              'aws_elasticache_security_group', 'aws_redshift_security_group']\n+        supported_resource = [\n+            'aws_security_group',\n+            'aws_security_group_rule',\n+            'aws_db_security_group',\n+            'aws_elasticache_security_group',\n+            'aws_redshift_security_group',\n+        ]\n         categories = [CheckCategories.NETWORKING]\n         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource)\n", "issue": "LaunchConfigurationEBSEncryption gives false-positives, due to not checking snapshot_id\nIn the relevant `aws_launch_configuration` Terraform docs https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration\r\n\r\n```\r\nencrypted - (Optional) Whether the volume should be encrypted or not. \r\nDo not use this option if you are using snapshot_id as the encrypted flag will be determined by the snapshot.\r\n(Default: false).\r\n```\r\nThe relevant part is **Do not use this option if you are using snapshot_id as the encrypted flag will be determined by the snapshot.** `snapshot_id` is not taken into account in the current check:\r\n\r\nhttps://github.com/bridgecrewio/checkov/blob/d67ec380daf81b889e83d4d7c7d33f490525e899/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py#L16-L34\n", "before_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass SecurityGroupRuleDescription(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure every security groups rule has a description\"\n        id = \"CKV_AWS_23\"\n        supported_resource = ['aws_security_group', 'aws_security_group_rule', 'aws_db_security_group',\n                              'aws_elasticache_security_group', 'aws_redshift_security_group']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for description at security group  rules :\n            https://www.terraform.io/docs/providers/aws/r/security_group.html\n        :param conf: aws_security_group configuration\n        :return: <CheckResult>\n        \"\"\"\n        if 'description' in conf.keys():\n            if conf['description']:\n                return CheckResult.PASSED\n        egress_result = self.check_rule(rule_type='egress', conf=conf)\n        ingress_result = self.check_rule(rule_type='ingress', conf=conf)\n        if egress_result == CheckResult.PASSED and ingress_result == CheckResult.PASSED:\n            return CheckResult.PASSED\n        return CheckResult.FAILED\n\n    def check_rule(self, rule_type, conf):\n        if rule_type in conf.keys():\n            for rule in conf[rule_type]:\n                if isinstance(rule, dict):\n                    if 'description' not in rule.keys() or not rule['description']:\n                        return CheckResult.FAILED\n        return CheckResult.PASSED\n\n\ncheck = SecurityGroupRuleDescription()\n", "path": "checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py"}, {"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n\n\nclass LaunchConfigurationEBSEncryption(BaseResourceValueCheck):\n    def __init__(self):\n        name = \"Ensure all data stored in the Launch configuration EBS is securely encrypted\"\n        id = \"CKV_AWS_8\"\n        supported_resources = ['aws_launch_configuration', 'aws_instance']\n        categories = [CheckCategories.ENCRYPTION]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self):\n        return \"*_block_device/[0]/encrypted\"\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for encryption configuration at launch configuration:\n            https://www.terraform.io/docs/providers/aws/r/launch_configuration.html or https://www.terraform.io/docs/providers/aws/d/instance.html\n        :param conf: aws_launch_configuration configuration\n        :return: <CheckResult>\n        \"\"\"\n        have_root_block = 0\n        for key in conf.keys():\n            if \"block_device\" in key and \"ephemeral\" not in key:\n                if isinstance(conf[key][0], dict) and conf[key][0].get(\"encrypted\") != [True]:\n                    return CheckResult.FAILED\n            if \"root_block_device\" in key:\n                # Issue 496 - TF will create unencrypted EBS root by default if whole root_block_device block is omitted.\n                have_root_block = 1\n        if have_root_block == 0: \n            return CheckResult.FAILED\n\n        return CheckResult.PASSED\n\n\ncheck = LaunchConfigurationEBSEncryption()\n", "path": "checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py"}, {"content": "import json\nimport logging\nfrom abc import abstractmethod\n\n\nclass RunnerRegistry(object):\n    runners = []\n    scan_reports = []\n    banner = \"\"\n\n    def __init__(self, banner, runner_filter, *runners):\n        self.logger = logging.getLogger(__name__)\n        self.runner_filter = runner_filter\n        self.runners = runners\n        self.banner = banner\n        self.filter_runner_framework()\n        self.scan_reports = []\n\n    @abstractmethod\n    def extract_entity_details(self, entity):\n        raise NotImplementedError()\n\n    def run(self, root_folder=None, external_checks_dir=None, files=None, guidelines={}):\n        for runner in self.runners:\n            scan_report = runner.run(root_folder, external_checks_dir=external_checks_dir, files=files,\n                                     runner_filter=self.runner_filter)\n            RunnerRegistry.enrich_report_with_guidelines(scan_report, guidelines)\n            self.scan_reports.append(scan_report)\n        return self.scan_reports\n\n    def print_reports(self, scan_reports, args):\n        if args.output != \"json\" and args.output != \"junitxml\" and args.output != \"github_failed_only\":\n            print(f\"{self.banner}\\n\")\n        exit_codes = []\n        report_jsons = []\n        for report in scan_reports:\n            if not report.is_empty():\n                if args.output == \"json\":\n                    report_jsons.append(report.get_dict())\n                elif args.output == \"junitxml\":\n                    report.print_junit_xml()\n                elif args.output == 'github_failed_only':\n                    report.print_failed_github_md()\n                else:\n                    report.print_console(is_quiet=args.quiet)\n            exit_codes.append(report.get_exit_code(args.soft_fail))\n        if args.output == \"json\":\n            if len(report_jsons) == 1:\n                print(json.dumps(report_jsons[0], indent=4))\n            else:\n                print(json.dumps(report_jsons, indent=4))\n        exit_code = 1 if 1 in exit_codes else 0\n        exit(exit_code)\n\n    def filter_runner_framework(self):\n        if self.runner_filter.framework == 'all':\n            return\n        for runner in self.runners:\n            if runner.check_type == self.runner_filter.framework:\n                self.runners = [runner]\n                return\n\n    @staticmethod\n    def enrich_report_with_guidelines(scan_report, guidelines):\n        for record in scan_report.failed_checks + scan_report.passed_checks + scan_report.skipped_checks:\n            if record.check_id in guidelines:\n                record.set_guideline(guidelines[record.check_id])\n", "path": "checkov/common/runners/runner_registry.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass SecurityGroupRuleDescription(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure every security groups rule has a description\"\n        id = \"CKV_AWS_23\"\n        supported_resource = [\n            'aws_security_group',\n            'aws_security_group_rule',\n            'aws_db_security_group',\n            'aws_elasticache_security_group',\n            'aws_redshift_security_group',\n        ]\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for description at security group  rules :\n            https://www.terraform.io/docs/providers/aws/r/security_group.html\n        :param conf: aws_security_group configuration\n        :return: <CheckResult>\n        \"\"\"\n        if 'description' in conf.keys():\n            if conf['description']:\n                return CheckResult.PASSED\n        egress_result = self.check_rule(rule_type='egress', conf=conf)\n        ingress_result = self.check_rule(rule_type='ingress', conf=conf)\n        if egress_result == CheckResult.PASSED and ingress_result == CheckResult.PASSED:\n            return CheckResult.PASSED\n        return CheckResult.FAILED\n\n    def check_rule(self, rule_type, conf):\n        if rule_type in conf.keys():\n            for rule in conf[rule_type]:\n                if isinstance(rule, dict):\n                    if 'description' not in rule.keys() or not rule['description']:\n                        return CheckResult.FAILED\n        return CheckResult.PASSED\n\n\ncheck = SecurityGroupRuleDescription()\n", "path": "checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py"}, {"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n\n\nclass LaunchConfigurationEBSEncryption(BaseResourceValueCheck):\n    def __init__(self):\n        name = \"Ensure all data stored in the Launch configuration EBS is securely encrypted\"\n        id = \"CKV_AWS_8\"\n        supported_resources = ['aws_launch_configuration', 'aws_instance']\n        categories = [CheckCategories.ENCRYPTION]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self):\n        return \"*_block_device/[0]/encrypted\"\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for encryption configuration at launch configuration:\n            https://www.terraform.io/docs/providers/aws/r/launch_configuration.html or https://www.terraform.io/docs/providers/aws/d/instance.html\n        :param conf: aws_launch_configuration configuration\n        :return: <CheckResult>\n        \"\"\"\n        for key in conf.keys():\n            if (\n                \"block_device\" in key\n                and\n                \"ephemeral\" not in key\n            ):\n                if (\n                    isinstance(conf[key][0], dict)\n                    and\n                    conf[key][0].get(\"encrypted\") != [True]\n                    and\n                    # If present, the encrypted flag will be determined by the snapshot\n                    # Note: checkov does not know if snapshot is encrypted, so we default to PASSED\n                    not conf[key][0].get(\"snapshot_id\")\n                ):\n                    return CheckResult.FAILED\n\n        # Issue 496 - TF will create unencrypted EBS root by default if whole root_block_device block is omitted.\n        if \"root_block_device\" not in conf.keys():\n            return CheckResult.FAILED\n\n        return CheckResult.PASSED\n\n\ncheck = LaunchConfigurationEBSEncryption()\n", "path": "checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py"}, {"content": "import json\nimport logging\nfrom abc import abstractmethod\n\n\nclass RunnerRegistry(object):\n    runners = []\n    scan_reports = []\n    banner = \"\"\n\n    def __init__(self, banner, runner_filter, *runners):\n        self.logger = logging.getLogger(__name__)\n        self.runner_filter = runner_filter\n        self.runners = runners\n        self.banner = banner\n        self.filter_runner_framework()\n        self.scan_reports = []\n\n    @abstractmethod\n    def extract_entity_details(self, entity):\n        raise NotImplementedError()\n\n    def run(self, root_folder=None, external_checks_dir=None, files=None, guidelines={}):\n        for runner in self.runners:\n            scan_report = runner.run(root_folder, external_checks_dir=external_checks_dir, files=files,\n                                     runner_filter=self.runner_filter)\n            RunnerRegistry.enrich_report_with_guidelines(scan_report, guidelines)\n            self.scan_reports.append(scan_report)\n        return self.scan_reports\n\n    def print_reports(self, scan_reports, args):\n        if args.output not in (\n            \"github_failed_only\",\n            \"json\",\n            \"junitxml\",\n        ):\n            print(f\"{self.banner}\\n\")\n        exit_codes = []\n        report_jsons = []\n        for report in scan_reports:\n            if not report.is_empty():\n                if args.output == \"json\":\n                    report_jsons.append(report.get_dict())\n                elif args.output == \"junitxml\":\n                    report.print_junit_xml()\n                elif args.output == 'github_failed_only':\n                    report.print_failed_github_md()\n                else:\n                    report.print_console(is_quiet=args.quiet)\n            exit_codes.append(report.get_exit_code(args.soft_fail))\n        if args.output == \"json\":\n            if len(report_jsons) == 1:\n                print(json.dumps(report_jsons[0], indent=4))\n            else:\n                print(json.dumps(report_jsons, indent=4))\n        exit_code = 1 if 1 in exit_codes else 0\n        exit(exit_code)\n\n    def filter_runner_framework(self):\n        if self.runner_filter.framework == 'all':\n            return\n        for runner in self.runners:\n            if runner.check_type == self.runner_filter.framework:\n                self.runners = [runner]\n                return\n\n    @staticmethod\n    def enrich_report_with_guidelines(scan_report, guidelines):\n        for record in scan_report.failed_checks + scan_report.passed_checks + scan_report.skipped_checks:\n            if record.check_id in guidelines:\n                record.set_guideline(guidelines[record.check_id])\n", "path": "checkov/common/runners/runner_registry.py"}]}