prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  CKV_AWS_144 false negative after updating to AWS Provider 4.0 
  **Describe the issue**
  After updating our AWS Provider to ~>4.0, we started getting a failure on `CKV_AWS_144` in our bucket module, despite having a properly configured `aws_s3_bucket_lifecycle_configuration` block.
  
  **Examples**
  Sample code:
  
  ```hcl
  provider "aws" {
    alias  = "aws-primary"
    region = "us-east-1"
  }
  
  provider "aws" {
    alias  = "aws-dr"
    region = "us-west-2"
  }
  
  resource "aws_s3_bucket" "test_bucket" {
    bucket = var.bucket_name
  }
  
  resource "aws_s3_bucket" "test_dr_bucket" {
    provider = aws.aws-dr
    bucket   = "${var.bucket_name}-dr"
  }
  
  resource "aws_s3_bucket_versioning" "test_bucket_versioning" {
    bucket = aws_s3_bucket.test_bucket.id
    versioning_configuration {
      status = "Enabled"
    }
  }
  
  resource "aws_s3_bucket_versioning" "test_dr_bucket_versioning" {
    provider = aws.aws-dr
    bucket = aws_s3_bucket.test_dr_bucket.id
    versioning_configuration {
      status = "Enabled"
    }
  }
  
  resource "aws_iam_role" "dr_replication" {
    name_prefix = "replication"
    description = "Allow S3 to assume the role for replication"
  
    assume_role_policy = <<POLICY
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "s3ReplicationAssume",
        "Effect": "Allow",
        "Principal": {
          "Service": "s3.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }
  POLICY
  }
  
  resource "aws_iam_policy" "dr_replication" {
    name_prefix = "replication"
    description = "Allows reading for replication."
  
    policy = <<POLICY
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": [
          "s3:GetReplicationConfiguration",
          "s3:ListBucket"
        ],
        "Effect": "Allow",
        "Resource": [
          "${aws_s3_bucket.test_bucket.arn}"
        ]
      },
      {
        "Action": [
          "s3:GetObjectVersion",
          "s3:GetObjectVersionForReplication",
          "s3:GetObjectVersionAcl"
        ],
        "Effect": "Allow",
        "Resource": [
          "${aws_s3_bucket.test_bucket.arn}/*"
        ]
      },
      {
        "Action": [
          "s3:ReplicateObject",
          "s3:ReplicateTags",
          "s3:ObjectOwnerOverrideToBucketOwner"
        ],
        "Effect": "Allow",
        "Resource": "${aws_s3_bucket.test_dr_bucket.arn}/*"
      }
    ]
  }
  POLICY
  }
  
  resource "aws_iam_policy_attachment" "dr_replication" {
    name       = "replication"
    roles      = [aws_iam_role.dr_replication.name]
    policy_arn = aws_iam_policy.dr_replication.arn
  }
  
  resource "aws_s3_bucket_replication_configuration" "dr_bucket_replication" {
  
    # Must have bucket versioning enabled first
    depends_on = [
      aws_s3_bucket_versioning.test_bucket_versioning,
      aws_s3_bucket_versioning.test_dr_bucket_versioning,
    ]
  
    role   = aws_iam_role.dr_replication.arn
    bucket = aws_s3_bucket.test_bucket.id
  
    rule {
      id     = "entire_bucket"
      status = "Enabled"
  
      destination {
        bucket        = aws_s3_bucket.test_dr_bucket.arn
        storage_class = "DEEP_ARCHIVE"
      }
    }
  }
  
  ```
  
  Expected: `CKV_AWS_144` will pass.
  
  Actual: 
  ```
  Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled"
          FAILED for resource: aws_s3_bucket.test_bucket
          File: /dr_test.tf:11-13
          Guide: https://docs.bridgecrew.io/docs/ensure-that-s3-bucket-has-cross-region-replication-enabled
  
                  11 | resource "aws_s3_bucket" "test_bucket" {
                  12 |   bucket = var.bucket_name
                  13 | }
  ```
  
  **Desktop (please complete the following information):**
   - OS: MacOS 10.14.6
   - Checkov Version 2.0.1074
  
  **Additional context**
  On the surface, this looks like related to  https://github.com/bridgecrewio/checkov/issues/2399 and https://github.com/bridgecrewio/checkov/pull/2724, but to the `CKV_AWS_144` rule.
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/terraform/checks/resource/aws/S3BucketReplicationConfiguration.py`
  Content:
  ```
  1 from checkov.common.models.consts import ANY_VALUE
  2 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
  3 from checkov.common.models.enums import CheckCategories
  4 
  5 
  6 class S3BucketReplicationConfiguration(BaseResourceValueCheck):
  7     def __init__(self):
  8         name = "Ensure that S3 bucket has cross-region replication enabled"
  9         id = "CKV_AWS_144"
  10         supported_resources = ['aws_s3_bucket']
  11         categories = [CheckCategories.GENERAL_SECURITY]
  12         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  13 
  14     def get_inspected_key(self):
  15         return "replication_configuration/[0]/role"
  16 
  17     def get_expected_value(self):
  18         return ANY_VALUE
  19 
  20 
  21 check = S3BucketReplicationConfiguration()
  22
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/terraform/checks/resource/aws/S3BucketReplicationConfiguration.py b/checkov/terraform/checks/resource/aws/S3BucketReplicationConfiguration.py
  deleted file mode 100644
  --- a/checkov/terraform/checks/resource/aws/S3BucketReplicationConfiguration.py
  +++ /dev/null
  @@ -1,21 +0,0 @@
  -from checkov.common.models.consts import ANY_VALUE
  -from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
  -from checkov.common.models.enums import CheckCategories
  -
  -
  -class S3BucketReplicationConfiguration(BaseResourceValueCheck):
  -    def __init__(self):
  -        name = "Ensure that S3 bucket has cross-region replication enabled"
  -        id = "CKV_AWS_144"
  -        supported_resources = ['aws_s3_bucket']
  -        categories = [CheckCategories.GENERAL_SECURITY]
  -        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  -
  -    def get_inspected_key(self):
  -        return "replication_configuration/[0]/role"
  -
  -    def get_expected_value(self):
  -        return ANY_VALUE
  -
  -
  -check = S3BucketReplicationConfiguration()
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/S3BucketReplicationConfiguration.py b/checkov/terraform/checks/resource/aws/S3BucketReplicationConfiguration.py\ndeleted file mode 100644\n--- a/checkov/terraform/checks/resource/aws/S3BucketReplicationConfiguration.py\n+++ /dev/null\n@@ -1,21 +0,0 @@\n-from checkov.common.models.consts import ANY_VALUE\n-from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n-from checkov.common.models.enums import CheckCategories\n-\n-\n-class S3BucketReplicationConfiguration(BaseResourceValueCheck):\n-    def __init__(self):\n-        name = \"Ensure that S3 bucket has cross-region replication enabled\"\n-        id = \"CKV_AWS_144\"\n-        supported_resources = ['aws_s3_bucket']\n-        categories = [CheckCategories.GENERAL_SECURITY]\n-        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n-\n-    def get_inspected_key(self):\n-        return \"replication_configuration/[0]/role\"\n-\n-    def get_expected_value(self):\n-        return ANY_VALUE\n-\n-\n-check = S3BucketReplicationConfiguration()\n", "issue": "CKV_AWS_144 false negative after updating to AWS Provider 4.0 \n**Describe the issue**\r\nAfter updating our AWS Provider to ~>4.0, we started getting a failure on `CKV_AWS_144` in our bucket module, despite having a properly configured `aws_s3_bucket_lifecycle_configuration` block.\r\n\r\n**Examples**\r\nSample code:\r\n\r\n```hcl\r\nprovider \"aws\" {\r\n  alias  = \"aws-primary\"\r\n  region = \"us-east-1\"\r\n}\r\n\r\nprovider \"aws\" {\r\n  alias  = \"aws-dr\"\r\n  region = \"us-west-2\"\r\n}\r\n\r\nresource \"aws_s3_bucket\" \"test_bucket\" {\r\n  bucket = var.bucket_name\r\n}\r\n\r\nresource \"aws_s3_bucket\" \"test_dr_bucket\" {\r\n  provider = aws.aws-dr\r\n  bucket   = \"${var.bucket_name}-dr\"\r\n}\r\n\r\nresource \"aws_s3_bucket_versioning\" \"test_bucket_versioning\" {\r\n  bucket = aws_s3_bucket.test_bucket.id\r\n  versioning_configuration {\r\n    status = \"Enabled\"\r\n  }\r\n}\r\n\r\nresource \"aws_s3_bucket_versioning\" \"test_dr_bucket_versioning\" {\r\n  provider = aws.aws-dr\r\n  bucket = aws_s3_bucket.test_dr_bucket.id\r\n  versioning_configuration {\r\n    status = \"Enabled\"\r\n  }\r\n}\r\n\r\nresource \"aws_iam_role\" \"dr_replication\" {\r\n  name_prefix = \"replication\"\r\n  description = \"Allow S3 to assume the role for replication\"\r\n\r\n  assume_role_policy = <<POLICY\r\n{\r\n  \"Version\": \"2012-10-17\",\r\n  \"Statement\": [\r\n    {\r\n      \"Sid\": \"s3ReplicationAssume\",\r\n      \"Effect\": \"Allow\",\r\n      \"Principal\": {\r\n        \"Service\": \"s3.amazonaws.com\"\r\n      },\r\n      \"Action\": \"sts:AssumeRole\"\r\n    }\r\n  ]\r\n}\r\nPOLICY\r\n}\r\n\r\nresource \"aws_iam_policy\" \"dr_replication\" {\r\n  name_prefix = \"replication\"\r\n  description = \"Allows reading for replication.\"\r\n\r\n  policy = <<POLICY\r\n{\r\n  \"Version\": \"2012-10-17\",\r\n  \"Statement\": [\r\n    {\r\n      \"Action\": [\r\n        \"s3:GetReplicationConfiguration\",\r\n        \"s3:ListBucket\"\r\n      ],\r\n      \"Effect\": \"Allow\",\r\n      \"Resource\": [\r\n        \"${aws_s3_bucket.test_bucket.arn}\"\r\n      ]\r\n    },\r\n    {\r\n      \"Action\": [\r\n        \"s3:GetObjectVersion\",\r\n        \"s3:GetObjectVersionForReplication\",\r\n        \"s3:GetObjectVersionAcl\"\r\n      ],\r\n      \"Effect\": \"Allow\",\r\n      \"Resource\": [\r\n        \"${aws_s3_bucket.test_bucket.arn}/*\"\r\n      ]\r\n    },\r\n    {\r\n      \"Action\": [\r\n        \"s3:ReplicateObject\",\r\n        \"s3:ReplicateTags\",\r\n        \"s3:ObjectOwnerOverrideToBucketOwner\"\r\n      ],\r\n      \"Effect\": \"Allow\",\r\n      \"Resource\": \"${aws_s3_bucket.test_dr_bucket.arn}/*\"\r\n    }\r\n  ]\r\n}\r\nPOLICY\r\n}\r\n\r\nresource \"aws_iam_policy_attachment\" \"dr_replication\" {\r\n  name       = \"replication\"\r\n  roles      = [aws_iam_role.dr_replication.name]\r\n  policy_arn = aws_iam_policy.dr_replication.arn\r\n}\r\n\r\nresource \"aws_s3_bucket_replication_configuration\" \"dr_bucket_replication\" {\r\n\r\n  # Must have bucket versioning enabled first\r\n  depends_on = [\r\n    aws_s3_bucket_versioning.test_bucket_versioning,\r\n    aws_s3_bucket_versioning.test_dr_bucket_versioning,\r\n  ]\r\n\r\n  role   = aws_iam_role.dr_replication.arn\r\n  bucket = aws_s3_bucket.test_bucket.id\r\n\r\n  rule {\r\n    id     = \"entire_bucket\"\r\n    status = \"Enabled\"\r\n\r\n    destination {\r\n      bucket        = aws_s3_bucket.test_dr_bucket.arn\r\n      storage_class = \"DEEP_ARCHIVE\"\r\n    }\r\n  }\r\n}\r\n\r\n```\r\n\r\nExpected: `CKV_AWS_144` will pass.\r\n\r\nActual: \r\n```\r\nCheck: CKV_AWS_144: \"Ensure that S3 bucket has cross-region replication enabled\"\r\n        FAILED for resource: aws_s3_bucket.test_bucket\r\n        File: /dr_test.tf:11-13\r\n        Guide: https://docs.bridgecrew.io/docs/ensure-that-s3-bucket-has-cross-region-replication-enabled\r\n\r\n                11 | resource \"aws_s3_bucket\" \"test_bucket\" {\r\n                12 |   bucket = var.bucket_name\r\n                13 | }\r\n```\r\n\r\n**Desktop (please complete the following information):**\r\n - OS: MacOS 10.14.6\r\n - Checkov Version 2.0.1074\r\n\r\n**Additional context**\r\nOn the surface, this looks like related to  https://github.com/bridgecrewio/checkov/issues/2399 and https://github.com/bridgecrewio/checkov/pull/2724, but to the `CKV_AWS_144` rule.\n", "before_files": [{"content": "from checkov.common.models.consts import ANY_VALUE\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\nfrom checkov.common.models.enums import CheckCategories\n\n\nclass S3BucketReplicationConfiguration(BaseResourceValueCheck):\n    def __init__(self):\n        name = \"Ensure that S3 bucket has cross-region replication enabled\"\n        id = \"CKV_AWS_144\"\n        supported_resources = ['aws_s3_bucket']\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self):\n        return \"replication_configuration/[0]/role\"\n\n    def get_expected_value(self):\n        return ANY_VALUE\n\n\ncheck = S3BucketReplicationConfiguration()\n", "path": "checkov/terraform/checks/resource/aws/S3BucketReplicationConfiguration.py"}], "after_files": [{"content": null, "path": "checkov/terraform/checks/resource/aws/S3BucketReplicationConfiguration.py"}]}