prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  CKV_AWS_4 is an invalid check
  **Describe the bug**
  CKV_AWS_4 for terraform resource `aws_ebs_snapshot` is invalid. There is not an argument for encryption. Please remove this check.
  
  **To Reproduce**
  Steps to reproduce the behavior:
  1. create tf file ckv_aws_4_test.tf:
  ```
  resource "aws_ebs_volume" "example" {
    availability_zone = "us-west-2a"
    encrypted = true
    size              = 40
  
    tags = {
      Name = "HelloWorld"
    }
  }
  
  resource "aws_ebs_snapshot" "example_snapshot" {
    volume_id = "${aws_ebs_volume.example.id}"
  
    tags = {
      Name = "HelloWorld_snap"
    }
  }
  ```
  
  2. Run cli command  'checkov -f ckv_aws_4_test.tf'
  3. Failed when should have passed
  
  **Expected behavior**
  Passing check
  
  **Screenshots**
  ![image](https://user-images.githubusercontent.com/15948264/85431230-dd199180-b546-11ea-824f-b763481a3bfe.png)
  
  
  
  **Desktop (please complete the following information):**
   - OS: [MacOS]
   - Checkov Version [1.0.391]
  
  **Additional context**
  - [link to resource doc](https://www.terraform.io/docs/providers/aws/r/ebs_snapshot.html)
  As you can see, there is not an argument for encryption listed.  Only a computed artifact named encryption.
  ![image](https://user-images.githubusercontent.com/15948264/85432245-4c43b580-b548-11ea-8b5f-9b663364bb52.png)
  
  - [TF SourceCode shows encryption as being computed](https://github.com/terraform-providers/terraform-provider-aws/blob/master/aws/resource_aws_ebs_snapshot.go)
  ![image](https://user-images.githubusercontent.com/15948264/85432117-1d2d4400-b548-11ea-9378-2dcb88c98cb2.png)
  
  - The docs from AWS explain that snapshots that are taken from encrypted volumes are automatically encrypted. [link](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html) 
  
  False positive for CKV_AWS_17
  Checkov `1.0.391` will fail CKV_AWS_17 for a Terraform file defining any value for `publicly_accessible`, even false, because the check is for any value rather the actual security goal which should be a test for true:
  
  https://github.com/bridgecrewio/checkov/blob/b906298b4a26135b7ee6b58f1aa4c54fc04ead20/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py
  
  It should probably also say “RDS instance” rather than “RDS bucket”
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py`
  Content:
  ```
  1 from checkov.common.models.consts import ANY_VALUE
  2 from checkov.common.models.enums import CheckCategories
  3 from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck
  4 
  5 
  6 class RDSPubliclyAccessible(BaseResourceNegativeValueCheck):
  7     def __init__(self):
  8         name = "Ensure all data stored in the RDS bucket is not public accessible"
  9         id = "CKV_AWS_17"
  10         supported_resources = ['aws_db_instance', 'aws_rds_cluster_instance']
  11         categories = [CheckCategories.NETWORKING]
  12         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  13 
  14     def get_inspected_key(self):
  15         return 'publicly_accessible'
  16 
  17     def get_forbidden_values(self):
  18         return [ANY_VALUE]
  19 
  20 
  21 check = RDSPubliclyAccessible()
  22
  ```
  
  Path: `checkov/terraform/checks/resource/aws/EBSSnapshotEncryption.py`
  Content:
  ```
  1 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
  2 from checkov.common.models.enums import CheckCategories
  3 
  4 
  5 class EBSSnapshotEncryption(BaseResourceValueCheck):
  6     def __init__(self):
  7         name = "Ensure all data stored in the EBS Snapshot is securely encrypted"
  8         id = "CKV_AWS_4"
  9         supported_resources = ['aws_ebs_snapshot']
  10         categories = [CheckCategories.ENCRYPTION]
  11         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  12 
  13     def get_inspected_key(self):
  14         return "encrypted"
  15 
  16 
  17 check = EBSSnapshotEncryption()
  18
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/terraform/checks/resource/aws/EBSSnapshotEncryption.py b/checkov/terraform/checks/resource/aws/EBSSnapshotEncryption.py
  deleted file mode 100644
  --- a/checkov/terraform/checks/resource/aws/EBSSnapshotEncryption.py
  +++ /dev/null
  @@ -1,17 +0,0 @@
  -from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
  -from checkov.common.models.enums import CheckCategories
  -
  -
  -class EBSSnapshotEncryption(BaseResourceValueCheck):
  -    def __init__(self):
  -        name = "Ensure all data stored in the EBS Snapshot is securely encrypted"
  -        id = "CKV_AWS_4"
  -        supported_resources = ['aws_ebs_snapshot']
  -        categories = [CheckCategories.ENCRYPTION]
  -        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  -
  -    def get_inspected_key(self):
  -        return "encrypted"
  -
  -
  -check = EBSSnapshotEncryption()
  diff --git a/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py b/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py
  --- a/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py
  +++ b/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py
  @@ -15,7 +15,7 @@
           return 'publicly_accessible'
   
       def get_forbidden_values(self):
  -        return [ANY_VALUE]
  +        return [True]
   
   
   check = RDSPubliclyAccessible()
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/EBSSnapshotEncryption.py b/checkov/terraform/checks/resource/aws/EBSSnapshotEncryption.py\ndeleted file mode 100644\n--- a/checkov/terraform/checks/resource/aws/EBSSnapshotEncryption.py\n+++ /dev/null\n@@ -1,17 +0,0 @@\n-from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n-from checkov.common.models.enums import CheckCategories\n-\n-\n-class EBSSnapshotEncryption(BaseResourceValueCheck):\n-    def __init__(self):\n-        name = \"Ensure all data stored in the EBS Snapshot is securely encrypted\"\n-        id = \"CKV_AWS_4\"\n-        supported_resources = ['aws_ebs_snapshot']\n-        categories = [CheckCategories.ENCRYPTION]\n-        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n-\n-    def get_inspected_key(self):\n-        return \"encrypted\"\n-\n-\n-check = EBSSnapshotEncryption()\ndiff --git a/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py b/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py\n--- a/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py\n+++ b/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py\n@@ -15,7 +15,7 @@\n         return 'publicly_accessible'\n \n     def get_forbidden_values(self):\n-        return [ANY_VALUE]\n+        return [True]\n \n \n check = RDSPubliclyAccessible()\n", "issue": "CKV_AWS_4 is an invalid check\n**Describe the bug**\r\nCKV_AWS_4 for terraform resource `aws_ebs_snapshot` is invalid. There is not an argument for encryption. Please remove this check.\r\n\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\n1. create tf file ckv_aws_4_test.tf:\r\n```\r\nresource \"aws_ebs_volume\" \"example\" {\r\n  availability_zone = \"us-west-2a\"\r\n  encrypted = true\r\n  size              = 40\r\n\r\n  tags = {\r\n    Name = \"HelloWorld\"\r\n  }\r\n}\r\n\r\nresource \"aws_ebs_snapshot\" \"example_snapshot\" {\r\n  volume_id = \"${aws_ebs_volume.example.id}\"\r\n\r\n  tags = {\r\n    Name = \"HelloWorld_snap\"\r\n  }\r\n}\r\n```\r\n\r\n2. Run cli command  'checkov -f ckv_aws_4_test.tf'\r\n3. Failed when should have passed\r\n\r\n**Expected behavior**\r\nPassing check\r\n\r\n**Screenshots**\r\n![image](https://user-images.githubusercontent.com/15948264/85431230-dd199180-b546-11ea-824f-b763481a3bfe.png)\r\n\r\n\r\n\r\n**Desktop (please complete the following information):**\r\n - OS: [MacOS]\r\n - Checkov Version [1.0.391]\r\n\r\n**Additional context**\r\n- [link to resource doc](https://www.terraform.io/docs/providers/aws/r/ebs_snapshot.html)\r\nAs you can see, there is not an argument for encryption listed.  Only a computed artifact named encryption.\r\n![image](https://user-images.githubusercontent.com/15948264/85432245-4c43b580-b548-11ea-8b5f-9b663364bb52.png)\r\n\r\n- [TF SourceCode shows encryption as being computed](https://github.com/terraform-providers/terraform-provider-aws/blob/master/aws/resource_aws_ebs_snapshot.go)\r\n![image](https://user-images.githubusercontent.com/15948264/85432117-1d2d4400-b548-11ea-9378-2dcb88c98cb2.png)\r\n\r\n- The docs from AWS explain that snapshots that are taken from encrypted volumes are automatically encrypted. [link](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html) \r\n\nFalse positive for CKV_AWS_17\nCheckov `1.0.391` will fail CKV_AWS_17 for a Terraform file defining any value for `publicly_accessible`, even false, because the check is for any value rather the actual security goal which should be a test for true:\r\n\r\nhttps://github.com/bridgecrewio/checkov/blob/b906298b4a26135b7ee6b58f1aa4c54fc04ead20/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py\r\n\r\nIt should probably also say \u201cRDS instance\u201d rather than \u201cRDS bucket\u201d\n", "before_files": [{"content": "from checkov.common.models.consts import ANY_VALUE\nfrom checkov.common.models.enums import CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck\n\n\nclass RDSPubliclyAccessible(BaseResourceNegativeValueCheck):\n    def __init__(self):\n        name = \"Ensure all data stored in the RDS bucket is not public accessible\"\n        id = \"CKV_AWS_17\"\n        supported_resources = ['aws_db_instance', 'aws_rds_cluster_instance']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self):\n        return 'publicly_accessible'\n\n    def get_forbidden_values(self):\n        return [ANY_VALUE]\n\n\ncheck = RDSPubliclyAccessible()\n", "path": "checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py"}, {"content": "from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\nfrom checkov.common.models.enums import CheckCategories\n\n\nclass EBSSnapshotEncryption(BaseResourceValueCheck):\n    def __init__(self):\n        name = \"Ensure all data stored in the EBS Snapshot is securely encrypted\"\n        id = \"CKV_AWS_4\"\n        supported_resources = ['aws_ebs_snapshot']\n        categories = [CheckCategories.ENCRYPTION]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self):\n        return \"encrypted\"\n\n\ncheck = EBSSnapshotEncryption()\n", "path": "checkov/terraform/checks/resource/aws/EBSSnapshotEncryption.py"}], "after_files": [{"content": "from checkov.common.models.consts import ANY_VALUE\nfrom checkov.common.models.enums import CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck\n\n\nclass RDSPubliclyAccessible(BaseResourceNegativeValueCheck):\n    def __init__(self):\n        name = \"Ensure all data stored in the RDS bucket is not public accessible\"\n        id = \"CKV_AWS_17\"\n        supported_resources = ['aws_db_instance', 'aws_rds_cluster_instance']\n        categories = [CheckCategories.NETWORKING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self):\n        return 'publicly_accessible'\n\n    def get_forbidden_values(self):\n        return [True]\n\n\ncheck = RDSPubliclyAccessible()\n", "path": "checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py"}, {"content": null, "path": "checkov/terraform/checks/resource/aws/EBSSnapshotEncryption.py"}]}