prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  Checks IDs changing
  Hi Team,
  
  would like to request the check IDs do not get changed since we allowlist some checks which we run in our environment.
  Eg : https://docs.bridgecrew.io/docs/bc_aws_iam_45 Check ID says CKV_AWS_61
  
  whereas code is different for CKV_AWS_61.
  Thanks!
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py`
  Content:
  ```
  1 import re
  2 
  3 from checkov.common.models.enums import CheckResult, CheckCategories
  4 from checkov.common.util.type_forcers import extract_policy_dict
  5 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
  6 from typing import List
  7 
  8 
  9 class IAMRoleAllowAssumeFromAccount(BaseResourceCheck):
  10 
  11     def __init__(self):
  12         name = "Ensure IAM role allows only specific principals in account to assume it"
  13         id = "CKV_AWS_61"
  14         supported_resources = ['aws_iam_role']
  15         categories = [CheckCategories.IAM]
  16         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  17 
  18     def scan_resource_conf(self, conf):
  19         try:
  20             assume_role_block = extract_policy_dict(conf['assume_role_policy'][0])
  21             if assume_role_block and 'Statement' in assume_role_block.keys() \
  22                     and 'Principal' in assume_role_block['Statement'][0] \
  23                     and 'AWS' in assume_role_block['Statement'][0]['Principal']:
  24                 account_access = re.compile(r'\d{12}|arn:aws:iam::\d{12}:root')
  25                 if re.match(account_access, assume_role_block['Statement'][0]['Principal']['AWS']):
  26                     return CheckResult.FAILED
  27         except Exception:  # nosec
  28             pass
  29         return CheckResult.PASSED
  30 
  31     def get_evaluated_keys(self) -> List[str]:
  32         return ['assume_role_policy']
  33 
  34 
  35 check = IAMRoleAllowAssumeFromAccount()
  36
  ```
  
  Path: `checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py`
  Content:
  ```
  1 import json
  2 import re
  3 
  4 from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck
  5 from checkov.common.models.enums import CheckResult, CheckCategories
  6 
  7 ACCOUNT_ACCESS = re.compile(r'\d{12}|arn:aws:iam::\d{12}:root')
  8 
  9 class IAMRoleAllowAssumeFromAccount(BaseResourceCheck):
  10     def __init__(self):
  11         name = "Ensure IAM role allows only specific principals in account to assume it"
  12         id = "CKV_AWS_61"
  13         supported_resources = ['AWS::IAM::Role']
  14         categories = [CheckCategories.IAM]
  15         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  16 
  17     def scan_resource_conf(self, conf):
  18         if 'AssumeRolePolicyDocument' in conf['Properties']:
  19             assume_role_policy_doc = conf['Properties']['AssumeRolePolicyDocument']
  20             if isinstance(assume_role_policy_doc, dict) and 'Fn::Sub' in assume_role_policy_doc.keys():
  21                 policy_fn_sub_block = assume_role_policy_doc['Fn::Sub']
  22                 if isinstance(policy_fn_sub_block, list) and len(policy_fn_sub_block) == 2:
  23                     assume_role_block = json.loads(policy_fn_sub_block[0])
  24                 else:
  25                     assume_role_block = json.loads(policy_fn_sub_block)
  26             elif isinstance(assume_role_policy_doc, str):
  27                 assume_role_block = json.loads(assume_role_policy_doc)
  28             else:
  29                 assume_role_block = assume_role_policy_doc
  30         else:
  31             return CheckResult.UNKNOWN
  32 
  33         if 'Statement' in assume_role_block.keys():
  34             if isinstance(assume_role_block['Statement'], list) and 'Principal' in \
  35                     assume_role_block['Statement'][0]:
  36                 if 'AWS' in assume_role_block['Statement'][0]['Principal']:
  37                     if isinstance(assume_role_block['Statement'][0]['Principal']['AWS'],list) \
  38                             and isinstance(assume_role_block['Statement'][0]['Principal']['AWS'][0], str):
  39                         if re.match(ACCOUNT_ACCESS, assume_role_block['Statement'][0]['Principal']['AWS'][0]):
  40                             return CheckResult.FAILED
  41 
  42             return CheckResult.PASSED
  43 
  44 
  45 check = IAMRoleAllowAssumeFromAccount()
  46
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py b/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py
  --- a/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py
  +++ b/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py
  @@ -8,7 +8,7 @@
   
   class IAMRoleAllowAssumeFromAccount(BaseResourceCheck):
       def __init__(self):
  -        name = "Ensure IAM role allows only specific principals in account to assume it"
  +        name = "Ensure AWS IAM policy does not allow assume role permission across all services"
           id = "CKV_AWS_61"
           supported_resources = ['AWS::IAM::Role']
           categories = [CheckCategories.IAM]
  diff --git a/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py b/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py
  --- a/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py
  +++ b/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py
  @@ -9,7 +9,7 @@
   class IAMRoleAllowAssumeFromAccount(BaseResourceCheck):
   
       def __init__(self):
  -        name = "Ensure IAM role allows only specific principals in account to assume it"
  +        name = "Ensure AWS IAM policy does not allow assume role permission across all services"
           id = "CKV_AWS_61"
           supported_resources = ['aws_iam_role']
           categories = [CheckCategories.IAM]
  
verification_info: {"golden_diff": "diff --git a/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py b/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py\n--- a/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py\n+++ b/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py\n@@ -8,7 +8,7 @@\n \n class IAMRoleAllowAssumeFromAccount(BaseResourceCheck):\n     def __init__(self):\n-        name = \"Ensure IAM role allows only specific principals in account to assume it\"\n+        name = \"Ensure AWS IAM policy does not allow assume role permission across all services\"\n         id = \"CKV_AWS_61\"\n         supported_resources = ['AWS::IAM::Role']\n         categories = [CheckCategories.IAM]\ndiff --git a/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py b/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py\n--- a/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py\n+++ b/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py\n@@ -9,7 +9,7 @@\n class IAMRoleAllowAssumeFromAccount(BaseResourceCheck):\n \n     def __init__(self):\n-        name = \"Ensure IAM role allows only specific principals in account to assume it\"\n+        name = \"Ensure AWS IAM policy does not allow assume role permission across all services\"\n         id = \"CKV_AWS_61\"\n         supported_resources = ['aws_iam_role']\n         categories = [CheckCategories.IAM]\n", "issue": "Checks IDs changing\nHi Team,\r\n\r\nwould like to request the check IDs do not get changed since we allowlist some checks which we run in our environment.\r\nEg : https://docs.bridgecrew.io/docs/bc_aws_iam_45 Check ID says CKV_AWS_61\r\n\r\nwhereas code is different for CKV_AWS_61.\r\nThanks!\r\n\n", "before_files": [{"content": "import re\n\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.common.util.type_forcers import extract_policy_dict\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom typing import List\n\n\nclass IAMRoleAllowAssumeFromAccount(BaseResourceCheck):\n\n    def __init__(self):\n        name = \"Ensure IAM role allows only specific principals in account to assume it\"\n        id = \"CKV_AWS_61\"\n        supported_resources = ['aws_iam_role']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        try:\n            assume_role_block = extract_policy_dict(conf['assume_role_policy'][0])\n            if assume_role_block and 'Statement' in assume_role_block.keys() \\\n                    and 'Principal' in assume_role_block['Statement'][0] \\\n                    and 'AWS' in assume_role_block['Statement'][0]['Principal']:\n                account_access = re.compile(r'\\d{12}|arn:aws:iam::\\d{12}:root')\n                if re.match(account_access, assume_role_block['Statement'][0]['Principal']['AWS']):\n                    return CheckResult.FAILED\n        except Exception:  # nosec\n            pass\n        return CheckResult.PASSED\n\n    def get_evaluated_keys(self) -> List[str]:\n        return ['assume_role_policy']\n\n\ncheck = IAMRoleAllowAssumeFromAccount()\n", "path": "checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py"}, {"content": "import json\nimport re\n\nfrom checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck\nfrom checkov.common.models.enums import CheckResult, CheckCategories\n\nACCOUNT_ACCESS = re.compile(r'\\d{12}|arn:aws:iam::\\d{12}:root')\n\nclass IAMRoleAllowAssumeFromAccount(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure IAM role allows only specific principals in account to assume it\"\n        id = \"CKV_AWS_61\"\n        supported_resources = ['AWS::IAM::Role']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if 'AssumeRolePolicyDocument' in conf['Properties']:\n            assume_role_policy_doc = conf['Properties']['AssumeRolePolicyDocument']\n            if isinstance(assume_role_policy_doc, dict) and 'Fn::Sub' in assume_role_policy_doc.keys():\n                policy_fn_sub_block = assume_role_policy_doc['Fn::Sub']\n                if isinstance(policy_fn_sub_block, list) and len(policy_fn_sub_block) == 2:\n                    assume_role_block = json.loads(policy_fn_sub_block[0])\n                else:\n                    assume_role_block = json.loads(policy_fn_sub_block)\n            elif isinstance(assume_role_policy_doc, str):\n                assume_role_block = json.loads(assume_role_policy_doc)\n            else:\n                assume_role_block = assume_role_policy_doc\n        else:\n            return CheckResult.UNKNOWN\n\n        if 'Statement' in assume_role_block.keys():\n            if isinstance(assume_role_block['Statement'], list) and 'Principal' in \\\n                    assume_role_block['Statement'][0]:\n                if 'AWS' in assume_role_block['Statement'][0]['Principal']:\n                    if isinstance(assume_role_block['Statement'][0]['Principal']['AWS'],list) \\\n                            and isinstance(assume_role_block['Statement'][0]['Principal']['AWS'][0], str):\n                        if re.match(ACCOUNT_ACCESS, assume_role_block['Statement'][0]['Principal']['AWS'][0]):\n                            return CheckResult.FAILED\n\n            return CheckResult.PASSED\n\n\ncheck = IAMRoleAllowAssumeFromAccount()\n", "path": "checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py"}], "after_files": [{"content": "import re\n\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.common.util.type_forcers import extract_policy_dict\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom typing import List\n\n\nclass IAMRoleAllowAssumeFromAccount(BaseResourceCheck):\n\n    def __init__(self):\n        name = \"Ensure AWS IAM policy does not allow assume role permission across all services\"\n        id = \"CKV_AWS_61\"\n        supported_resources = ['aws_iam_role']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        try:\n            assume_role_block = extract_policy_dict(conf['assume_role_policy'][0])\n            if assume_role_block and 'Statement' in assume_role_block.keys() \\\n                    and 'Principal' in assume_role_block['Statement'][0] \\\n                    and 'AWS' in assume_role_block['Statement'][0]['Principal']:\n                account_access = re.compile(r'\\d{12}|arn:aws:iam::\\d{12}:root')\n                if re.match(account_access, assume_role_block['Statement'][0]['Principal']['AWS']):\n                    return CheckResult.FAILED\n        except Exception:  # nosec\n            pass\n        return CheckResult.PASSED\n\n    def get_evaluated_keys(self) -> List[str]:\n        return ['assume_role_policy']\n\n\ncheck = IAMRoleAllowAssumeFromAccount()\n", "path": "checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py"}, {"content": "import json\nimport re\n\nfrom checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck\nfrom checkov.common.models.enums import CheckResult, CheckCategories\n\nACCOUNT_ACCESS = re.compile(r'\\d{12}|arn:aws:iam::\\d{12}:root')\n\nclass IAMRoleAllowAssumeFromAccount(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure AWS IAM policy does not allow assume role permission across all services\"\n        id = \"CKV_AWS_61\"\n        supported_resources = ['AWS::IAM::Role']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if 'AssumeRolePolicyDocument' in conf['Properties']:\n            assume_role_policy_doc = conf['Properties']['AssumeRolePolicyDocument']\n            if isinstance(assume_role_policy_doc, dict) and 'Fn::Sub' in assume_role_policy_doc.keys():\n                policy_fn_sub_block = assume_role_policy_doc['Fn::Sub']\n                if isinstance(policy_fn_sub_block, list) and len(policy_fn_sub_block) == 2:\n                    assume_role_block = json.loads(policy_fn_sub_block[0])\n                else:\n                    assume_role_block = json.loads(policy_fn_sub_block)\n            elif isinstance(assume_role_policy_doc, str):\n                assume_role_block = json.loads(assume_role_policy_doc)\n            else:\n                assume_role_block = assume_role_policy_doc\n        else:\n            return CheckResult.UNKNOWN\n\n        if 'Statement' in assume_role_block.keys():\n            if isinstance(assume_role_block['Statement'], list) and 'Principal' in \\\n                    assume_role_block['Statement'][0]:\n                if 'AWS' in assume_role_block['Statement'][0]['Principal']:\n                    if isinstance(assume_role_block['Statement'][0]['Principal']['AWS'],list) \\\n                            and isinstance(assume_role_block['Statement'][0]['Principal']['AWS'][0], str):\n                        if re.match(ACCOUNT_ACCESS, assume_role_block['Statement'][0]['Principal']['AWS'][0]):\n                            return CheckResult.FAILED\n\n            return CheckResult.PASSED\n\n\ncheck = IAMRoleAllowAssumeFromAccount()\n", "path": "checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py"}]}