prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  Missing AWS RDS CA in CKV_AWS_211
  **Describe the issue**
  In check CKV_AWS_211, checkov currently only checks for one possible CA on AWS RDS instances, namely `rds-ca-2019` (see [associated code](https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py#L24)) whereas RDS supports several (see [AWS docs](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.RegionCertificateAuthorities)). The check should accept those CAs: `rds-ca-rsa2048-g1`, `rds-ca-rsa4096-g1` and `rds-ca-ecc384-g1`.
  
  **Examples**
  Terraform code on which the check should pass:
  ```terraform
  resource "aws_db_instance" "pass3" {
    allocated_storage                   = 20
    storage_type                        = "gp2"
    engine                              = "mysql"
    engine_version                      = "5.7"
    instance_class                      = "db.t2.micro"
    db_name                             = "mydb"
    username                            = "foo"
    password                            = "foobarbaz"
    iam_database_authentication_enabled = true
    storage_encrypted                   = true
    ca_cert_identifier                  = "rds-ca-rsa2048-g1"
  }
  ```
  When I run checkov on this Terraform example, I get an error whereas the test should pass:
  
  ```
  Check: CKV_AWS_211: "Ensure RDS uses a modern CaCert"
  	FAILED for resource: aws_db_instance.pass3
  	File: /main.tf:43-55
  	Guide: https://docs.paloaltonetworks.com/content/techdocs/en_US/prisma/prisma-cloud/prisma-cloud-code-security-policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-uses-a-modern-cacert.html
  
  		43 | resource "aws_db_instance" "pass3" {
  		44 |   allocated_storage                   = 20
  		45 |   storage_type                        = "gp2"
  		46 |   engine                              = "mysql"
  		47 |   engine_version                      = "5.7"
  		48 |   instance_class                      = "db.t2.micro"
  		49 |   db_name                             = "mydb"
  		50 |   username                            = "foo"
  		51 |   password                            = "foobarbaz"
  		52 |   iam_database_authentication_enabled = true
  		53 |   storage_encrypted                   = true
  		54 |   ca_cert_identifier                  = "rds-ca-rsa2048-g1"
  		55 | }
  ```
  
  **Version (please complete the following information):**
   - Checkov Version 2.0.930
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py`
  Content:
  ```
  1 from checkov.common.models.enums import CheckCategories, CheckResult
  2 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
  3 from typing import Any, List
  4 
  5 
  6 class RDSCACertIsRecent(BaseResourceValueCheck):
  7     def __init__(self):
  8         name = "Ensure RDS uses a modern CaCert"
  9         id = "CKV_AWS_211"
  10         supported_resources = ["aws_db_instance"]
  11         categories = [CheckCategories.GENERAL_SECURITY]
  12         super().__init__(
  13             name=name,
  14             id=id,
  15             categories=categories,
  16             supported_resources=supported_resources,
  17             missing_block_result=CheckResult.PASSED
  18         )
  19 
  20     def get_inspected_key(self) -> str:
  21         return "ca_cert_identifier"
  22 
  23     def get_expected_values(self) -> List[Any]:
  24         return ["rds-ca-2019"]
  25 
  26 
  27 check = RDSCACertIsRecent()
  28
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py b/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py
  --- a/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py
  +++ b/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py
  @@ -21,7 +21,7 @@
           return "ca_cert_identifier"
   
       def get_expected_values(self) -> List[Any]:
  -        return ["rds-ca-2019"]
  +        return ["rds-ca-rsa2048-g1", "rds-ca-rsa4096-g1", "rds-ca-ecc384-g1"]
   
   
   check = RDSCACertIsRecent()
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py b/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py\n--- a/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py\n+++ b/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py\n@@ -21,7 +21,7 @@\n         return \"ca_cert_identifier\"\n \n     def get_expected_values(self) -> List[Any]:\n-        return [\"rds-ca-2019\"]\n+        return [\"rds-ca-rsa2048-g1\", \"rds-ca-rsa4096-g1\", \"rds-ca-ecc384-g1\"]\n \n \n check = RDSCACertIsRecent()\n", "issue": "Missing AWS RDS CA in CKV_AWS_211\n**Describe the issue**\r\nIn check CKV_AWS_211, checkov currently only checks for one possible CA on AWS RDS instances, namely `rds-ca-2019` (see [associated code](https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py#L24)) whereas RDS supports several (see [AWS docs](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.RegionCertificateAuthorities)). The check should accept those CAs: `rds-ca-rsa2048-g1`, `rds-ca-rsa4096-g1` and `rds-ca-ecc384-g1`.\r\n\r\n**Examples**\r\nTerraform code on which the check should pass:\r\n```terraform\r\nresource \"aws_db_instance\" \"pass3\" {\r\n  allocated_storage                   = 20\r\n  storage_type                        = \"gp2\"\r\n  engine                              = \"mysql\"\r\n  engine_version                      = \"5.7\"\r\n  instance_class                      = \"db.t2.micro\"\r\n  db_name                             = \"mydb\"\r\n  username                            = \"foo\"\r\n  password                            = \"foobarbaz\"\r\n  iam_database_authentication_enabled = true\r\n  storage_encrypted                   = true\r\n  ca_cert_identifier                  = \"rds-ca-rsa2048-g1\"\r\n}\r\n```\r\nWhen I run checkov on this Terraform example, I get an error whereas the test should pass:\r\n\r\n```\r\nCheck: CKV_AWS_211: \"Ensure RDS uses a modern CaCert\"\r\n\tFAILED for resource: aws_db_instance.pass3\r\n\tFile: /main.tf:43-55\r\n\tGuide: https://docs.paloaltonetworks.com/content/techdocs/en_US/prisma/prisma-cloud/prisma-cloud-code-security-policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-uses-a-modern-cacert.html\r\n\r\n\t\t43 | resource \"aws_db_instance\" \"pass3\" {\r\n\t\t44 |   allocated_storage                   = 20\r\n\t\t45 |   storage_type                        = \"gp2\"\r\n\t\t46 |   engine                              = \"mysql\"\r\n\t\t47 |   engine_version                      = \"5.7\"\r\n\t\t48 |   instance_class                      = \"db.t2.micro\"\r\n\t\t49 |   db_name                             = \"mydb\"\r\n\t\t50 |   username                            = \"foo\"\r\n\t\t51 |   password                            = \"foobarbaz\"\r\n\t\t52 |   iam_database_authentication_enabled = true\r\n\t\t53 |   storage_encrypted                   = true\r\n\t\t54 |   ca_cert_identifier                  = \"rds-ca-rsa2048-g1\"\r\n\t\t55 | }\r\n```\r\n\r\n**Version (please complete the following information):**\r\n - Checkov Version 2.0.930\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\nfrom typing import Any, List\n\n\nclass RDSCACertIsRecent(BaseResourceValueCheck):\n    def __init__(self):\n        name = \"Ensure RDS uses a modern CaCert\"\n        id = \"CKV_AWS_211\"\n        supported_resources = [\"aws_db_instance\"]\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(\n            name=name,\n            id=id,\n            categories=categories,\n            supported_resources=supported_resources,\n            missing_block_result=CheckResult.PASSED\n        )\n\n    def get_inspected_key(self) -> str:\n        return \"ca_cert_identifier\"\n\n    def get_expected_values(self) -> List[Any]:\n        return [\"rds-ca-2019\"]\n\n\ncheck = RDSCACertIsRecent()\n", "path": "checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\nfrom typing import Any, List\n\n\nclass RDSCACertIsRecent(BaseResourceValueCheck):\n    def __init__(self):\n        name = \"Ensure RDS uses a modern CaCert\"\n        id = \"CKV_AWS_211\"\n        supported_resources = [\"aws_db_instance\"]\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(\n            name=name,\n            id=id,\n            categories=categories,\n            supported_resources=supported_resources,\n            missing_block_result=CheckResult.PASSED\n        )\n\n    def get_inspected_key(self) -> str:\n        return \"ca_cert_identifier\"\n\n    def get_expected_values(self) -> List[Any]:\n        return [\"rds-ca-rsa2048-g1\", \"rds-ca-rsa4096-g1\", \"rds-ca-ecc384-g1\"]\n\n\ncheck = RDSCACertIsRecent()\n", "path": "checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py"}]}