prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  CKV_AWS_174 incorrect reporting
  CKV_AWS_174 is being triggered in our terraform code even though we have the viewer certificate set to use TLSv.1.2. Snippet of our code here:
  
  viewer_certificate {
     acm_certificate_arn = aws_acm_certificate.cert.arn
     ssl_support_method       = "sni-only"
     minimum_protocol_version = "TLSv1.2_2019" 
  }
  
  
  Steps to reproduce the behavior:
  Running checkov on our terraform code
  
  **Expected behavior**
  This check should be passed
  
  
  
  **Additional context**
  It looks to me like the issue is in the code between lines 17 and 19. I dont think based on the terraform documentation and the if statements that it would ever pass if using an acm certificate
  
  https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/CloudfrontTLS12.py
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/terraform/checks/resource/aws/CloudfrontTLS12.py`
  Content:
  ```
  1 from checkov.common.models.enums import CheckCategories, CheckResult
  2 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
  3 
  4 
  5 class CloudFrontTLS12(BaseResourceValueCheck):
  6     def __init__(self):
  7         name = "Verify CloudFront Distribution Viewer Certificate is using TLS v1.2"
  8         id = "CKV_AWS_174"
  9         supported_resources = ["aws_cloudfront_distribution"]
  10         categories = [CheckCategories.ENCRYPTION]
  11         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  12 
  13     def scan_resource_conf(self, conf):
  14         if "viewer_certificate" in conf.keys():
  15             # check if cloudfront_default_certificate is true then this could use less than tls 1.2
  16             viewer_certificate = conf["viewer_certificate"][0]
  17             if 'cloudfront_default_certificate' in viewer_certificate:
  18                 #is not using the default certificate
  19                 if viewer_certificate["cloudfront_default_certificate"] is not True:
  20                     #these protocol versions
  21                     if "minimum_protocol_version" in viewer_certificate:
  22                         protocol=viewer_certificate["minimum_protocol_version"][0]
  23                         if protocol in ['TLSv1.2_2018', 'TLSv1.2_2019', 'TLSv1.2_2021']:
  24                             return CheckResult.PASSED
  25 
  26         #No cert specified so using default which can be less that tls 1.2
  27         return CheckResult.FAILED
  28 
  29     def get_inspected_key(self):
  30 
  31         return "viewer_certificate/[0]/minimum_protocol_version"
  32 
  33     def get_expected_values(self):
  34         return ['TLSv1.2_2018', 'TLSv1.2_2019', 'TLSv1.2_2021']
  35 
  36 
  37 check = CloudFrontTLS12()
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/terraform/checks/resource/aws/CloudfrontTLS12.py b/checkov/terraform/checks/resource/aws/CloudfrontTLS12.py
  --- a/checkov/terraform/checks/resource/aws/CloudfrontTLS12.py
  +++ b/checkov/terraform/checks/resource/aws/CloudfrontTLS12.py
  @@ -12,18 +12,18 @@
   
       def scan_resource_conf(self, conf):
           if "viewer_certificate" in conf.keys():
  -            # check if cloudfront_default_certificate is true then this could use less than tls 1.2
               viewer_certificate = conf["viewer_certificate"][0]
  -            if 'cloudfront_default_certificate' in viewer_certificate:
  -                #is not using the default certificate
  -                if viewer_certificate["cloudfront_default_certificate"] is not True:
  -                    #these protocol versions
  -                    if "minimum_protocol_version" in viewer_certificate:
  -                        protocol=viewer_certificate["minimum_protocol_version"][0]
  -                        if protocol in ['TLSv1.2_2018', 'TLSv1.2_2019', 'TLSv1.2_2021']:
  -                            return CheckResult.PASSED
  -
  -        #No cert specified so using default which can be less that tls 1.2
  +            # check if cloudfront_default_certificate is true then this could use less than tls 1.2
  +            if ("cloudfront_default_certificate" in viewer_certificate and viewer_certificate
  +                    ["cloudfront_default_certificate"][0] is not True) or (
  +                    'minimum_protocol_version' in viewer_certificate):
  +                # is not using the default certificate
  +                if 'minimum_protocol_version' in viewer_certificate:
  +                    protocol = viewer_certificate["minimum_protocol_version"][0]
  +                    # these protocol versions
  +                    if protocol in ['TLSv1.2_2018', 'TLSv1.2_2019', 'TLSv1.2_2021']:
  +                        return CheckResult.PASSED
  +        # No cert specified so using default which can be less that tls 1.2
           return CheckResult.FAILED
   
       def get_inspected_key(self):
  @@ -34,4 +34,4 @@
           return ['TLSv1.2_2018', 'TLSv1.2_2019', 'TLSv1.2_2021']
   
   
  -check = CloudFrontTLS12()
  \ No newline at end of file
  +check = CloudFrontTLS12()
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/CloudfrontTLS12.py b/checkov/terraform/checks/resource/aws/CloudfrontTLS12.py\n--- a/checkov/terraform/checks/resource/aws/CloudfrontTLS12.py\n+++ b/checkov/terraform/checks/resource/aws/CloudfrontTLS12.py\n@@ -12,18 +12,18 @@\n \n     def scan_resource_conf(self, conf):\n         if \"viewer_certificate\" in conf.keys():\n-            # check if cloudfront_default_certificate is true then this could use less than tls 1.2\n             viewer_certificate = conf[\"viewer_certificate\"][0]\n-            if 'cloudfront_default_certificate' in viewer_certificate:\n-                #is not using the default certificate\n-                if viewer_certificate[\"cloudfront_default_certificate\"] is not True:\n-                    #these protocol versions\n-                    if \"minimum_protocol_version\" in viewer_certificate:\n-                        protocol=viewer_certificate[\"minimum_protocol_version\"][0]\n-                        if protocol in ['TLSv1.2_2018', 'TLSv1.2_2019', 'TLSv1.2_2021']:\n-                            return CheckResult.PASSED\n-\n-        #No cert specified so using default which can be less that tls 1.2\n+            # check if cloudfront_default_certificate is true then this could use less than tls 1.2\n+            if (\"cloudfront_default_certificate\" in viewer_certificate and viewer_certificate\n+                    [\"cloudfront_default_certificate\"][0] is not True) or (\n+                    'minimum_protocol_version' in viewer_certificate):\n+                # is not using the default certificate\n+                if 'minimum_protocol_version' in viewer_certificate:\n+                    protocol = viewer_certificate[\"minimum_protocol_version\"][0]\n+                    # these protocol versions\n+                    if protocol in ['TLSv1.2_2018', 'TLSv1.2_2019', 'TLSv1.2_2021']:\n+                        return CheckResult.PASSED\n+        # No cert specified so using default which can be less that tls 1.2\n         return CheckResult.FAILED\n \n     def get_inspected_key(self):\n@@ -34,4 +34,4 @@\n         return ['TLSv1.2_2018', 'TLSv1.2_2019', 'TLSv1.2_2021']\n \n \n-check = CloudFrontTLS12()\n\\ No newline at end of file\n+check = CloudFrontTLS12()\n", "issue": "CKV_AWS_174 incorrect reporting\nCKV_AWS_174 is being triggered in our terraform code even though we have the viewer certificate set to use TLSv.1.2. Snippet of our code here:\r\n\r\nviewer_certificate {\r\n   acm_certificate_arn = aws_acm_certificate.cert.arn\r\n   ssl_support_method       = \"sni-only\"\r\n   minimum_protocol_version = \"TLSv1.2_2019\" \r\n}\r\n\r\n\r\nSteps to reproduce the behavior:\r\nRunning checkov on our terraform code\r\n\r\n**Expected behavior**\r\nThis check should be passed\r\n\r\n\r\n\r\n**Additional context**\r\nIt looks to me like the issue is in the code between lines 17 and 19. I dont think based on the terraform documentation and the if statements that it would ever pass if using an acm certificate\r\n\r\nhttps://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/CloudfrontTLS12.py\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n\n\nclass CloudFrontTLS12(BaseResourceValueCheck):\n    def __init__(self):\n        name = \"Verify CloudFront Distribution Viewer Certificate is using TLS v1.2\"\n        id = \"CKV_AWS_174\"\n        supported_resources = [\"aws_cloudfront_distribution\"]\n        categories = [CheckCategories.ENCRYPTION]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if \"viewer_certificate\" in conf.keys():\n            # check if cloudfront_default_certificate is true then this could use less than tls 1.2\n            viewer_certificate = conf[\"viewer_certificate\"][0]\n            if 'cloudfront_default_certificate' in viewer_certificate:\n                #is not using the default certificate\n                if viewer_certificate[\"cloudfront_default_certificate\"] is not True:\n                    #these protocol versions\n                    if \"minimum_protocol_version\" in viewer_certificate:\n                        protocol=viewer_certificate[\"minimum_protocol_version\"][0]\n                        if protocol in ['TLSv1.2_2018', 'TLSv1.2_2019', 'TLSv1.2_2021']:\n                            return CheckResult.PASSED\n\n        #No cert specified so using default which can be less that tls 1.2\n        return CheckResult.FAILED\n\n    def get_inspected_key(self):\n\n        return \"viewer_certificate/[0]/minimum_protocol_version\"\n\n    def get_expected_values(self):\n        return ['TLSv1.2_2018', 'TLSv1.2_2019', 'TLSv1.2_2021']\n\n\ncheck = CloudFrontTLS12()", "path": "checkov/terraform/checks/resource/aws/CloudfrontTLS12.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n\n\nclass CloudFrontTLS12(BaseResourceValueCheck):\n    def __init__(self):\n        name = \"Verify CloudFront Distribution Viewer Certificate is using TLS v1.2\"\n        id = \"CKV_AWS_174\"\n        supported_resources = [\"aws_cloudfront_distribution\"]\n        categories = [CheckCategories.ENCRYPTION]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if \"viewer_certificate\" in conf.keys():\n            viewer_certificate = conf[\"viewer_certificate\"][0]\n            # check if cloudfront_default_certificate is true then this could use less than tls 1.2\n            if (\"cloudfront_default_certificate\" in viewer_certificate and viewer_certificate\n                    [\"cloudfront_default_certificate\"][0] is not True) or (\n                    'minimum_protocol_version' in viewer_certificate):\n                # is not using the default certificate\n                if 'minimum_protocol_version' in viewer_certificate:\n                    protocol = viewer_certificate[\"minimum_protocol_version\"][0]\n                    # these protocol versions\n                    if protocol in ['TLSv1.2_2018', 'TLSv1.2_2019', 'TLSv1.2_2021']:\n                        return CheckResult.PASSED\n        # No cert specified so using default which can be less that tls 1.2\n        return CheckResult.FAILED\n\n    def get_inspected_key(self):\n\n        return \"viewer_certificate/[0]/minimum_protocol_version\"\n\n    def get_expected_values(self):\n        return ['TLSv1.2_2018', 'TLSv1.2_2019', 'TLSv1.2_2021']\n\n\ncheck = CloudFrontTLS12()\n", "path": "checkov/terraform/checks/resource/aws/CloudfrontTLS12.py"}]}