We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
AWS_CKV_7 False Positive on assymetric key check in Cloudformation
**Describe the issue**
In terraform, the check avoids false positives with an extra check against symmetric keys before checking whether rotation is enabled.  This same check hasn't been configured for cloudformation:

```
def scan_resource_conf(self, conf):
        # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.
        spec = conf.get('customer_master_key_spec')
        if not spec or 'SYMMETRIC_DEFAULT' in spec:
            return super().scan_resource_conf(conf)
        else:
            return CheckResult.PASSED
```

**Examples**

```
RSASigningKey:
  Type: 'AWS::KMS::Key'
  Properties:
    Description: RSA-3072 asymmetric KMS key for signing and verification
    KeySpec: RSA_3072
    KeyUsage: SIGN_VERIFY
    KeyPolicy:
      Version: 2012-10-17
      Id: key-default-1
      Statement:
        - Sid: Enable IAM User Permissions
          Effect: Allow
          Principal:
            AWS: 'arn:aws:iam::111122223333:root'
          Action: 'kms:*'
          Resource: '*'
        - Sid: Allow administration of the key
          Effect: Allow
          Principal:
            AWS: 'arn:aws:iam::111122223333:role/Admin'
          Action:
            - 'kms:Create*'
            - 'kms:Describe*'
            - 'kms:Enable*'
            - 'kms:List*'
            - 'kms:Put*'
            - 'kms:Update*'
            - 'kms:Revoke*'
            - 'kms:Disable*'
            - 'kms:Get*'
            - 'kms:Delete*'
            - 'kms:ScheduleKeyDeletion'
            - 'kms:CancelKeyDeletion'
          Resource: '*'
        - Sid: Allow use of the key
          Effect: Allow
          Principal:
            AWS: 'arn:aws:iam::111122223333:role/Developer'
          Action:
            - 'kms:Sign'
            - 'kms:Verify'
            - 'kms:DescribeKey'
          Resource: '*'
```

**Version (please complete the following information):**
 - Checkov Version [e.g. 2.3.0]

**Additional context**

This blocks checkov working for assymetric keys in CFN.


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/cloudformation/checks/resource/aws/KMSRotation.py`
Content:
```
1 from checkov.common.models.enums import CheckCategories
2 from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck
3 
4 
5 class KMSRotation(BaseResourceValueCheck):
6     def __init__(self) -> None:
7         name = "Ensure rotation for customer created CMKs is enabled"
8         id = "CKV_AWS_7"
9         supported_resources = ("AWS::KMS::Key",)
10         categories = (CheckCategories.ENCRYPTION,)
11         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
12 
13     def get_inspected_key(self) -> str:
14         return "Properties/EnableKeyRotation"
15 
16 
17 check = KMSRotation()
18
```

Path: `checkov/terraform/checks/resource/aws/KMSRotation.py`
Content:
```
1 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
2 from checkov.common.models.enums import CheckCategories, CheckResult
3 
4 
5 class KMSRotation(BaseResourceValueCheck):
6     def __init__(self):
7         name = "Ensure rotation for customer created CMKs is enabled"
8         id = "CKV_AWS_7"
9         supported_resources = ['aws_kms_key']
10         categories = [CheckCategories.ENCRYPTION]
11         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
12 
13     def get_inspected_key(self):
14         return "enable_key_rotation"
15 
16     def scan_resource_conf(self, conf):
17         # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.
18         spec = conf.get('customer_master_key_spec')
19         if not spec or 'SYMMETRIC_DEFAULT' in spec:
20             return super().scan_resource_conf(conf)
21         else:
22             return CheckResult.PASSED
23 
24 
25 check = KMSRotation()
26
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/cloudformation/checks/resource/aws/KMSRotation.py b/checkov/cloudformation/checks/resource/aws/KMSRotation.py
--- a/checkov/cloudformation/checks/resource/aws/KMSRotation.py
+++ b/checkov/cloudformation/checks/resource/aws/KMSRotation.py
@@ -1,4 +1,4 @@
-from checkov.common.models.enums import CheckCategories
+from checkov.common.models.enums import CheckCategories, CheckResult
 from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck
 
 
@@ -13,5 +13,15 @@
     def get_inspected_key(self) -> str:
         return "Properties/EnableKeyRotation"
 
+    def scan_resource_conf(self, conf):
+        # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.
+        properties = conf.get("Properties")
+        if properties and isinstance(properties, dict):
+            spec = properties.get("KeySpec")
+            if spec and isinstance(spec, str):
+                if 'SYMMETRIC_DEFAULT' not in spec and 'HMAC' not in spec:
+                    return CheckResult.UNKNOWN
+        return super().scan_resource_conf(conf)
+
 
 check = KMSRotation()
diff --git a/checkov/terraform/checks/resource/aws/KMSRotation.py b/checkov/terraform/checks/resource/aws/KMSRotation.py
--- a/checkov/terraform/checks/resource/aws/KMSRotation.py
+++ b/checkov/terraform/checks/resource/aws/KMSRotation.py
@@ -16,10 +16,10 @@
     def scan_resource_conf(self, conf):
         # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.
         spec = conf.get('customer_master_key_spec')
-        if not spec or 'SYMMETRIC_DEFAULT' in spec:
+        if not spec or 'SYMMETRIC_DEFAULT' in spec or 'HMAC' in spec:
             return super().scan_resource_conf(conf)
         else:
-            return CheckResult.PASSED
+            return CheckResult.UNKNOWN
 
 
 check = KMSRotation()

{"golden_diff": "diff --git a/checkov/cloudformation/checks/resource/aws/KMSRotation.py b/checkov/cloudformation/checks/resource/aws/KMSRotation.py\n--- a/checkov/cloudformation/checks/resource/aws/KMSRotation.py\n+++ b/checkov/cloudformation/checks/resource/aws/KMSRotation.py\n@@ -1,4 +1,4 @@\n-from checkov.common.models.enums import CheckCategories\n+from checkov.common.models.enums import CheckCategories, CheckResult\n from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck\n \n \n@@ -13,5 +13,15 @@\n     def get_inspected_key(self) -> str:\n         return \"Properties/EnableKeyRotation\"\n \n+    def scan_resource_conf(self, conf):\n+        # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.\n+        properties = conf.get(\"Properties\")\n+        if properties and isinstance(properties, dict):\n+            spec = properties.get(\"KeySpec\")\n+            if spec and isinstance(spec, str):\n+                if 'SYMMETRIC_DEFAULT' not in spec and 'HMAC' not in spec:\n+                    return CheckResult.UNKNOWN\n+        return super().scan_resource_conf(conf)\n+\n \n check = KMSRotation()\ndiff --git a/checkov/terraform/checks/resource/aws/KMSRotation.py b/checkov/terraform/checks/resource/aws/KMSRotation.py\n--- a/checkov/terraform/checks/resource/aws/KMSRotation.py\n+++ b/checkov/terraform/checks/resource/aws/KMSRotation.py\n@@ -16,10 +16,10 @@\n     def scan_resource_conf(self, conf):\n         # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.\n         spec = conf.get('customer_master_key_spec')\n-        if not spec or 'SYMMETRIC_DEFAULT' in spec:\n+        if not spec or 'SYMMETRIC_DEFAULT' in spec or 'HMAC' in spec:\n             return super().scan_resource_conf(conf)\n         else:\n-            return CheckResult.PASSED\n+            return CheckResult.UNKNOWN\n \n \n check = KMSRotation()\n", "issue": "AWS_CKV_7 False Positive on assymetric key check in Cloudformation\n**Describe the issue**\r\nIn terraform, the check avoids false positives with an extra check against symmetric keys before checking whether rotation is enabled.  This same check hasn't been configured for cloudformation:\r\n\r\n```\r\ndef scan_resource_conf(self, conf):\r\n        # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.\r\n        spec = conf.get('customer_master_key_spec')\r\n        if not spec or 'SYMMETRIC_DEFAULT' in spec:\r\n            return super().scan_resource_conf(conf)\r\n        else:\r\n            return CheckResult.PASSED\r\n```\r\n\r\n**Examples**\r\n\r\n```\r\nRSASigningKey:\r\n  Type: 'AWS::KMS::Key'\r\n  Properties:\r\n    Description: RSA-3072 asymmetric KMS key for signing and verification\r\n    KeySpec: RSA_3072\r\n    KeyUsage: SIGN_VERIFY\r\n    KeyPolicy:\r\n      Version: 2012-10-17\r\n      Id: key-default-1\r\n      Statement:\r\n        - Sid: Enable IAM User Permissions\r\n          Effect: Allow\r\n          Principal:\r\n            AWS: 'arn:aws:iam::111122223333:root'\r\n          Action: 'kms:*'\r\n          Resource: '*'\r\n        - Sid: Allow administration of the key\r\n          Effect: Allow\r\n          Principal:\r\n            AWS: 'arn:aws:iam::111122223333:role/Admin'\r\n          Action:\r\n            - 'kms:Create*'\r\n            - 'kms:Describe*'\r\n            - 'kms:Enable*'\r\n            - 'kms:List*'\r\n            - 'kms:Put*'\r\n            - 'kms:Update*'\r\n            - 'kms:Revoke*'\r\n            - 'kms:Disable*'\r\n            - 'kms:Get*'\r\n            - 'kms:Delete*'\r\n            - 'kms:ScheduleKeyDeletion'\r\n            - 'kms:CancelKeyDeletion'\r\n          Resource: '*'\r\n        - Sid: Allow use of the key\r\n          Effect: Allow\r\n          Principal:\r\n            AWS: 'arn:aws:iam::111122223333:role/Developer'\r\n          Action:\r\n            - 'kms:Sign'\r\n            - 'kms:Verify'\r\n            - 'kms:DescribeKey'\r\n          Resource: '*'\r\n```\r\n\r\n**Version (please complete the following information):**\r\n - Checkov Version [e.g. 2.3.0]\r\n\r\n**Additional context**\r\n\r\nThis blocks checkov working for assymetric keys in CFN.\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckCategories\nfrom checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck\n\n\nclass KMSRotation(BaseResourceValueCheck):\n    def __init__(self) -> None:\n        name = \"Ensure rotation for customer created CMKs is enabled\"\n        id = \"CKV_AWS_7\"\n        supported_resources = (\"AWS::KMS::Key\",)\n        categories = (CheckCategories.ENCRYPTION,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self) -> str:\n        return \"Properties/EnableKeyRotation\"\n\n\ncheck = KMSRotation()\n", "path": "checkov/cloudformation/checks/resource/aws/KMSRotation.py"}, {"content": "from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\nfrom checkov.common.models.enums import CheckCategories, CheckResult\n\n\nclass KMSRotation(BaseResourceValueCheck):\n    def __init__(self):\n        name = \"Ensure rotation for customer created CMKs is enabled\"\n        id = \"CKV_AWS_7\"\n        supported_resources = ['aws_kms_key']\n        categories = [CheckCategories.ENCRYPTION]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self):\n        return \"enable_key_rotation\"\n\n    def scan_resource_conf(self, conf):\n        # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.\n        spec = conf.get('customer_master_key_spec')\n        if not spec or 'SYMMETRIC_DEFAULT' in spec:\n            return super().scan_resource_conf(conf)\n        else:\n            return CheckResult.PASSED\n\n\ncheck = KMSRotation()\n", "path": "checkov/terraform/checks/resource/aws/KMSRotation.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck\n\n\nclass KMSRotation(BaseResourceValueCheck):\n    def __init__(self) -> None:\n        name = \"Ensure rotation for customer created CMKs is enabled\"\n        id = \"CKV_AWS_7\"\n        supported_resources = (\"AWS::KMS::Key\",)\n        categories = (CheckCategories.ENCRYPTION,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self) -> str:\n        return \"Properties/EnableKeyRotation\"\n\n    def scan_resource_conf(self, conf):\n        # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.\n        properties = conf.get(\"Properties\")\n        if properties and isinstance(properties, dict):\n            spec = properties.get(\"KeySpec\")\n            if spec and isinstance(spec, str):\n                if 'SYMMETRIC_DEFAULT' not in spec and 'HMAC' not in spec:\n                    return CheckResult.UNKNOWN\n        return super().scan_resource_conf(conf)\n\n\ncheck = KMSRotation()\n", "path": "checkov/cloudformation/checks/resource/aws/KMSRotation.py"}, {"content": "from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\nfrom checkov.common.models.enums import CheckCategories, CheckResult\n\n\nclass KMSRotation(BaseResourceValueCheck):\n    def __init__(self):\n        name = \"Ensure rotation for customer created CMKs is enabled\"\n        id = \"CKV_AWS_7\"\n        supported_resources = ['aws_kms_key']\n        categories = [CheckCategories.ENCRYPTION]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self):\n        return \"enable_key_rotation\"\n\n    def scan_resource_conf(self, conf):\n        # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.\n        spec = conf.get('customer_master_key_spec')\n        if not spec or 'SYMMETRIC_DEFAULT' in spec or 'HMAC' in spec:\n            return super().scan_resource_conf(conf)\n        else:\n            return CheckResult.UNKNOWN\n\n\ncheck = KMSRotation()\n", "path": "checkov/terraform/checks/resource/aws/KMSRotation.py"}]}