We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
False positive on CKV_AWS_59 - APIGatewayAuthorization ignores API keys
**Describe the bug**
**CKV_AWS_59** assumes the API is open to the public if authorization is **NONE**. However, API keys are another option on REST APIs and are configured separately. See https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-setup-api-key-with-console.html.

**To Reproduce**
The following terraform code will cause a test failure, which appears to be against the spirit of the rule:
```terraform
resource "aws_api_gateway_method" "POST" {
...
authorization = NONE
api_key_required = true
...
}
````

**Expected behavior**
I would expect this configuration to be considered secure. 

**Desktop (please complete the following information):**
 - OS: linux/amd64 Docker image bridgecrew/checkov:1.0.833
 - Checkov Version 1.0.833




--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py`
Content:
```
1 from checkov.common.models.enums import CheckResult, CheckCategories
2 from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck
3 
4 class APIGatewayAuthorization(BaseResourceCheck):
5 
6     def __init__(self):
7         name = "Ensure there is no open access to back-end resources through API"
8         id = "CKV_AWS_59"
9         supported_resources = ['AWS::ApiGateway::Method']
10         categories = [CheckCategories.GENERAL_SECURITY]
11         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
12 
13     def scan_resource_conf(self, conf):
14         if 'Properties' in conf.keys():
15             if 'HttpMethod' in conf['Properties'].keys() and 'AuthorizationType' in conf['Properties'].keys():
16                 if conf['Properties']['HttpMethod'] != "OPTIONS" and conf['Properties']['AuthorizationType'] == "NONE":
17                     return CheckResult.FAILED
18         return CheckResult.PASSED
19 
20 check = APIGatewayAuthorization()
21
```

Path: `checkov/terraform/checks/resource/aws/APIGatewayAuthorization.py`
Content:
```
1 from checkov.common.models.enums import CheckResult, CheckCategories
2 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
3 
4 
5 class APIGatewayAuthorization(BaseResourceCheck):
6 
7     def __init__(self):
8         name = "Ensure there is no open access to back-end resources through API"
9         id = "CKV_AWS_59"
10         supported_resources = ['aws_api_gateway_method']
11         categories = [CheckCategories.GENERAL_SECURITY]
12         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
13 
14     def scan_resource_conf(self, conf):
15         self.evaluated_keys = ['http_method', 'authorization']
16         if conf['http_method'][0] != "OPTIONS" and conf['authorization'][0] == "NONE":
17             return CheckResult.FAILED
18         return CheckResult.PASSED
19 
20 
21 check = APIGatewayAuthorization()
22
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py b/checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py
--- a/checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py
+++ b/checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py
@@ -14,7 +14,8 @@
         if 'Properties' in conf.keys():
             if 'HttpMethod' in conf['Properties'].keys() and 'AuthorizationType' in conf['Properties'].keys():
                 if conf['Properties']['HttpMethod'] != "OPTIONS" and conf['Properties']['AuthorizationType'] == "NONE":
-                    return CheckResult.FAILED
+                    if 'ApiKeyRequired' not in conf['Properties'].keys() or conf['Properties']['ApiKeyRequired'] == False:
+                        return CheckResult.FAILED
         return CheckResult.PASSED
 
 check = APIGatewayAuthorization()
diff --git a/checkov/terraform/checks/resource/aws/APIGatewayAuthorization.py b/checkov/terraform/checks/resource/aws/APIGatewayAuthorization.py
--- a/checkov/terraform/checks/resource/aws/APIGatewayAuthorization.py
+++ b/checkov/terraform/checks/resource/aws/APIGatewayAuthorization.py
@@ -12,8 +12,8 @@
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
     def scan_resource_conf(self, conf):
-        self.evaluated_keys = ['http_method', 'authorization']
-        if conf['http_method'][0] != "OPTIONS" and conf['authorization'][0] == "NONE":
+        self.evaluated_keys = ['http_method', 'authorization', 'api_key_required']
+        if conf['http_method'][0] != "OPTIONS" and conf['authorization'][0] == "NONE" and ('api_key_required' not in conf or conf['api_key_required'][0] == False):
             return CheckResult.FAILED
         return CheckResult.PASSED

{"golden_diff": "diff --git a/checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py b/checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py\n--- a/checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py\n+++ b/checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py\n@@ -14,7 +14,8 @@\n         if 'Properties' in conf.keys():\n             if 'HttpMethod' in conf['Properties'].keys() and 'AuthorizationType' in conf['Properties'].keys():\n                 if conf['Properties']['HttpMethod'] != \"OPTIONS\" and conf['Properties']['AuthorizationType'] == \"NONE\":\n-                    return CheckResult.FAILED\n+                    if 'ApiKeyRequired' not in conf['Properties'].keys() or conf['Properties']['ApiKeyRequired'] == False:\n+                        return CheckResult.FAILED\n         return CheckResult.PASSED\n \n check = APIGatewayAuthorization()\ndiff --git a/checkov/terraform/checks/resource/aws/APIGatewayAuthorization.py b/checkov/terraform/checks/resource/aws/APIGatewayAuthorization.py\n--- a/checkov/terraform/checks/resource/aws/APIGatewayAuthorization.py\n+++ b/checkov/terraform/checks/resource/aws/APIGatewayAuthorization.py\n@@ -12,8 +12,8 @@\n         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n \n     def scan_resource_conf(self, conf):\n-        self.evaluated_keys = ['http_method', 'authorization']\n-        if conf['http_method'][0] != \"OPTIONS\" and conf['authorization'][0] == \"NONE\":\n+        self.evaluated_keys = ['http_method', 'authorization', 'api_key_required']\n+        if conf['http_method'][0] != \"OPTIONS\" and conf['authorization'][0] == \"NONE\" and ('api_key_required' not in conf or conf['api_key_required'][0] == False):\n             return CheckResult.FAILED\n         return CheckResult.PASSED\n", "issue": "False positive on CKV_AWS_59 - APIGatewayAuthorization ignores API keys\n**Describe the bug**\r\n**CKV_AWS_59** assumes the API is open to the public if authorization is **NONE**. However, API keys are another option on REST APIs and are configured separately. See https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-setup-api-key-with-console.html.\r\n\r\n**To Reproduce**\r\nThe following terraform code will cause a test failure, which appears to be against the spirit of the rule:\r\n```terraform\r\nresource \"aws_api_gateway_method\" \"POST\" {\r\n...\r\nauthorization = NONE\r\napi_key_required = true\r\n...\r\n}\r\n````\r\n\r\n**Expected behavior**\r\nI would expect this configuration to be considered secure. \r\n\r\n**Desktop (please complete the following information):**\r\n - OS: linux/amd64 Docker image bridgecrew/checkov:1.0.833\r\n - Checkov Version 1.0.833\r\n\r\n\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck\n\nclass APIGatewayAuthorization(BaseResourceCheck):\n\n    def __init__(self):\n        name = \"Ensure there is no open access to back-end resources through API\"\n        id = \"CKV_AWS_59\"\n        supported_resources = ['AWS::ApiGateway::Method']\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if 'Properties' in conf.keys():\n            if 'HttpMethod' in conf['Properties'].keys() and 'AuthorizationType' in conf['Properties'].keys():\n                if conf['Properties']['HttpMethod'] != \"OPTIONS\" and conf['Properties']['AuthorizationType'] == \"NONE\":\n                    return CheckResult.FAILED\n        return CheckResult.PASSED\n\ncheck = APIGatewayAuthorization()\n", "path": "checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py"}, {"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass APIGatewayAuthorization(BaseResourceCheck):\n\n    def __init__(self):\n        name = \"Ensure there is no open access to back-end resources through API\"\n        id = \"CKV_AWS_59\"\n        supported_resources = ['aws_api_gateway_method']\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        self.evaluated_keys = ['http_method', 'authorization']\n        if conf['http_method'][0] != \"OPTIONS\" and conf['authorization'][0] == \"NONE\":\n            return CheckResult.FAILED\n        return CheckResult.PASSED\n\n\ncheck = APIGatewayAuthorization()\n", "path": "checkov/terraform/checks/resource/aws/APIGatewayAuthorization.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck\n\nclass APIGatewayAuthorization(BaseResourceCheck):\n\n    def __init__(self):\n        name = \"Ensure there is no open access to back-end resources through API\"\n        id = \"CKV_AWS_59\"\n        supported_resources = ['AWS::ApiGateway::Method']\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if 'Properties' in conf.keys():\n            if 'HttpMethod' in conf['Properties'].keys() and 'AuthorizationType' in conf['Properties'].keys():\n                if conf['Properties']['HttpMethod'] != \"OPTIONS\" and conf['Properties']['AuthorizationType'] == \"NONE\":\n                    if 'ApiKeyRequired' not in conf['Properties'].keys() or conf['Properties']['ApiKeyRequired'] == False:\n                        return CheckResult.FAILED\n        return CheckResult.PASSED\n\ncheck = APIGatewayAuthorization()\n", "path": "checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py"}, {"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass APIGatewayAuthorization(BaseResourceCheck):\n\n    def __init__(self):\n        name = \"Ensure there is no open access to back-end resources through API\"\n        id = \"CKV_AWS_59\"\n        supported_resources = ['aws_api_gateway_method']\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        self.evaluated_keys = ['http_method', 'authorization', 'api_key_required']\n        if conf['http_method'][0] != \"OPTIONS\" and conf['authorization'][0] == \"NONE\" and ('api_key_required' not in conf or conf['api_key_required'][0] == False):\n            return CheckResult.FAILED\n        return CheckResult.PASSED\n\n\ncheck = APIGatewayAuthorization()\n", "path": "checkov/terraform/checks/resource/aws/APIGatewayAuthorization.py"}]}