We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
CKV_AZURE_226: error in check and testcase
**Describe the issue**
CKV_AZURE_226 checks for ephemeral disks within the "main resource" azurerm_kubernetes_cluster but the cluster itself doesn't have any argument called os_disk_type. The argument os_disk_type is part of the node pool. 
The testcase [here](https://github.com/bridgecrewio/checkov/pull/5584/files#diff-c0b8f08537766f6eff2a5d10b9439d227fdaaebe6ff7903008825c5f9d51c22dR1) is misleading and the check itself [here](https://github.com/bridgecrewio/checkov/pull/5584/files#diff-c9248390aa120f7af4643f1908d3d824fb903fd3c6cd63e9e77fe8e9ecd59289R28) too. 

In my opinion this must be something like 
```
    def get_inspected_key(self) -> str:
        return "default_node_pool/[0]/os_disk_type"
```
otherwise it won't work?

Same for CKV_AZURE_227.

**Examples**
```
[root] # head -30 aks.tf
resource "azurerm_kubernetes_cluster" "this" {
  name                = local.name_prefix
  location            = var.resource_group.location
  resource_group_name = var.resource_group.name
  node_resource_group = "${local.name_prefix}-node-pool"
  dns_prefix          = local.name_prefix
  kubernetes_version  = local.kubernetes_version
  sku_tier            = var.sku_tier

  api_server_access_profile {
    authorized_ip_ranges = var.api_server_authorized_ip_ranges
  }

  default_node_pool {
    name = "default"

    enable_host_encryption       = true
    vm_size                      = "Standard_E4ads_v5"
    os_disk_type                 = "Ephemeral"
    zones                        = [1, 2, 3]
    only_critical_addons_enabled = true

    type                 = "VirtualMachineScaleSets"
    vnet_subnet_id       = var.subnet_id
    enable_auto_scaling  = true
    max_count            = 6
    min_count            = 2
    orchestrator_version = local.kubernetes_version

    upgrade_settings {
```

results in
```
[root] # checkov --skip-framework kubernetes --skip-framework helm --quiet --compact -o junitxml -o cli --directory .
2023-10-02 11:58:47,399 [MainThread  ] [WARNI]  The framework "sca_image" is part of the "SCA" module, which is not enabled in the platform
2023-10-02 11:58:47,399 [MainThread  ] [WARNI]  The framework "sca_package" is part of the "SCA" module, which is not enabled in the platform
terraform scan results:

Passed checks: 6, Failed checks: 11, Skipped checks: 0

[...]
Check: CKV_AZURE_226: "Ensure ephemeral disks are used for OS disks"
        FAILED for resource: azurerm_kubernetes_cluster.this
        File: /aks.tf:1-64
Check: CKV_AZURE_227: "Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources"
        FAILED for resource: azurerm_kubernetes_cluster.this
        File: /aks.tf:1-64
[...]
```

Please also see https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster for code example.

**Version (please complete the following information):**
 - Checkov Version 2.4.58

**Additional context**
This is related to https://github.com/bridgecrewio/checkov/pull/5584 and https://github.com/bridgecrewio/checkov/pull/5588.


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py`
Content:
```
1 from checkov.common.models.enums import CheckCategories
2 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
3 from typing import Any
4 
5 
6 class AKSEphemeralOSDisks(BaseResourceValueCheck):
7     def __init__(self) -> None:
8         """
9         Temporary data can contain sensitive data at some points, by using ephemeral disks,
10         we ensure that data written to OS disk is stored on local VM storage and isn't persisted to Azure Storage
11 
12         Azure automatically replicates data stored in the managed OS disk of a virtual machine to Azure storage
13         to avoid data loss in case the virtual machine needs to be relocated to another host.
14         Generally speaking, containers are not designed to have local state persisted to the managed OS disk,
15         hence this behavior offers limited value to AKS hosted while providing some drawbacks,
16         including slower node provisioning and higher read/write latency.
17 
18         Ephemeral disks allow us also to have faster cluster operations like scale or upgrade
19         due to faster re-imaging and boot times.
20         """
21         name = "Ensure ephemeral disks are used for OS disks"
22         id = "CKV_AZURE_226"
23         supported_resources = ("azurerm_kubernetes_cluster",)
24         categories = (CheckCategories.KUBERNETES,)
25         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
26 
27     def get_inspected_key(self) -> str:
28         return "os_disk_type"
29 
30     def get_expected_value(self) -> Any:
31         return "Ephemeral"
32 
33 
34 check = AKSEphemeralOSDisks()
35
```

Path: `checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py`
Content:
```
1 
2 from checkov.common.models.enums import CheckCategories, CheckResult
3 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
4 
5 
6 class AKSEncryptionAtHostEnabled(BaseResourceValueCheck):
7     def __init__(self) -> None:
8         """
9         With host-based encryption, the data stored on the VM host of
10         your AKS agent nodes' VMs is encrypted at rest and flows encrypted to the Storage service.
11 
12         This means the temp disks are encrypted at rest with platform-managed keys.
13         The cache of OS and data disks is encrypted at rest with either platform-managed keys
14         or customer-managed keys depending on the encryption type set on those disks.
15         """
16         name = "Ensure that the AKS cluster encrypt temp disks, caches, and data flows "
17         name += "between Compute and Storage resources"
18         id = "CKV_AZURE_227"
19         supported_resources = ("azurerm_kubernetes_cluster", "azurerm_kubernetes_cluster_node_pool")
20         categories = (CheckCategories.KUBERNETES,)
21         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,
22                          missing_block_result=CheckResult.FAILED)
23 
24     def get_inspected_key(self) -> str:
25         return "enable_host_encryption"
26 
27 
28 check = AKSEncryptionAtHostEnabled()
29
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py b/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py
--- a/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py
+++ b/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py
@@ -1,4 +1,3 @@
-
 from checkov.common.models.enums import CheckCategories, CheckResult
 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
 
@@ -18,11 +17,19 @@
         id = "CKV_AZURE_227"
         supported_resources = ("azurerm_kubernetes_cluster", "azurerm_kubernetes_cluster_node_pool")
         categories = (CheckCategories.KUBERNETES,)
-        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,
-                         missing_block_result=CheckResult.FAILED)
+        super().__init__(
+            name=name,
+            id=id,
+            categories=categories,
+            supported_resources=supported_resources,
+            missing_block_result=CheckResult.FAILED,
+        )
 
     def get_inspected_key(self) -> str:
-        return "enable_host_encryption"
+        if self.entity_type == "azurerm_kubernetes_cluster":
+            return "default_node_pool/[0]/enable_host_encryption"
+        else:
+            return "enable_host_encryption"
 
 
 check = AKSEncryptionAtHostEnabled()
diff --git a/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py b/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py
--- a/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py
+++ b/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py
@@ -25,7 +25,7 @@
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
     def get_inspected_key(self) -> str:
-        return "os_disk_type"
+        return "default_node_pool/[0]/os_disk_type"
 
     def get_expected_value(self) -> Any:
         return "Ephemeral"

{"golden_diff": "diff --git a/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py b/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py\n--- a/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py\n+++ b/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py\n@@ -1,4 +1,3 @@\n-\n from checkov.common.models.enums import CheckCategories, CheckResult\n from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n \n@@ -18,11 +17,19 @@\n         id = \"CKV_AZURE_227\"\n         supported_resources = (\"azurerm_kubernetes_cluster\", \"azurerm_kubernetes_cluster_node_pool\")\n         categories = (CheckCategories.KUBERNETES,)\n-        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,\n-                         missing_block_result=CheckResult.FAILED)\n+        super().__init__(\n+            name=name,\n+            id=id,\n+            categories=categories,\n+            supported_resources=supported_resources,\n+            missing_block_result=CheckResult.FAILED,\n+        )\n \n     def get_inspected_key(self) -> str:\n-        return \"enable_host_encryption\"\n+        if self.entity_type == \"azurerm_kubernetes_cluster\":\n+            return \"default_node_pool/[0]/enable_host_encryption\"\n+        else:\n+            return \"enable_host_encryption\"\n \n \n check = AKSEncryptionAtHostEnabled()\ndiff --git a/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py b/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py\n--- a/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py\n+++ b/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py\n@@ -25,7 +25,7 @@\n         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n \n     def get_inspected_key(self) -> str:\n-        return \"os_disk_type\"\n+        return \"default_node_pool/[0]/os_disk_type\"\n \n     def get_expected_value(self) -> Any:\n         return \"Ephemeral\"\n", "issue": "CKV_AZURE_226: error in check and testcase\n**Describe the issue**\r\nCKV_AZURE_226 checks for ephemeral disks within the \"main resource\" azurerm_kubernetes_cluster but the cluster itself doesn't have any argument called os_disk_type. The argument os_disk_type is part of the node pool. \r\nThe testcase [here](https://github.com/bridgecrewio/checkov/pull/5584/files#diff-c0b8f08537766f6eff2a5d10b9439d227fdaaebe6ff7903008825c5f9d51c22dR1) is misleading and the check itself [here](https://github.com/bridgecrewio/checkov/pull/5584/files#diff-c9248390aa120f7af4643f1908d3d824fb903fd3c6cd63e9e77fe8e9ecd59289R28) too. \r\n\r\nIn my opinion this must be something like \r\n```\r\n    def get_inspected_key(self) -> str:\r\n        return \"default_node_pool/[0]/os_disk_type\"\r\n```\r\notherwise it won't work?\r\n\r\nSame for CKV_AZURE_227.\r\n\r\n**Examples**\r\n```\r\n[root] # head -30 aks.tf\r\nresource \"azurerm_kubernetes_cluster\" \"this\" {\r\n  name                = local.name_prefix\r\n  location            = var.resource_group.location\r\n  resource_group_name = var.resource_group.name\r\n  node_resource_group = \"${local.name_prefix}-node-pool\"\r\n  dns_prefix          = local.name_prefix\r\n  kubernetes_version  = local.kubernetes_version\r\n  sku_tier            = var.sku_tier\r\n\r\n  api_server_access_profile {\r\n    authorized_ip_ranges = var.api_server_authorized_ip_ranges\r\n  }\r\n\r\n  default_node_pool {\r\n    name = \"default\"\r\n\r\n    enable_host_encryption       = true\r\n    vm_size                      = \"Standard_E4ads_v5\"\r\n    os_disk_type                 = \"Ephemeral\"\r\n    zones                        = [1, 2, 3]\r\n    only_critical_addons_enabled = true\r\n\r\n    type                 = \"VirtualMachineScaleSets\"\r\n    vnet_subnet_id       = var.subnet_id\r\n    enable_auto_scaling  = true\r\n    max_count            = 6\r\n    min_count            = 2\r\n    orchestrator_version = local.kubernetes_version\r\n\r\n    upgrade_settings {\r\n```\r\n\r\nresults in\r\n```\r\n[root] # checkov --skip-framework kubernetes --skip-framework helm --quiet --compact -o junitxml -o cli --directory .\r\n2023-10-02 11:58:47,399 [MainThread  ] [WARNI]  The framework \"sca_image\" is part of the \"SCA\" module, which is not enabled in the platform\r\n2023-10-02 11:58:47,399 [MainThread  ] [WARNI]  The framework \"sca_package\" is part of the \"SCA\" module, which is not enabled in the platform\r\nterraform scan results:\r\n\r\nPassed checks: 6, Failed checks: 11, Skipped checks: 0\r\n\r\n[...]\r\nCheck: CKV_AZURE_226: \"Ensure ephemeral disks are used for OS disks\"\r\n        FAILED for resource: azurerm_kubernetes_cluster.this\r\n        File: /aks.tf:1-64\r\nCheck: CKV_AZURE_227: \"Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources\"\r\n        FAILED for resource: azurerm_kubernetes_cluster.this\r\n        File: /aks.tf:1-64\r\n[...]\r\n```\r\n\r\nPlease also see https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster for code example.\r\n\r\n**Version (please complete the following information):**\r\n - Checkov Version 2.4.58\r\n\r\n**Additional context**\r\nThis is related to https://github.com/bridgecrewio/checkov/pull/5584 and https://github.com/bridgecrewio/checkov/pull/5588.\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\nfrom typing import Any\n\n\nclass AKSEphemeralOSDisks(BaseResourceValueCheck):\n    def __init__(self) -> None:\n        \"\"\"\n        Temporary data can contain sensitive data at some points, by using ephemeral disks,\n        we ensure that data written to OS disk is stored on local VM storage and isn't persisted to Azure Storage\n\n        Azure automatically replicates data stored in the managed OS disk of a virtual machine to Azure storage\n        to avoid data loss in case the virtual machine needs to be relocated to another host.\n        Generally speaking, containers are not designed to have local state persisted to the managed OS disk,\n        hence this behavior offers limited value to AKS hosted while providing some drawbacks,\n        including slower node provisioning and higher read/write latency.\n\n        Ephemeral disks allow us also to have faster cluster operations like scale or upgrade\n        due to faster re-imaging and boot times.\n        \"\"\"\n        name = \"Ensure ephemeral disks are used for OS disks\"\n        id = \"CKV_AZURE_226\"\n        supported_resources = (\"azurerm_kubernetes_cluster\",)\n        categories = (CheckCategories.KUBERNETES,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self) -> str:\n        return \"os_disk_type\"\n\n    def get_expected_value(self) -> Any:\n        return \"Ephemeral\"\n\n\ncheck = AKSEphemeralOSDisks()\n", "path": "checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py"}, {"content": "\nfrom checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n\n\nclass AKSEncryptionAtHostEnabled(BaseResourceValueCheck):\n    def __init__(self) -> None:\n        \"\"\"\n        With host-based encryption, the data stored on the VM host of\n        your AKS agent nodes' VMs is encrypted at rest and flows encrypted to the Storage service.\n\n        This means the temp disks are encrypted at rest with platform-managed keys.\n        The cache of OS and data disks is encrypted at rest with either platform-managed keys\n        or customer-managed keys depending on the encryption type set on those disks.\n        \"\"\"\n        name = \"Ensure that the AKS cluster encrypt temp disks, caches, and data flows \"\n        name += \"between Compute and Storage resources\"\n        id = \"CKV_AZURE_227\"\n        supported_resources = (\"azurerm_kubernetes_cluster\", \"azurerm_kubernetes_cluster_node_pool\")\n        categories = (CheckCategories.KUBERNETES,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,\n                         missing_block_result=CheckResult.FAILED)\n\n    def get_inspected_key(self) -> str:\n        return \"enable_host_encryption\"\n\n\ncheck = AKSEncryptionAtHostEnabled()\n", "path": "checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\nfrom typing import Any\n\n\nclass AKSEphemeralOSDisks(BaseResourceValueCheck):\n    def __init__(self) -> None:\n        \"\"\"\n        Temporary data can contain sensitive data at some points, by using ephemeral disks,\n        we ensure that data written to OS disk is stored on local VM storage and isn't persisted to Azure Storage\n\n        Azure automatically replicates data stored in the managed OS disk of a virtual machine to Azure storage\n        to avoid data loss in case the virtual machine needs to be relocated to another host.\n        Generally speaking, containers are not designed to have local state persisted to the managed OS disk,\n        hence this behavior offers limited value to AKS hosted while providing some drawbacks,\n        including slower node provisioning and higher read/write latency.\n\n        Ephemeral disks allow us also to have faster cluster operations like scale or upgrade\n        due to faster re-imaging and boot times.\n        \"\"\"\n        name = \"Ensure ephemeral disks are used for OS disks\"\n        id = \"CKV_AZURE_226\"\n        supported_resources = (\"azurerm_kubernetes_cluster\",)\n        categories = (CheckCategories.KUBERNETES,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def get_inspected_key(self) -> str:\n        return \"default_node_pool/[0]/os_disk_type\"\n\n    def get_expected_value(self) -> Any:\n        return \"Ephemeral\"\n\n\ncheck = AKSEphemeralOSDisks()\n", "path": "checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py"}, {"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\n\n\nclass AKSEncryptionAtHostEnabled(BaseResourceValueCheck):\n    def __init__(self) -> None:\n        \"\"\"\n        With host-based encryption, the data stored on the VM host of\n        your AKS agent nodes' VMs is encrypted at rest and flows encrypted to the Storage service.\n\n        This means the temp disks are encrypted at rest with platform-managed keys.\n        The cache of OS and data disks is encrypted at rest with either platform-managed keys\n        or customer-managed keys depending on the encryption type set on those disks.\n        \"\"\"\n        name = \"Ensure that the AKS cluster encrypt temp disks, caches, and data flows \"\n        name += \"between Compute and Storage resources\"\n        id = \"CKV_AZURE_227\"\n        supported_resources = (\"azurerm_kubernetes_cluster\", \"azurerm_kubernetes_cluster_node_pool\")\n        categories = (CheckCategories.KUBERNETES,)\n        super().__init__(\n            name=name,\n            id=id,\n            categories=categories,\n            supported_resources=supported_resources,\n            missing_block_result=CheckResult.FAILED,\n        )\n\n    def get_inspected_key(self) -> str:\n        if self.entity_type == \"azurerm_kubernetes_cluster\":\n            return \"default_node_pool/[0]/enable_host_encryption\"\n        else:\n            return \"enable_host_encryption\"\n\n\ncheck = AKSEncryptionAtHostEnabled()\n", "path": "checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py"}]}