We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Check: CKV_GCP_19 False positive
**Describe the bug**
Checkov Will flag your code even if the `basic-auth` is already disabled on your cluster.
**To Reproduce**
Steps to reproduce the behavior:
1. Have a file as follows:
``` 
resource "google_container_cluster" "cluster-test" {
  name     = "cluster-test"
  location = "europe-west1-c"
  provider = google-beta

  remove_default_node_pool = true
  initial_node_count       = 1

  enable_shielded_nodes = true

  release_channel {
    channel = "RAPID"
  }

  pod_security_policy_config {
    enabled = true
  }

  master_auth {
    username = ""
    password = ""

    client_certificate_config {
      issue_client_certificate = false
    }
  }
}
``` 
2. Run cli command  'checkov -d path/to/your/terraform/folder.'
3. See error:
``` 
Check: CKV_GCP_19: "Ensure GKE basic auth is disabled"
	FAILED for resource: google_container_cluster.cluster-test
	File: /cluster.tf:1-27
	Guide: https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_11

		1  | resource "google_container_cluster" "cluster-test" {
		2  |   name     = "cluster-test"
		3  |   location = "europe-west1-c"
		4  |   provider = google-beta
		5  | 
		6  |   remove_default_node_pool = true
		7  |   initial_node_count       = 1
		8  | 
		9  |   enable_shielded_nodes = true
		10 | 
		11 |   release_channel {
		12 |     channel = "RAPID"
		13 |   }
		14 | 
		15 |   pod_security_policy_config {
		16 |     enabled = true
		17 |   }
		18 | 
		19 |   master_auth {
		20 |     username = ""
		21 |     password = ""
		22 | 
		23 |     client_certificate_config {
		24 |       issue_client_certificate = false
		25 |     }
		26 |   }
		27 | }
``` 

**Expected behavior**
``` 
Check: CKV_GCP_19: "Ensure GKE basic auth is disabled"
	PASSED for resource: google_container_cluster.cluster-test
	File: /cluster.tf:1-27
	Guide: https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_7
``` 

The `basic-auth` is already supposed to be disabled using this bit of code as:
```  
  master_auth {
    username = ""
    password = ""

    client_certificate_config {
      issue_client_certificate = false
    }
  }
```

**Environment:**
 - CI: Github Actions 
 - OS: Ubuntu-lastest
 - Checkov Version [latest]
 - Terraform v0.12.24

**Additional context**
Tested and installed today following documentation available here: https://www.checkov.io/1.Introduction/Getting%20Started.html

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/terraform/checks/resource/gcp/GKEBasicAuth.py`
Content:
```
1 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
2 from checkov.common.models.enums import CheckResult, CheckCategories
3 
4 
5 class GKEBasicAuth(BaseResourceCheck):
6     def __init__(self):
7         name = "Ensure GKE basic auth is disabled"
8         id = "CKV_GCP_19"
9         supported_resources = ['google_container_cluster']
10         categories = [CheckCategories.KUBERNETES]
11         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
12 
13     def scan_resource_conf(self, conf):
14         """
15             Looks for password configuration at azure_instance:
16             https://www.terraform.io/docs/providers/google/r/compute_ssl_policy.html
17         :param conf: google_compute_ssl_policy configuration
18         :return: <CheckResult>
19         """
20         if 'master_auth' in conf.keys():
21             if conf['master_auth'][0].get('username') or conf['master_auth'][0].get('password'):
22                 return CheckResult.FAILED
23             return CheckResult.PASSED
24         return CheckResult.FAILED
25 
26 
27 check = GKEBasicAuth()
28
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py b/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py
--- a/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py
+++ b/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py
@@ -1,5 +1,5 @@
-from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
 from checkov.common.models.enums import CheckResult, CheckCategories
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
 
 
 class GKEBasicAuth(BaseResourceCheck):
@@ -18,7 +18,13 @@
         :return: <CheckResult>
         """
         if 'master_auth' in conf.keys():
-            if conf['master_auth'][0].get('username') or conf['master_auth'][0].get('password'):
+            username = conf['master_auth'][0].get('username')
+            password = conf['master_auth'][0].get('password')
+            if username or password:
+                # only if both are set to the empty string it is fine
+                # https://www.terraform.io/docs/providers/google/r/container_cluster.html
+                if len(username) == 1 and len(password) == 1 and username[0] == '' and password[0] == '':
+                    return CheckResult.PASSED
                 return CheckResult.FAILED
             return CheckResult.PASSED
         return CheckResult.FAILED

{"golden_diff": "diff --git a/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py b/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py\n--- a/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py\n+++ b/checkov/terraform/checks/resource/gcp/GKEBasicAuth.py\n@@ -1,5 +1,5 @@\n-from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n from checkov.common.models.enums import CheckResult, CheckCategories\n+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n \n \n class GKEBasicAuth(BaseResourceCheck):\n@@ -18,7 +18,13 @@\n         :return: <CheckResult>\n         \"\"\"\n         if 'master_auth' in conf.keys():\n-            if conf['master_auth'][0].get('username') or conf['master_auth'][0].get('password'):\n+            username = conf['master_auth'][0].get('username')\n+            password = conf['master_auth'][0].get('password')\n+            if username or password:\n+                # only if both are set to the empty string it is fine\n+                # https://www.terraform.io/docs/providers/google/r/container_cluster.html\n+                if len(username) == 1 and len(password) == 1 and username[0] == '' and password[0] == '':\n+                    return CheckResult.PASSED\n                 return CheckResult.FAILED\n             return CheckResult.PASSED\n         return CheckResult.FAILED\n", "issue": "Check: CKV_GCP_19 False positive\n**Describe the bug**\r\nCheckov Will flag your code even if the `basic-auth` is already disabled on your cluster.\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\n1. Have a file as follows:\r\n``` \r\nresource \"google_container_cluster\" \"cluster-test\" {\r\n  name     = \"cluster-test\"\r\n  location = \"europe-west1-c\"\r\n  provider = google-beta\r\n\r\n  remove_default_node_pool = true\r\n  initial_node_count       = 1\r\n\r\n  enable_shielded_nodes = true\r\n\r\n  release_channel {\r\n    channel = \"RAPID\"\r\n  }\r\n\r\n  pod_security_policy_config {\r\n    enabled = true\r\n  }\r\n\r\n  master_auth {\r\n    username = \"\"\r\n    password = \"\"\r\n\r\n    client_certificate_config {\r\n      issue_client_certificate = false\r\n    }\r\n  }\r\n}\r\n``` \r\n2. Run cli command  'checkov -d path/to/your/terraform/folder.'\r\n3. See error:\r\n``` \r\nCheck: CKV_GCP_19: \"Ensure GKE basic auth is disabled\"\r\n\tFAILED for resource: google_container_cluster.cluster-test\r\n\tFile: /cluster.tf:1-27\r\n\tGuide: https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_11\r\n\r\n\t\t1  | resource \"google_container_cluster\" \"cluster-test\" {\r\n\t\t2  |   name     = \"cluster-test\"\r\n\t\t3  |   location = \"europe-west1-c\"\r\n\t\t4  |   provider = google-beta\r\n\t\t5  | \r\n\t\t6  |   remove_default_node_pool = true\r\n\t\t7  |   initial_node_count       = 1\r\n\t\t8  | \r\n\t\t9  |   enable_shielded_nodes = true\r\n\t\t10 | \r\n\t\t11 |   release_channel {\r\n\t\t12 |     channel = \"RAPID\"\r\n\t\t13 |   }\r\n\t\t14 | \r\n\t\t15 |   pod_security_policy_config {\r\n\t\t16 |     enabled = true\r\n\t\t17 |   }\r\n\t\t18 | \r\n\t\t19 |   master_auth {\r\n\t\t20 |     username = \"\"\r\n\t\t21 |     password = \"\"\r\n\t\t22 | \r\n\t\t23 |     client_certificate_config {\r\n\t\t24 |       issue_client_certificate = false\r\n\t\t25 |     }\r\n\t\t26 |   }\r\n\t\t27 | }\r\n``` \r\n\r\n**Expected behavior**\r\n``` \r\nCheck: CKV_GCP_19: \"Ensure GKE basic auth is disabled\"\r\n\tPASSED for resource: google_container_cluster.cluster-test\r\n\tFile: /cluster.tf:1-27\r\n\tGuide: https://docs.bridgecrew.io/docs/bc_gcp_kubernetes_7\r\n``` \r\n\r\nThe `basic-auth` is already supposed to be disabled using this bit of code as:\r\n```  \r\n  master_auth {\r\n    username = \"\"\r\n    password = \"\"\r\n\r\n    client_certificate_config {\r\n      issue_client_certificate = false\r\n    }\r\n  }\r\n```\r\n\r\n**Environment:**\r\n - CI: Github Actions \r\n - OS: Ubuntu-lastest\r\n - Checkov Version [latest]\r\n - Terraform v0.12.24\r\n\r\n**Additional context**\r\nTested and installed today following documentation available here: https://www.checkov.io/1.Introduction/Getting%20Started.html\n", "before_files": [{"content": "from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom checkov.common.models.enums import CheckResult, CheckCategories\n\n\nclass GKEBasicAuth(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure GKE basic auth is disabled\"\n        id = \"CKV_GCP_19\"\n        supported_resources = ['google_container_cluster']\n        categories = [CheckCategories.KUBERNETES]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for password configuration at azure_instance:\n            https://www.terraform.io/docs/providers/google/r/compute_ssl_policy.html\n        :param conf: google_compute_ssl_policy configuration\n        :return: <CheckResult>\n        \"\"\"\n        if 'master_auth' in conf.keys():\n            if conf['master_auth'][0].get('username') or conf['master_auth'][0].get('password'):\n                return CheckResult.FAILED\n            return CheckResult.PASSED\n        return CheckResult.FAILED\n\n\ncheck = GKEBasicAuth()\n", "path": "checkov/terraform/checks/resource/gcp/GKEBasicAuth.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass GKEBasicAuth(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure GKE basic auth is disabled\"\n        id = \"CKV_GCP_19\"\n        supported_resources = ['google_container_cluster']\n        categories = [CheckCategories.KUBERNETES]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        \"\"\"\n            Looks for password configuration at azure_instance:\n            https://www.terraform.io/docs/providers/google/r/compute_ssl_policy.html\n        :param conf: google_compute_ssl_policy configuration\n        :return: <CheckResult>\n        \"\"\"\n        if 'master_auth' in conf.keys():\n            username = conf['master_auth'][0].get('username')\n            password = conf['master_auth'][0].get('password')\n            if username or password:\n                # only if both are set to the empty string it is fine\n                # https://www.terraform.io/docs/providers/google/r/container_cluster.html\n                if len(username) == 1 and len(password) == 1 and username[0] == '' and password[0] == '':\n                    return CheckResult.PASSED\n                return CheckResult.FAILED\n            return CheckResult.PASSED\n        return CheckResult.FAILED\n\n\ncheck = GKEBasicAuth()\n", "path": "checkov/terraform/checks/resource/gcp/GKEBasicAuth.py"}]}