We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
CKV_AWS_103 should not trigger for TCP NLB's
Hi!

CKV_AWS_103 throws an error when using an NLB with TCP protocol.
However, setting an `ssl_policy` only make sense for ELB's with protocol HTTPS or TLS.

```
                14 | resource "aws_lb_listener" "nlb_listener_https" {
                15 |   load_balancer_arn = aws_lb.nlb.arn
                16 |   port              = xxxxxxxx
                17 |   protocol          = "TCP"
                18 |   default_action {
                19 |     target_group_arn = aws_lb_target_group.nlb_target_group.id
                20 |     type             = "forward"
                21 |   }
                22 | }
```

`Check: CKV_AWS_103: "Ensure that load balancer is using TLS 1.2"
        FAILED for resource: aws_lb_listener.nlb_listener_https
        File: /nlb.tf:14-22
        Guide: https://docs.bridgecrew.io/docs/bc_aws_general_43`

**Expected behavior**
Check is PASSED instead of FAILED.

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/terraform/checks/resource/aws/AppLoadBalancerTLS12.py`
Content:
```
1 from checkov.common.models.enums import CheckResult, CheckCategories
2 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
3 
4 
5 class AppLoadBalancerTLS12(BaseResourceCheck):
6     def __init__(self):
7         name = "Ensure that load balancer is using TLS 1.2"
8         id = "CKV_AWS_103"
9         supported_resources = ['aws_lb_listener']
10         categories = [CheckCategories.GENERAL_SECURITY]
11         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
12 
13     def scan_resource_conf(self, conf):
14         key="protocol"
15         if key in conf.keys():
16             if conf[key] in (["HTTPS"], ["TLS"]):
17               # Only interested in HTTPS & TLS listeners
18                 policy="ssl_policy"
19                 if policy in conf.keys():
20                   name=str(conf[policy]).strip("['']") 
21                   if name.startswith("ELBSecurityPolicy-FS-1-2") or name.startswith("ELBSecurityPolicy-TLS-1-2"):
22                     return CheckResult.PASSED
23                   else:
24                     return CheckResult.FAILED
25                 else:
26                   return CheckResult.FAILED
27             else:
28                 for action in conf.get('default_action',[]):
29                     for redirect in action.get('redirect',[]):
30                         if redirect.get('protocol',[]) == ["HTTPS"]:
31                             return CheckResult.PASSED
32                 return CheckResult.FAILED
33         else:
34             return CheckResult.FAILED
35 
36 
37 check = AppLoadBalancerTLS12()
38
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/terraform/checks/resource/aws/AppLoadBalancerTLS12.py b/checkov/terraform/checks/resource/aws/AppLoadBalancerTLS12.py
--- a/checkov/terraform/checks/resource/aws/AppLoadBalancerTLS12.py
+++ b/checkov/terraform/checks/resource/aws/AppLoadBalancerTLS12.py
@@ -6,28 +6,35 @@
     def __init__(self):
         name = "Ensure that load balancer is using TLS 1.2"
         id = "CKV_AWS_103"
-        supported_resources = ['aws_lb_listener']
+        supported_resources = ["aws_lb_listener"]
         categories = [CheckCategories.GENERAL_SECURITY]
-        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+        super().__init__(
+            name=name,
+            id=id,
+            categories=categories,
+            supported_resources=supported_resources,
+        )
 
     def scan_resource_conf(self, conf):
-        key="protocol"
+        key = "protocol"
         if key in conf.keys():
             if conf[key] in (["HTTPS"], ["TLS"]):
-              # Only interested in HTTPS & TLS listeners
-                policy="ssl_policy"
+                # Only interested in HTTPS & TLS listeners
+                policy = "ssl_policy"
                 if policy in conf.keys():
-                  name=str(conf[policy]).strip("['']") 
-                  if name.startswith("ELBSecurityPolicy-FS-1-2") or name.startswith("ELBSecurityPolicy-TLS-1-2"):
-                    return CheckResult.PASSED
-                  else:
-                    return CheckResult.FAILED
+                    name = str(conf[policy]).strip("['']")
+                    if name.startswith("ELBSecurityPolicy-FS-1-2") or name.startswith("ELBSecurityPolicy-TLS-1-2"):
+                        return CheckResult.PASSED
+                    else:
+                        return CheckResult.FAILED
                 else:
-                  return CheckResult.FAILED
+                    return CheckResult.FAILED
+            elif conf[key] in (["TCP"], ["UDP"], ["TCP_UDP"]):
+                return CheckResult.PASSED
             else:
-                for action in conf.get('default_action',[]):
-                    for redirect in action.get('redirect',[]):
-                        if redirect.get('protocol',[]) == ["HTTPS"]:
+                for action in conf.get("default_action", []):
+                    for redirect in action.get("redirect", []):
+                        if redirect.get("protocol", []) == ["HTTPS"]:
                             return CheckResult.PASSED
                 return CheckResult.FAILED
         else:

{"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/AppLoadBalancerTLS12.py b/checkov/terraform/checks/resource/aws/AppLoadBalancerTLS12.py\n--- a/checkov/terraform/checks/resource/aws/AppLoadBalancerTLS12.py\n+++ b/checkov/terraform/checks/resource/aws/AppLoadBalancerTLS12.py\n@@ -6,28 +6,35 @@\n     def __init__(self):\n         name = \"Ensure that load balancer is using TLS 1.2\"\n         id = \"CKV_AWS_103\"\n-        supported_resources = ['aws_lb_listener']\n+        supported_resources = [\"aws_lb_listener\"]\n         categories = [CheckCategories.GENERAL_SECURITY]\n-        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n+        super().__init__(\n+            name=name,\n+            id=id,\n+            categories=categories,\n+            supported_resources=supported_resources,\n+        )\n \n     def scan_resource_conf(self, conf):\n-        key=\"protocol\"\n+        key = \"protocol\"\n         if key in conf.keys():\n             if conf[key] in ([\"HTTPS\"], [\"TLS\"]):\n-              # Only interested in HTTPS & TLS listeners\n-                policy=\"ssl_policy\"\n+                # Only interested in HTTPS & TLS listeners\n+                policy = \"ssl_policy\"\n                 if policy in conf.keys():\n-                  name=str(conf[policy]).strip(\"['']\") \n-                  if name.startswith(\"ELBSecurityPolicy-FS-1-2\") or name.startswith(\"ELBSecurityPolicy-TLS-1-2\"):\n-                    return CheckResult.PASSED\n-                  else:\n-                    return CheckResult.FAILED\n+                    name = str(conf[policy]).strip(\"['']\")\n+                    if name.startswith(\"ELBSecurityPolicy-FS-1-2\") or name.startswith(\"ELBSecurityPolicy-TLS-1-2\"):\n+                        return CheckResult.PASSED\n+                    else:\n+                        return CheckResult.FAILED\n                 else:\n-                  return CheckResult.FAILED\n+                    return CheckResult.FAILED\n+            elif conf[key] in ([\"TCP\"], [\"UDP\"], [\"TCP_UDP\"]):\n+                return CheckResult.PASSED\n             else:\n-                for action in conf.get('default_action',[]):\n-                    for redirect in action.get('redirect',[]):\n-                        if redirect.get('protocol',[]) == [\"HTTPS\"]:\n+                for action in conf.get(\"default_action\", []):\n+                    for redirect in action.get(\"redirect\", []):\n+                        if redirect.get(\"protocol\", []) == [\"HTTPS\"]:\n                             return CheckResult.PASSED\n                 return CheckResult.FAILED\n         else:\n", "issue": "CKV_AWS_103 should not trigger for TCP NLB's\nHi!\r\n\r\nCKV_AWS_103 throws an error when using an NLB with TCP protocol.\r\nHowever, setting an `ssl_policy` only make sense for ELB's with protocol HTTPS or TLS.\r\n\r\n```\r\n                14 | resource \"aws_lb_listener\" \"nlb_listener_https\" {\r\n                15 |   load_balancer_arn = aws_lb.nlb.arn\r\n                16 |   port              = xxxxxxxx\r\n                17 |   protocol          = \"TCP\"\r\n                18 |   default_action {\r\n                19 |     target_group_arn = aws_lb_target_group.nlb_target_group.id\r\n                20 |     type             = \"forward\"\r\n                21 |   }\r\n                22 | }\r\n```\r\n\r\n`Check: CKV_AWS_103: \"Ensure that load balancer is using TLS 1.2\"\r\n        FAILED for resource: aws_lb_listener.nlb_listener_https\r\n        File: /nlb.tf:14-22\r\n        Guide: https://docs.bridgecrew.io/docs/bc_aws_general_43`\r\n\r\n**Expected behavior**\r\nCheck is PASSED instead of FAILED.\n", "before_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass AppLoadBalancerTLS12(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure that load balancer is using TLS 1.2\"\n        id = \"CKV_AWS_103\"\n        supported_resources = ['aws_lb_listener']\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        key=\"protocol\"\n        if key in conf.keys():\n            if conf[key] in ([\"HTTPS\"], [\"TLS\"]):\n              # Only interested in HTTPS & TLS listeners\n                policy=\"ssl_policy\"\n                if policy in conf.keys():\n                  name=str(conf[policy]).strip(\"['']\") \n                  if name.startswith(\"ELBSecurityPolicy-FS-1-2\") or name.startswith(\"ELBSecurityPolicy-TLS-1-2\"):\n                    return CheckResult.PASSED\n                  else:\n                    return CheckResult.FAILED\n                else:\n                  return CheckResult.FAILED\n            else:\n                for action in conf.get('default_action',[]):\n                    for redirect in action.get('redirect',[]):\n                        if redirect.get('protocol',[]) == [\"HTTPS\"]:\n                            return CheckResult.PASSED\n                return CheckResult.FAILED\n        else:\n            return CheckResult.FAILED\n\n\ncheck = AppLoadBalancerTLS12()\n", "path": "checkov/terraform/checks/resource/aws/AppLoadBalancerTLS12.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass AppLoadBalancerTLS12(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure that load balancer is using TLS 1.2\"\n        id = \"CKV_AWS_103\"\n        supported_resources = [\"aws_lb_listener\"]\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(\n            name=name,\n            id=id,\n            categories=categories,\n            supported_resources=supported_resources,\n        )\n\n    def scan_resource_conf(self, conf):\n        key = \"protocol\"\n        if key in conf.keys():\n            if conf[key] in ([\"HTTPS\"], [\"TLS\"]):\n                # Only interested in HTTPS & TLS listeners\n                policy = \"ssl_policy\"\n                if policy in conf.keys():\n                    name = str(conf[policy]).strip(\"['']\")\n                    if name.startswith(\"ELBSecurityPolicy-FS-1-2\") or name.startswith(\"ELBSecurityPolicy-TLS-1-2\"):\n                        return CheckResult.PASSED\n                    else:\n                        return CheckResult.FAILED\n                else:\n                    return CheckResult.FAILED\n            elif conf[key] in ([\"TCP\"], [\"UDP\"], [\"TCP_UDP\"]):\n                return CheckResult.PASSED\n            else:\n                for action in conf.get(\"default_action\", []):\n                    for redirect in action.get(\"redirect\", []):\n                        if redirect.get(\"protocol\", []) == [\"HTTPS\"]:\n                            return CheckResult.PASSED\n                return CheckResult.FAILED\n        else:\n            return CheckResult.FAILED\n\n\ncheck = AppLoadBalancerTLS12()\n", "path": "checkov/terraform/checks/resource/aws/AppLoadBalancerTLS12.py"}]}