We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Checks IDs changing
Hi Team,

would like to request the check IDs do not get changed since we allowlist some checks which we run in our environment.
Eg : https://docs.bridgecrew.io/docs/bc_aws_iam_45 Check ID says CKV_AWS_61

whereas code is different for CKV_AWS_61.
Thanks!


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py`
Content:
```
1 import re
2 
3 from checkov.common.models.enums import CheckResult, CheckCategories
4 from checkov.common.util.type_forcers import extract_policy_dict
5 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
6 from typing import List
7 
8 
9 class IAMRoleAllowAssumeFromAccount(BaseResourceCheck):
10 
11     def __init__(self):
12         name = "Ensure IAM role allows only specific principals in account to assume it"
13         id = "CKV_AWS_61"
14         supported_resources = ['aws_iam_role']
15         categories = [CheckCategories.IAM]
16         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
17 
18     def scan_resource_conf(self, conf):
19         try:
20             assume_role_block = extract_policy_dict(conf['assume_role_policy'][0])
21             if assume_role_block and 'Statement' in assume_role_block.keys() \
22                     and 'Principal' in assume_role_block['Statement'][0] \
23                     and 'AWS' in assume_role_block['Statement'][0]['Principal']:
24                 account_access = re.compile(r'\d{12}|arn:aws:iam::\d{12}:root')
25                 if re.match(account_access, assume_role_block['Statement'][0]['Principal']['AWS']):
26                     return CheckResult.FAILED
27         except Exception:  # nosec
28             pass
29         return CheckResult.PASSED
30 
31     def get_evaluated_keys(self) -> List[str]:
32         return ['assume_role_policy']
33 
34 
35 check = IAMRoleAllowAssumeFromAccount()
36
```

Path: `checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py`
Content:
```
1 import json
2 import re
3 
4 from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck
5 from checkov.common.models.enums import CheckResult, CheckCategories
6 
7 ACCOUNT_ACCESS = re.compile(r'\d{12}|arn:aws:iam::\d{12}:root')
8 
9 class IAMRoleAllowAssumeFromAccount(BaseResourceCheck):
10     def __init__(self):
11         name = "Ensure IAM role allows only specific principals in account to assume it"
12         id = "CKV_AWS_61"
13         supported_resources = ['AWS::IAM::Role']
14         categories = [CheckCategories.IAM]
15         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
16 
17     def scan_resource_conf(self, conf):
18         if 'AssumeRolePolicyDocument' in conf['Properties']:
19             assume_role_policy_doc = conf['Properties']['AssumeRolePolicyDocument']
20             if isinstance(assume_role_policy_doc, dict) and 'Fn::Sub' in assume_role_policy_doc.keys():
21                 policy_fn_sub_block = assume_role_policy_doc['Fn::Sub']
22                 if isinstance(policy_fn_sub_block, list) and len(policy_fn_sub_block) == 2:
23                     assume_role_block = json.loads(policy_fn_sub_block[0])
24                 else:
25                     assume_role_block = json.loads(policy_fn_sub_block)
26             elif isinstance(assume_role_policy_doc, str):
27                 assume_role_block = json.loads(assume_role_policy_doc)
28             else:
29                 assume_role_block = assume_role_policy_doc
30         else:
31             return CheckResult.UNKNOWN
32 
33         if 'Statement' in assume_role_block.keys():
34             if isinstance(assume_role_block['Statement'], list) and 'Principal' in \
35                     assume_role_block['Statement'][0]:
36                 if 'AWS' in assume_role_block['Statement'][0]['Principal']:
37                     if isinstance(assume_role_block['Statement'][0]['Principal']['AWS'],list) \
38                             and isinstance(assume_role_block['Statement'][0]['Principal']['AWS'][0], str):
39                         if re.match(ACCOUNT_ACCESS, assume_role_block['Statement'][0]['Principal']['AWS'][0]):
40                             return CheckResult.FAILED
41 
42             return CheckResult.PASSED
43 
44 
45 check = IAMRoleAllowAssumeFromAccount()
46
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py b/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py
--- a/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py
+++ b/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py
@@ -8,7 +8,7 @@
 
 class IAMRoleAllowAssumeFromAccount(BaseResourceCheck):
     def __init__(self):
-        name = "Ensure IAM role allows only specific principals in account to assume it"
+        name = "Ensure AWS IAM policy does not allow assume role permission across all services"
         id = "CKV_AWS_61"
         supported_resources = ['AWS::IAM::Role']
         categories = [CheckCategories.IAM]
diff --git a/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py b/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py
--- a/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py
+++ b/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py
@@ -9,7 +9,7 @@
 class IAMRoleAllowAssumeFromAccount(BaseResourceCheck):
 
     def __init__(self):
-        name = "Ensure IAM role allows only specific principals in account to assume it"
+        name = "Ensure AWS IAM policy does not allow assume role permission across all services"
         id = "CKV_AWS_61"
         supported_resources = ['aws_iam_role']
         categories = [CheckCategories.IAM]

{"golden_diff": "diff --git a/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py b/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py\n--- a/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py\n+++ b/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py\n@@ -8,7 +8,7 @@\n \n class IAMRoleAllowAssumeFromAccount(BaseResourceCheck):\n     def __init__(self):\n-        name = \"Ensure IAM role allows only specific principals in account to assume it\"\n+        name = \"Ensure AWS IAM policy does not allow assume role permission across all services\"\n         id = \"CKV_AWS_61\"\n         supported_resources = ['AWS::IAM::Role']\n         categories = [CheckCategories.IAM]\ndiff --git a/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py b/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py\n--- a/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py\n+++ b/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py\n@@ -9,7 +9,7 @@\n class IAMRoleAllowAssumeFromAccount(BaseResourceCheck):\n \n     def __init__(self):\n-        name = \"Ensure IAM role allows only specific principals in account to assume it\"\n+        name = \"Ensure AWS IAM policy does not allow assume role permission across all services\"\n         id = \"CKV_AWS_61\"\n         supported_resources = ['aws_iam_role']\n         categories = [CheckCategories.IAM]\n", "issue": "Checks IDs changing\nHi Team,\r\n\r\nwould like to request the check IDs do not get changed since we allowlist some checks which we run in our environment.\r\nEg : https://docs.bridgecrew.io/docs/bc_aws_iam_45 Check ID says CKV_AWS_61\r\n\r\nwhereas code is different for CKV_AWS_61.\r\nThanks!\r\n\n", "before_files": [{"content": "import re\n\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.common.util.type_forcers import extract_policy_dict\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom typing import List\n\n\nclass IAMRoleAllowAssumeFromAccount(BaseResourceCheck):\n\n    def __init__(self):\n        name = \"Ensure IAM role allows only specific principals in account to assume it\"\n        id = \"CKV_AWS_61\"\n        supported_resources = ['aws_iam_role']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        try:\n            assume_role_block = extract_policy_dict(conf['assume_role_policy'][0])\n            if assume_role_block and 'Statement' in assume_role_block.keys() \\\n                    and 'Principal' in assume_role_block['Statement'][0] \\\n                    and 'AWS' in assume_role_block['Statement'][0]['Principal']:\n                account_access = re.compile(r'\\d{12}|arn:aws:iam::\\d{12}:root')\n                if re.match(account_access, assume_role_block['Statement'][0]['Principal']['AWS']):\n                    return CheckResult.FAILED\n        except Exception:  # nosec\n            pass\n        return CheckResult.PASSED\n\n    def get_evaluated_keys(self) -> List[str]:\n        return ['assume_role_policy']\n\n\ncheck = IAMRoleAllowAssumeFromAccount()\n", "path": "checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py"}, {"content": "import json\nimport re\n\nfrom checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck\nfrom checkov.common.models.enums import CheckResult, CheckCategories\n\nACCOUNT_ACCESS = re.compile(r'\\d{12}|arn:aws:iam::\\d{12}:root')\n\nclass IAMRoleAllowAssumeFromAccount(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure IAM role allows only specific principals in account to assume it\"\n        id = \"CKV_AWS_61\"\n        supported_resources = ['AWS::IAM::Role']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if 'AssumeRolePolicyDocument' in conf['Properties']:\n            assume_role_policy_doc = conf['Properties']['AssumeRolePolicyDocument']\n            if isinstance(assume_role_policy_doc, dict) and 'Fn::Sub' in assume_role_policy_doc.keys():\n                policy_fn_sub_block = assume_role_policy_doc['Fn::Sub']\n                if isinstance(policy_fn_sub_block, list) and len(policy_fn_sub_block) == 2:\n                    assume_role_block = json.loads(policy_fn_sub_block[0])\n                else:\n                    assume_role_block = json.loads(policy_fn_sub_block)\n            elif isinstance(assume_role_policy_doc, str):\n                assume_role_block = json.loads(assume_role_policy_doc)\n            else:\n                assume_role_block = assume_role_policy_doc\n        else:\n            return CheckResult.UNKNOWN\n\n        if 'Statement' in assume_role_block.keys():\n            if isinstance(assume_role_block['Statement'], list) and 'Principal' in \\\n                    assume_role_block['Statement'][0]:\n                if 'AWS' in assume_role_block['Statement'][0]['Principal']:\n                    if isinstance(assume_role_block['Statement'][0]['Principal']['AWS'],list) \\\n                            and isinstance(assume_role_block['Statement'][0]['Principal']['AWS'][0], str):\n                        if re.match(ACCOUNT_ACCESS, assume_role_block['Statement'][0]['Principal']['AWS'][0]):\n                            return CheckResult.FAILED\n\n            return CheckResult.PASSED\n\n\ncheck = IAMRoleAllowAssumeFromAccount()\n", "path": "checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py"}], "after_files": [{"content": "import re\n\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.common.util.type_forcers import extract_policy_dict\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\nfrom typing import List\n\n\nclass IAMRoleAllowAssumeFromAccount(BaseResourceCheck):\n\n    def __init__(self):\n        name = \"Ensure AWS IAM policy does not allow assume role permission across all services\"\n        id = \"CKV_AWS_61\"\n        supported_resources = ['aws_iam_role']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        try:\n            assume_role_block = extract_policy_dict(conf['assume_role_policy'][0])\n            if assume_role_block and 'Statement' in assume_role_block.keys() \\\n                    and 'Principal' in assume_role_block['Statement'][0] \\\n                    and 'AWS' in assume_role_block['Statement'][0]['Principal']:\n                account_access = re.compile(r'\\d{12}|arn:aws:iam::\\d{12}:root')\n                if re.match(account_access, assume_role_block['Statement'][0]['Principal']['AWS']):\n                    return CheckResult.FAILED\n        except Exception:  # nosec\n            pass\n        return CheckResult.PASSED\n\n    def get_evaluated_keys(self) -> List[str]:\n        return ['assume_role_policy']\n\n\ncheck = IAMRoleAllowAssumeFromAccount()\n", "path": "checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py"}, {"content": "import json\nimport re\n\nfrom checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck\nfrom checkov.common.models.enums import CheckResult, CheckCategories\n\nACCOUNT_ACCESS = re.compile(r'\\d{12}|arn:aws:iam::\\d{12}:root')\n\nclass IAMRoleAllowAssumeFromAccount(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure AWS IAM policy does not allow assume role permission across all services\"\n        id = \"CKV_AWS_61\"\n        supported_resources = ['AWS::IAM::Role']\n        categories = [CheckCategories.IAM]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if 'AssumeRolePolicyDocument' in conf['Properties']:\n            assume_role_policy_doc = conf['Properties']['AssumeRolePolicyDocument']\n            if isinstance(assume_role_policy_doc, dict) and 'Fn::Sub' in assume_role_policy_doc.keys():\n                policy_fn_sub_block = assume_role_policy_doc['Fn::Sub']\n                if isinstance(policy_fn_sub_block, list) and len(policy_fn_sub_block) == 2:\n                    assume_role_block = json.loads(policy_fn_sub_block[0])\n                else:\n                    assume_role_block = json.loads(policy_fn_sub_block)\n            elif isinstance(assume_role_policy_doc, str):\n                assume_role_block = json.loads(assume_role_policy_doc)\n            else:\n                assume_role_block = assume_role_policy_doc\n        else:\n            return CheckResult.UNKNOWN\n\n        if 'Statement' in assume_role_block.keys():\n            if isinstance(assume_role_block['Statement'], list) and 'Principal' in \\\n                    assume_role_block['Statement'][0]:\n                if 'AWS' in assume_role_block['Statement'][0]['Principal']:\n                    if isinstance(assume_role_block['Statement'][0]['Principal']['AWS'],list) \\\n                            and isinstance(assume_role_block['Statement'][0]['Principal']['AWS'][0], str):\n                        if re.match(ACCOUNT_ACCESS, assume_role_block['Statement'][0]['Principal']['AWS'][0]):\n                            return CheckResult.FAILED\n\n            return CheckResult.PASSED\n\n\ncheck = IAMRoleAllowAssumeFromAccount()\n", "path": "checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py"}]}