prompt: You will be provided with a partial code base and an issue statement explaining a problem to resolve.
  <issue>
  Checkov Managed Disk Encryption check in Bicep IaC failing
  **Describe the issue**
  Checkov Managed Disk Encryption check will fail despite having the required check in Bicep code. It will only be successful if both checks are in the code, but need to be hashed out.
  
  **Examples**
  ```
  resource Disks 'Microsoft.Compute/disks@2022-07-02' = [for (disk, i) in dataDisks: {
    name: disk.diskName
    location: location
    tags: tags
    sku: {
      name: disk.storageAccountType
    }
    zones: [
      avZone
    ]
    properties: {
      creationData: {
        createOption: 'Empty'
      }
      diskSizeGB: disk.diskSizeGB
      // encryption: {
      //   type: 'EncryptionAtRestWithCustomerKey'
      //   diskEncryptionSetId: diskEncryptionSetId
      // }
      encryption: {
        type: 'EncryptionAtRestWithCustomerKey'
        diskEncryptionSetId: diskEncryptionSetId
      }
      // encryptionSettingsCollection: {
      //   enabled: true
      //   encryptionSettings: [
      //     {
      //       diskEncryptionKey: {
      //         secretUrl: keyURL
      //         sourceVault: {
      //           id: keyVaultId
      //         }
      //       }
      //     }
      //   ]
      // }
    }
  }]
  ```
  
  **Version :**
   - Latest
  
  **Additional context**
  Even if I remove the commented out sections, the check will fail. If I have the "encryptionSettingsCollection" block, the check will fail. It will only work if it is formatted like the above.
  
  
  </issue>
  <code>
  [start of checkov/arm/checks/resource/AzureManagedDiscEncryption.py]
  1 from __future__ import annotations
  2 
  3 from typing import Any
  4 
  5 from checkov.common.models.enums import CheckResult, CheckCategories
  6 from checkov.arm.base_resource_check import BaseResourceCheck
  7 
  8 
  9 class AzureManagedDiscEncryption(BaseResourceCheck):
  10     def __init__(self) -> None:
  11         name = "Ensure Azure managed disk have encryption enabled"
  12         id = "CKV_AZURE_2"
  13         supported_resources = ("Microsoft.Compute/disks",)
  14         categories = (CheckCategories.ENCRYPTION,)
  15         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  16 
  17     def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
  18         if "properties" in conf:
  19             if "encryptionSettingsCollection" in conf["properties"]:
  20                 if "enabled" in conf["properties"]["encryptionSettingsCollection"]:
  21                     if str(conf["properties"]["encryptionSettingsCollection"]["enabled"]).lower() == "true":
  22                         return CheckResult.PASSED
  23             elif "encryptionSettings" in conf["properties"]:
  24                 if "enabled" in conf["properties"]["encryptionSettings"]:
  25                     if str(conf["properties"]["encryptionSettings"]["enabled"]).lower() == "true":
  26                         return CheckResult.PASSED
  27         return CheckResult.FAILED
  28 
  29 
  30 check = AzureManagedDiscEncryption()
  31
  [end of checkov/arm/checks/resource/AzureManagedDiscEncryption.py]
  [start of checkov/arm/base_resource_check.py]
  1 from __future__ import annotations
  2 
  3 from abc import abstractmethod
  4 from collections.abc import Iterable
  5 from typing import Any, Callable
  6 
  7 from checkov.arm.registry import arm_resource_registry
  8 from checkov.bicep.checks.resource.registry import registry as bicep_registry
  9 from checkov.common.checks.base_check import BaseCheck
  10 from checkov.common.models.enums import CheckCategories, CheckResult
  11 from checkov.common.multi_signature import multi_signature
  12 
  13 
  14 class BaseResourceCheck(BaseCheck):
  15     def __init__(
  16         self,
  17         name: str,
  18         id: str,
  19         categories: "Iterable[CheckCategories]",
  20         supported_resources: "Iterable[str]",
  21         guideline: str | None = None,
  22     ) -> None:
  23         super().__init__(
  24             name=name,
  25             id=id,
  26             categories=categories,
  27             supported_entities=supported_resources,
  28             block_type="resource",
  29             guideline=guideline,
  30         )
  31         self.supported_resources = supported_resources
  32         arm_resource_registry.register(self)
  33         # leverage ARM checks to use with bicep runner
  34         bicep_registry.register(self)
  35 
  36     def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult:  # type:ignore[override]  # it's ok
  37         self.entity_type = entity_type
  38 
  39         # the "existing" key indicates a Bicep resource
  40         if "existing" in conf:
  41             if conf["existing"] is True:
  42                 # the existing keyword is used to retrieve information about an already deployed resource
  43                 return CheckResult.UNKNOWN
  44 
  45             self.api_version = conf["api_version"]
  46             conf["config"]["apiVersion"] = conf["api_version"]  # set for better reusability of existing ARM checks
  47 
  48             return self.scan_resource_conf(conf["config"], entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation
  49 
  50         self.api_version = None
  51 
  52         return self.scan_resource_conf(conf, entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation
  53 
  54     @multi_signature()
  55     @abstractmethod
  56     def scan_resource_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult:
  57         raise NotImplementedError()
  58 
  59     @classmethod
  60     @scan_resource_conf.add_signature(args=["self", "conf"])
  61     def _scan_resource_conf_self_conf(cls, wrapped: Callable[..., CheckResult]) -> Callable[..., CheckResult]:
  62         def wrapper(self: BaseCheck, conf: dict[str, Any], entity_type: str | None = None) -> CheckResult:
  63             # keep default argument for entity_type so old code, that doesn't set it, will work.
  64             return wrapped(self, conf)
  65 
  66         return wrapper
  67
  [end of checkov/arm/base_resource_check.py]
  </code>
  
  I need you to solve this issue by generating a single patch file that I can apply directly to this repository using git apply. Please respond with a single patch file in the following format.
  <patch>
  diff --git a/file.py b/file.py
  --- a/file.py
  +++ b/file.py
  @@ -1,27 +1,35 @@
   def euclidean(a, b):
  -    while b:
  -        a, b = b, a % b
  -    return a
  +    if b == 0:
  +        return a
  +    return euclidean(b, a % b)
   
   
   def bresenham(x0, y0, x1, y1):
       points = []
       dx = abs(x1 - x0)
       dy = abs(y1 - y0)
  -    sx = 1 if x0 < x1 else -1
  -    sy = 1 if y0 < y1 else -1
  -    err = dx - dy
  +    x, y = x0, y0
  +    sx = -1 if x0 > x1 else 1
  +    sy = -1 if y0 > y1 else 1
   
  -    while True:
  -        points.append((x0, y0))
  -        if x0 == x1 and y0 == y1:
  -            break
  -        e2 = 2 * err
  -        if e2 > -dy:
  -            err -= dy
  -            x0 += sx
  -        if e2 < dx:
  -            err += dx
  -            y0 += sy
  +    if dx > dy:
  +        err = dx / 2.0
  +        while x != x1:
  +            points.append((x, y))
  +            err -= dy
  +            if err < 0:
  +                y += sy
  +                err += dx
  +            x += sx
  +    else:
  +        err = dy / 2.0
  +        while y != y1:
  +            points.append((x, y))
  +            err -= dx
  +            if err < 0:
  +                x += sx
  +                err += dy
  +            y += sy
  +
  +    points.append((x, y))
       return points
  
  </patch>
golden_diff: diff --git a/checkov/arm/base_resource_check.py b/checkov/arm/base_resource_check.py
  --- a/checkov/arm/base_resource_check.py
  +++ b/checkov/arm/base_resource_check.py
  @@ -45,7 +45,12 @@
               self.api_version = conf["api_version"]
               conf["config"]["apiVersion"] = conf["api_version"]  # set for better reusability of existing ARM checks
   
  -            return self.scan_resource_conf(conf["config"], entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation
  +            resource_conf = conf["config"]
  +            if "loop_type" in resource_conf:
  +                # this means the whole resource block is surrounded by a for loop
  +                resource_conf = resource_conf["config"]
  +
  +            return self.scan_resource_conf(resource_conf, entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation
   
           self.api_version = None
   
  diff --git a/checkov/arm/checks/resource/AzureManagedDiscEncryption.py b/checkov/arm/checks/resource/AzureManagedDiscEncryption.py
  --- a/checkov/arm/checks/resource/AzureManagedDiscEncryption.py
  +++ b/checkov/arm/checks/resource/AzureManagedDiscEncryption.py
  @@ -4,6 +4,7 @@
   
   from checkov.common.models.enums import CheckResult, CheckCategories
   from checkov.arm.base_resource_check import BaseResourceCheck
  +from checkov.common.util.data_structures_utils import find_in_dict
   
   
   class AzureManagedDiscEncryption(BaseResourceCheck):
  @@ -15,15 +16,21 @@
           super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
   
       def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
  -        if "properties" in conf:
  -            if "encryptionSettingsCollection" in conf["properties"]:
  -                if "enabled" in conf["properties"]["encryptionSettingsCollection"]:
  -                    if str(conf["properties"]["encryptionSettingsCollection"]["enabled"]).lower() == "true":
  -                        return CheckResult.PASSED
  -            elif "encryptionSettings" in conf["properties"]:
  -                if "enabled" in conf["properties"]["encryptionSettings"]:
  -                    if str(conf["properties"]["encryptionSettings"]["enabled"]).lower() == "true":
  -                        return CheckResult.PASSED
  +        properties = conf.get("properties")
  +        if properties:
  +            encryption = properties.get("encryption")
  +            if encryption:
  +                # if the block exists, then it is enabled
  +                return CheckResult.PASSED
  +
  +            encryption_enabled = find_in_dict(input_dict=properties, key_path="encryptionSettingsCollection/enabled")
  +            if str(encryption_enabled).lower() == "true":
  +                return CheckResult.PASSED
  +
  +            encryption_enabled = find_in_dict(input_dict=properties, key_path="encryptionSettings/enabled")
  +            if str(encryption_enabled).lower() == "true":
  +                return CheckResult.PASSED
  +
           return CheckResult.FAILED
  
verification_info: {"golden_diff": "diff --git a/checkov/arm/base_resource_check.py b/checkov/arm/base_resource_check.py\n--- a/checkov/arm/base_resource_check.py\n+++ b/checkov/arm/base_resource_check.py\n@@ -45,7 +45,12 @@\n             self.api_version = conf[\"api_version\"]\n             conf[\"config\"][\"apiVersion\"] = conf[\"api_version\"]  # set for better reusability of existing ARM checks\n \n-            return self.scan_resource_conf(conf[\"config\"], entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation\n+            resource_conf = conf[\"config\"]\n+            if \"loop_type\" in resource_conf:\n+                # this means the whole resource block is surrounded by a for loop\n+                resource_conf = resource_conf[\"config\"]\n+\n+            return self.scan_resource_conf(resource_conf, entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation\n \n         self.api_version = None\n \ndiff --git a/checkov/arm/checks/resource/AzureManagedDiscEncryption.py b/checkov/arm/checks/resource/AzureManagedDiscEncryption.py\n--- a/checkov/arm/checks/resource/AzureManagedDiscEncryption.py\n+++ b/checkov/arm/checks/resource/AzureManagedDiscEncryption.py\n@@ -4,6 +4,7 @@\n \n from checkov.common.models.enums import CheckResult, CheckCategories\n from checkov.arm.base_resource_check import BaseResourceCheck\n+from checkov.common.util.data_structures_utils import find_in_dict\n \n \n class AzureManagedDiscEncryption(BaseResourceCheck):\n@@ -15,15 +16,21 @@\n         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n \n     def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:\n-        if \"properties\" in conf:\n-            if \"encryptionSettingsCollection\" in conf[\"properties\"]:\n-                if \"enabled\" in conf[\"properties\"][\"encryptionSettingsCollection\"]:\n-                    if str(conf[\"properties\"][\"encryptionSettingsCollection\"][\"enabled\"]).lower() == \"true\":\n-                        return CheckResult.PASSED\n-            elif \"encryptionSettings\" in conf[\"properties\"]:\n-                if \"enabled\" in conf[\"properties\"][\"encryptionSettings\"]:\n-                    if str(conf[\"properties\"][\"encryptionSettings\"][\"enabled\"]).lower() == \"true\":\n-                        return CheckResult.PASSED\n+        properties = conf.get(\"properties\")\n+        if properties:\n+            encryption = properties.get(\"encryption\")\n+            if encryption:\n+                # if the block exists, then it is enabled\n+                return CheckResult.PASSED\n+\n+            encryption_enabled = find_in_dict(input_dict=properties, key_path=\"encryptionSettingsCollection/enabled\")\n+            if str(encryption_enabled).lower() == \"true\":\n+                return CheckResult.PASSED\n+\n+            encryption_enabled = find_in_dict(input_dict=properties, key_path=\"encryptionSettings/enabled\")\n+            if str(encryption_enabled).lower() == \"true\":\n+                return CheckResult.PASSED\n+\n         return CheckResult.FAILED\n", "issue": "Checkov Managed Disk Encryption check in Bicep IaC failing\n**Describe the issue**\r\nCheckov Managed Disk Encryption check will fail despite having the required check in Bicep code. It will only be successful if both checks are in the code, but need to be hashed out.\r\n\r\n**Examples**\r\n```\r\nresource Disks 'Microsoft.Compute/disks@2022-07-02' = [for (disk, i) in dataDisks: {\r\n  name: disk.diskName\r\n  location: location\r\n  tags: tags\r\n  sku: {\r\n    name: disk.storageAccountType\r\n  }\r\n  zones: [\r\n    avZone\r\n  ]\r\n  properties: {\r\n    creationData: {\r\n      createOption: 'Empty'\r\n    }\r\n    diskSizeGB: disk.diskSizeGB\r\n    // encryption: {\r\n    //   type: 'EncryptionAtRestWithCustomerKey'\r\n    //   diskEncryptionSetId: diskEncryptionSetId\r\n    // }\r\n    encryption: {\r\n      type: 'EncryptionAtRestWithCustomerKey'\r\n      diskEncryptionSetId: diskEncryptionSetId\r\n    }\r\n    // encryptionSettingsCollection: {\r\n    //   enabled: true\r\n    //   encryptionSettings: [\r\n    //     {\r\n    //       diskEncryptionKey: {\r\n    //         secretUrl: keyURL\r\n    //         sourceVault: {\r\n    //           id: keyVaultId\r\n    //         }\r\n    //       }\r\n    //     }\r\n    //   ]\r\n    // }\r\n  }\r\n}]\r\n```\r\n\r\n**Version :**\r\n - Latest\r\n\r\n**Additional context**\r\nEven if I remove the commented out sections, the check will fail. If I have the \"encryptionSettingsCollection\" block, the check will fail. It will only work if it is formatted like the above.\r\n\n", "before_files": [{"content": "from __future__ import annotations\n\nfrom typing import Any\n\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.arm.base_resource_check import BaseResourceCheck\n\n\nclass AzureManagedDiscEncryption(BaseResourceCheck):\n    def __init__(self) -> None:\n        name = \"Ensure Azure managed disk have encryption enabled\"\n        id = \"CKV_AZURE_2\"\n        supported_resources = (\"Microsoft.Compute/disks\",)\n        categories = (CheckCategories.ENCRYPTION,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:\n        if \"properties\" in conf:\n            if \"encryptionSettingsCollection\" in conf[\"properties\"]:\n                if \"enabled\" in conf[\"properties\"][\"encryptionSettingsCollection\"]:\n                    if str(conf[\"properties\"][\"encryptionSettingsCollection\"][\"enabled\"]).lower() == \"true\":\n                        return CheckResult.PASSED\n            elif \"encryptionSettings\" in conf[\"properties\"]:\n                if \"enabled\" in conf[\"properties\"][\"encryptionSettings\"]:\n                    if str(conf[\"properties\"][\"encryptionSettings\"][\"enabled\"]).lower() == \"true\":\n                        return CheckResult.PASSED\n        return CheckResult.FAILED\n\n\ncheck = AzureManagedDiscEncryption()\n", "path": "checkov/arm/checks/resource/AzureManagedDiscEncryption.py"}, {"content": "from __future__ import annotations\n\nfrom abc import abstractmethod\nfrom collections.abc import Iterable\nfrom typing import Any, Callable\n\nfrom checkov.arm.registry import arm_resource_registry\nfrom checkov.bicep.checks.resource.registry import registry as bicep_registry\nfrom checkov.common.checks.base_check import BaseCheck\nfrom checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.common.multi_signature import multi_signature\n\n\nclass BaseResourceCheck(BaseCheck):\n    def __init__(\n        self,\n        name: str,\n        id: str,\n        categories: \"Iterable[CheckCategories]\",\n        supported_resources: \"Iterable[str]\",\n        guideline: str | None = None,\n    ) -> None:\n        super().__init__(\n            name=name,\n            id=id,\n            categories=categories,\n            supported_entities=supported_resources,\n            block_type=\"resource\",\n            guideline=guideline,\n        )\n        self.supported_resources = supported_resources\n        arm_resource_registry.register(self)\n        # leverage ARM checks to use with bicep runner\n        bicep_registry.register(self)\n\n    def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult:  # type:ignore[override]  # it's ok\n        self.entity_type = entity_type\n\n        # the \"existing\" key indicates a Bicep resource\n        if \"existing\" in conf:\n            if conf[\"existing\"] is True:\n                # the existing keyword is used to retrieve information about an already deployed resource\n                return CheckResult.UNKNOWN\n\n            self.api_version = conf[\"api_version\"]\n            conf[\"config\"][\"apiVersion\"] = conf[\"api_version\"]  # set for better reusability of existing ARM checks\n\n            return self.scan_resource_conf(conf[\"config\"], entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation\n\n        self.api_version = None\n\n        return self.scan_resource_conf(conf, entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation\n\n    @multi_signature()\n    @abstractmethod\n    def scan_resource_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult:\n        raise NotImplementedError()\n\n    @classmethod\n    @scan_resource_conf.add_signature(args=[\"self\", \"conf\"])\n    def _scan_resource_conf_self_conf(cls, wrapped: Callable[..., CheckResult]) -> Callable[..., CheckResult]:\n        def wrapper(self: BaseCheck, conf: dict[str, Any], entity_type: str | None = None) -> CheckResult:\n            # keep default argument for entity_type so old code, that doesn't set it, will work.\n            return wrapped(self, conf)\n\n        return wrapper\n", "path": "checkov/arm/base_resource_check.py"}]}