prompt: You will be provided with a partial code base and an issue statement explaining a problem to resolve.
  <issue>
  False positive for check 'MSKClusterEncryption' (CKV_AWS_81)
  **Describe the bug**
  CKV_AWS_81 is reporting MSK clusters as unencrypted at rest while they are encrypted at rest.
  
  **To Reproduce**
  Example Terraform code producing a cluster with encryption (it will use the default KMS key as documented in https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/msk_cluster#encryption_at_rest_kms_key_arn)
  
  (slightly adapted from example on the msk_cluster resource docs)
  <details>
    <summary>Code</summary>
  
  ```
  resource "aws_vpc" "vpc" {
    cidr_block = "192.168.0.0/22"
  }
  
  data "aws_availability_zones" "azs" {
    state = "available"
  }
  
  resource "aws_subnet" "subnet_az1" {
    availability_zone = data.aws_availability_zones.azs.names[0]
    cidr_block        = "192.168.0.0/24"
    vpc_id            = aws_vpc.vpc.id
  }
  
  resource "aws_subnet" "subnet_az2" {
    availability_zone = data.aws_availability_zones.azs.names[1]
    cidr_block        = "192.168.1.0/24"
    vpc_id            = aws_vpc.vpc.id
  }
  
  resource "aws_subnet" "subnet_az3" {
    availability_zone = data.aws_availability_zones.azs.names[2]
    cidr_block        = "192.168.2.0/24"
    vpc_id            = aws_vpc.vpc.id
  }
  
  resource "aws_security_group" "sg" {
    vpc_id = aws_vpc.vpc.id
  }
  
  resource "aws_kms_key" "kms" {
    description = "example"
  }
  
  resource "aws_cloudwatch_log_group" "test" {
    name = "msk_broker_logs"
  }
  
  resource "aws_s3_bucket" "bucket" {
    bucket = "msk-broker-logs-bucket"
    acl    = "private"
  }
  
  resource "aws_iam_role" "firehose_role" {
    name = "firehose_test_role"
  
    assume_role_policy = <<EOF
  {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "firehose.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
    ]
  }
  EOF
  }
  
  resource "aws_kinesis_firehose_delivery_stream" "test_stream" {
    name        = "terraform-kinesis-firehose-msk-broker-logs-stream"
    destination = "s3"
  
    s3_configuration {
      role_arn   = aws_iam_role.firehose_role.arn
      bucket_arn = aws_s3_bucket.bucket.arn
    }
  
    tags = {
      LogDeliveryEnabled = "placeholder"
    }
  
    lifecycle {
      ignore_changes = [
        tags["LogDeliveryEnabled"],
      ]
    }
  }
  
  resource "aws_msk_cluster" "example" {
    cluster_name           = "example"
    kafka_version          = "2.4.1"
    number_of_broker_nodes = 3
  
    broker_node_group_info {
      instance_type   = "kafka.m5.large"
      ebs_volume_size = 1000
      client_subnets = [
        aws_subnet.subnet_az1.id,
        aws_subnet.subnet_az2.id,
        aws_subnet.subnet_az3.id,
      ]
      security_groups = [aws_security_group.sg.id]
    }
  
    encryption_info {
      encryption_in_transit {                                                                                                                                        
        client_broker = "TLS"
        in_cluster    = true                                                                                                                                         
      }
    }
  
    open_monitoring {
      prometheus {
        jmx_exporter {
          enabled_in_broker = true
        }
        node_exporter {
          enabled_in_broker = true
        }
      }
    }
  
    logging_info {
      broker_logs {
        cloudwatch_logs {
          enabled   = true
          log_group = aws_cloudwatch_log_group.test.name
        }
        firehose {
          enabled         = true
          delivery_stream = aws_kinesis_firehose_delivery_stream.test_stream.name
        }
        s3 {
          enabled = true
          bucket  = aws_s3_bucket.bucket.id
          prefix  = "logs/msk-"
        }
      }
    }
  
    tags = {
      foo = "bar"
    }
  }
  
  output "zookeeper_connect_string" {
    value = aws_msk_cluster.example.zookeeper_connect_string
  }
  
  output "bootstrap_brokers_tls" {
    description = "TLS connection host:port pairs"
    value       = aws_msk_cluster.example.bootstrap_brokers_tls
  }
  ```
  
  </details>
  
  **Expected behavior**
  No error is thrown as long as an encryption_info block is defined
  
  
   Checkov Version 1.0.669
  
  
  </issue>
  <code>
  [start of checkov/terraform/checks/resource/aws/MSKClusterEncryption.py]
  1 from checkov.common.models.enums import CheckResult, CheckCategories
  2 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
  3 
  4 
  5 class MSKClusterEncryption(BaseResourceCheck):
  6     def __init__(self):
  7         name = "Ensure MSK Cluster encryption in rest and transit is enabled"
  8         id = "CKV_AWS_81"
  9         supported_resources = ['aws_msk_cluster']
  10         categories = [CheckCategories.ENCRYPTION]
  11         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  12 
  13     def scan_resource_conf(self, conf):
  14         if 'encryption_info' in conf.keys():
  15             encryption = conf['encryption_info'][0]
  16             if 'encryption_at_rest_kms_key_arn' in encryption:
  17                 if 'encryption_in_transit' in encryption:
  18                     transit = encryption['encryption_in_transit'][0]
  19                     if 'client_broker' in transit and transit['client_broker'][0] != 'TLS' or \
  20                             'in_cluster' in transit and transit['in_cluster'][0] is False:
  21                         return CheckResult.FAILED
  22                     return CheckResult.PASSED
  23                 return CheckResult.PASSED
  24         return CheckResult.FAILED
  25 
  26 
  27 check = MSKClusterEncryption()
  28
  [end of checkov/terraform/checks/resource/aws/MSKClusterEncryption.py]
  </code>
  
  I need you to solve this issue by generating a single patch file that I can apply directly to this repository using git apply. Please respond with a single patch file in the following format.
  <patch>
  diff --git a/file.py b/file.py
  --- a/file.py
  +++ b/file.py
  @@ -1,27 +1,35 @@
   def euclidean(a, b):
  -    while b:
  -        a, b = b, a % b
  -    return a
  +    if b == 0:
  +        return a
  +    return euclidean(b, a % b)
   
   
   def bresenham(x0, y0, x1, y1):
       points = []
       dx = abs(x1 - x0)
       dy = abs(y1 - y0)
  -    sx = 1 if x0 < x1 else -1
  -    sy = 1 if y0 < y1 else -1
  -    err = dx - dy
  +    x, y = x0, y0
  +    sx = -1 if x0 > x1 else 1
  +    sy = -1 if y0 > y1 else 1
   
  -    while True:
  -        points.append((x0, y0))
  -        if x0 == x1 and y0 == y1:
  -            break
  -        e2 = 2 * err
  -        if e2 > -dy:
  -            err -= dy
  -            x0 += sx
  -        if e2 < dx:
  -            err += dx
  -            y0 += sy
  +    if dx > dy:
  +        err = dx / 2.0
  +        while x != x1:
  +            points.append((x, y))
  +            err -= dy
  +            if err < 0:
  +                y += sy
  +                err += dx
  +            x += sx
  +    else:
  +        err = dy / 2.0
  +        while y != y1:
  +            points.append((x, y))
  +            err -= dx
  +            if err < 0:
  +                x += sx
  +                err += dy
  +            y += sy
  +
  +    points.append((x, y))
       return points
  
  </patch>
golden_diff: diff --git a/checkov/terraform/checks/resource/aws/MSKClusterEncryption.py b/checkov/terraform/checks/resource/aws/MSKClusterEncryption.py
  --- a/checkov/terraform/checks/resource/aws/MSKClusterEncryption.py
  +++ b/checkov/terraform/checks/resource/aws/MSKClusterEncryption.py
  @@ -11,16 +11,18 @@
           super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
   
       def scan_resource_conf(self, conf):
  +        # Note: As long as the 'encryption_info' block is specified, the cluster
  +        # will be encrypted at rest even if 'encryption_at_rest_kms_key_arn' is not specified
  +        # See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/msk_cluster#encryption_at_rest_kms_key_arn
           if 'encryption_info' in conf.keys():
               encryption = conf['encryption_info'][0]
  -            if 'encryption_at_rest_kms_key_arn' in encryption:
  -                if 'encryption_in_transit' in encryption:
  -                    transit = encryption['encryption_in_transit'][0]
  -                    if 'client_broker' in transit and transit['client_broker'][0] != 'TLS' or \
  -                            'in_cluster' in transit and transit['in_cluster'][0] is False:
  -                        return CheckResult.FAILED
  -                    return CheckResult.PASSED
  +            if 'encryption_in_transit' in encryption:
  +                transit = encryption['encryption_in_transit'][0]
  +                if 'client_broker' in transit and transit['client_broker'][0] != 'TLS' or \
  +                        'in_cluster' in transit and transit['in_cluster'][0] is False:
  +                    return CheckResult.FAILED
                   return CheckResult.PASSED
  +            return CheckResult.PASSED
           return CheckResult.FAILED
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/MSKClusterEncryption.py b/checkov/terraform/checks/resource/aws/MSKClusterEncryption.py\n--- a/checkov/terraform/checks/resource/aws/MSKClusterEncryption.py\n+++ b/checkov/terraform/checks/resource/aws/MSKClusterEncryption.py\n@@ -11,16 +11,18 @@\n         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n \n     def scan_resource_conf(self, conf):\n+        # Note: As long as the 'encryption_info' block is specified, the cluster\n+        # will be encrypted at rest even if 'encryption_at_rest_kms_key_arn' is not specified\n+        # See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/msk_cluster#encryption_at_rest_kms_key_arn\n         if 'encryption_info' in conf.keys():\n             encryption = conf['encryption_info'][0]\n-            if 'encryption_at_rest_kms_key_arn' in encryption:\n-                if 'encryption_in_transit' in encryption:\n-                    transit = encryption['encryption_in_transit'][0]\n-                    if 'client_broker' in transit and transit['client_broker'][0] != 'TLS' or \\\n-                            'in_cluster' in transit and transit['in_cluster'][0] is False:\n-                        return CheckResult.FAILED\n-                    return CheckResult.PASSED\n+            if 'encryption_in_transit' in encryption:\n+                transit = encryption['encryption_in_transit'][0]\n+                if 'client_broker' in transit and transit['client_broker'][0] != 'TLS' or \\\n+                        'in_cluster' in transit and transit['in_cluster'][0] is False:\n+                    return CheckResult.FAILED\n                 return CheckResult.PASSED\n+            return CheckResult.PASSED\n         return CheckResult.FAILED\n", "issue": "False positive for check 'MSKClusterEncryption' (CKV_AWS_81)\n**Describe the bug**\r\nCKV_AWS_81 is reporting MSK clusters as unencrypted at rest while they are encrypted at rest.\r\n\r\n**To Reproduce**\r\nExample Terraform code producing a cluster with encryption (it will use the default KMS key as documented in https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/msk_cluster#encryption_at_rest_kms_key_arn)\r\n\r\n(slightly adapted from example on the msk_cluster resource docs)\r\n<details>\r\n  <summary>Code</summary>\r\n\r\n```\r\nresource \"aws_vpc\" \"vpc\" {\r\n  cidr_block = \"192.168.0.0/22\"\r\n}\r\n\r\ndata \"aws_availability_zones\" \"azs\" {\r\n  state = \"available\"\r\n}\r\n\r\nresource \"aws_subnet\" \"subnet_az1\" {\r\n  availability_zone = data.aws_availability_zones.azs.names[0]\r\n  cidr_block        = \"192.168.0.0/24\"\r\n  vpc_id            = aws_vpc.vpc.id\r\n}\r\n\r\nresource \"aws_subnet\" \"subnet_az2\" {\r\n  availability_zone = data.aws_availability_zones.azs.names[1]\r\n  cidr_block        = \"192.168.1.0/24\"\r\n  vpc_id            = aws_vpc.vpc.id\r\n}\r\n\r\nresource \"aws_subnet\" \"subnet_az3\" {\r\n  availability_zone = data.aws_availability_zones.azs.names[2]\r\n  cidr_block        = \"192.168.2.0/24\"\r\n  vpc_id            = aws_vpc.vpc.id\r\n}\r\n\r\nresource \"aws_security_group\" \"sg\" {\r\n  vpc_id = aws_vpc.vpc.id\r\n}\r\n\r\nresource \"aws_kms_key\" \"kms\" {\r\n  description = \"example\"\r\n}\r\n\r\nresource \"aws_cloudwatch_log_group\" \"test\" {\r\n  name = \"msk_broker_logs\"\r\n}\r\n\r\nresource \"aws_s3_bucket\" \"bucket\" {\r\n  bucket = \"msk-broker-logs-bucket\"\r\n  acl    = \"private\"\r\n}\r\n\r\nresource \"aws_iam_role\" \"firehose_role\" {\r\n  name = \"firehose_test_role\"\r\n\r\n  assume_role_policy = <<EOF\r\n{\r\n\"Version\": \"2012-10-17\",\r\n\"Statement\": [\r\n  {\r\n    \"Action\": \"sts:AssumeRole\",\r\n    \"Principal\": {\r\n      \"Service\": \"firehose.amazonaws.com\"\r\n    },\r\n    \"Effect\": \"Allow\",\r\n    \"Sid\": \"\"\r\n  }\r\n  ]\r\n}\r\nEOF\r\n}\r\n\r\nresource \"aws_kinesis_firehose_delivery_stream\" \"test_stream\" {\r\n  name        = \"terraform-kinesis-firehose-msk-broker-logs-stream\"\r\n  destination = \"s3\"\r\n\r\n  s3_configuration {\r\n    role_arn   = aws_iam_role.firehose_role.arn\r\n    bucket_arn = aws_s3_bucket.bucket.arn\r\n  }\r\n\r\n  tags = {\r\n    LogDeliveryEnabled = \"placeholder\"\r\n  }\r\n\r\n  lifecycle {\r\n    ignore_changes = [\r\n      tags[\"LogDeliveryEnabled\"],\r\n    ]\r\n  }\r\n}\r\n\r\nresource \"aws_msk_cluster\" \"example\" {\r\n  cluster_name           = \"example\"\r\n  kafka_version          = \"2.4.1\"\r\n  number_of_broker_nodes = 3\r\n\r\n  broker_node_group_info {\r\n    instance_type   = \"kafka.m5.large\"\r\n    ebs_volume_size = 1000\r\n    client_subnets = [\r\n      aws_subnet.subnet_az1.id,\r\n      aws_subnet.subnet_az2.id,\r\n      aws_subnet.subnet_az3.id,\r\n    ]\r\n    security_groups = [aws_security_group.sg.id]\r\n  }\r\n\r\n  encryption_info {\r\n    encryption_in_transit {                                                                                                                                        \r\n      client_broker = \"TLS\"\r\n      in_cluster    = true                                                                                                                                         \r\n    }\r\n  }\r\n\r\n  open_monitoring {\r\n    prometheus {\r\n      jmx_exporter {\r\n        enabled_in_broker = true\r\n      }\r\n      node_exporter {\r\n        enabled_in_broker = true\r\n      }\r\n    }\r\n  }\r\n\r\n  logging_info {\r\n    broker_logs {\r\n      cloudwatch_logs {\r\n        enabled   = true\r\n        log_group = aws_cloudwatch_log_group.test.name\r\n      }\r\n      firehose {\r\n        enabled         = true\r\n        delivery_stream = aws_kinesis_firehose_delivery_stream.test_stream.name\r\n      }\r\n      s3 {\r\n        enabled = true\r\n        bucket  = aws_s3_bucket.bucket.id\r\n        prefix  = \"logs/msk-\"\r\n      }\r\n    }\r\n  }\r\n\r\n  tags = {\r\n    foo = \"bar\"\r\n  }\r\n}\r\n\r\noutput \"zookeeper_connect_string\" {\r\n  value = aws_msk_cluster.example.zookeeper_connect_string\r\n}\r\n\r\noutput \"bootstrap_brokers_tls\" {\r\n  description = \"TLS connection host:port pairs\"\r\n  value       = aws_msk_cluster.example.bootstrap_brokers_tls\r\n}\r\n```\r\n\r\n</details>\r\n\r\n**Expected behavior**\r\nNo error is thrown as long as an encryption_info block is defined\r\n\r\n\r\n Checkov Version 1.0.669\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass MSKClusterEncryption(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure MSK Cluster encryption in rest and transit is enabled\"\n        id = \"CKV_AWS_81\"\n        supported_resources = ['aws_msk_cluster']\n        categories = [CheckCategories.ENCRYPTION]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if 'encryption_info' in conf.keys():\n            encryption = conf['encryption_info'][0]\n            if 'encryption_at_rest_kms_key_arn' in encryption:\n                if 'encryption_in_transit' in encryption:\n                    transit = encryption['encryption_in_transit'][0]\n                    if 'client_broker' in transit and transit['client_broker'][0] != 'TLS' or \\\n                            'in_cluster' in transit and transit['in_cluster'][0] is False:\n                        return CheckResult.FAILED\n                    return CheckResult.PASSED\n                return CheckResult.PASSED\n        return CheckResult.FAILED\n\n\ncheck = MSKClusterEncryption()\n", "path": "checkov/terraform/checks/resource/aws/MSKClusterEncryption.py"}]}