feat: checks for awscc provider resources

[quixoticmonk]

User description

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

The PR intends to add support checks for a few resources in the AWSCC resource list

New/Edited policies (Delete if not relevant)

Description

Include a description of what makes it a violation and any relevant external links.

Fix

How does someone fix the issue in code and/or in runtime?

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my feature, policy, or fix is effective and works
• New and existing tests pass locally with my changes

---

Generated description

Below is a concise technical summary of the changes proposed in this PR:

Topic	Details
Test Coverage	Adds comprehensive test cases and example configurations for all new AWSCC checks, ensuring robustness and accuracy Modified files (16) tests/terraform/checks/resource/awscc/test_KMSKeyIsEnabled.py tests/terraform/checks/resource/awscc/test_KMSRotation.py tests/terraform/checks/resource/awscc/test_CloudtrailLogValidation.py tests/terraform/checks/resource/awscc/test_SubnetPublicIP.py tests/terraform/checks/resource/awscc/test_SNSTopicEncryption.py tests/terraform/checks/resource/awscc/test_BedrockGuardrails.py tests/terraform/checks/resource/awscc/test_BackupVaultEncrypted.py tests/terraform/checks/resource/awscc/test_BedrockAgentEncrypted.py tests/terraform/checks/resource/awscc/example_SubnetPublicIp/main.tf tests/terraform/checks/resource/awscc/example_BackupVaultEncrypted/main.tf tests/terraform/checks/resource/awscc/example_KMSRotation/main.tf tests/terraform/checks/resource/awscc/example_BedrockAgentEncrypted/main.tf tests/terraform/checks/resource/awscc/example_CloudtrailLogValidation/main.tf tests/terraform/checks/resource/awscc/example_SNSTopicEncryption/main.tf tests/terraform/checks/resource/awscc/example_KMSKeyIsEnabled/main.tf tests/terraform/checks/resource/awscc/example_BedrockGuardrails/main.tf Latest Contributors(0) User Commit Date
AWSCC Security Checks	Implements new security and compliance checks for AWSCC provider resources across multiple AWS services Modified files (9) checkov/terraform/checks/resource/awscc/BedrockAgentEncrypted.py checkov/terraform/checks/resource/awscc/KMSKeyIsEnabled.py checkov/terraform/checks/resource/awscc/KMSRotation.py checkov/terraform/checks/resource/awscc/CloudtrailLogValidation.py checkov/terraform/checks/resource/awscc/SubnetPublicIP.py checkov/terraform/checks/resource/awscc/SNSTopicEncryption.py checkov/terraform/checks/resource/awscc/BackupVaultEncrypted.py checkov/terraform/checks/resource/awscc/BedrockGuardrails.py checkov/terraform/checks/resource/awscc/__init__.py Latest Contributors(0) User Commit Date

This pull request is reviewed by Baz. Join @quixoticmonk and the rest of your team on (Baz).

[quixoticmonk]

The individual tests run locally.

pipenv run python -m coverage run -m pytest tests/terraform/checks/resource/awscc
========================================================================================= test session starts =========================================================================================
platform darwin -- Python 3.8.19, pytest-7.4.4, pluggy-1.5.0
rootdir: /Users/manuchn/Documents/2025/TFC/Hashi/experiments/checkov
configfile: pyproject.toml
plugins: asyncio-0.23.8, cov-5.0.0, time-machine-2.15.0, mock-3.14.0, xdist-3.6.1
asyncio: mode=strict
2 workers [30 items]
..............................                                                                                                                                                                  [100%]
========================================================================================= 30 passed in 7.62s ==========================================================================================

Since I was asked to use CKV_AWS_* check ids, the overall tests fail on duplicate check ids. I have currently separated these out under awscc. Whats the best path here ?