We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Missing AWS RDS CA in CKV_AWS_211
**Describe the issue**
In check CKV_AWS_211, checkov currently only checks for one possible CA on AWS RDS instances, namely `rds-ca-2019` (see [associated code](https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py#L24)) whereas RDS supports several (see [AWS docs](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.RegionCertificateAuthorities)). The check should accept those CAs: `rds-ca-rsa2048-g1`, `rds-ca-rsa4096-g1` and `rds-ca-ecc384-g1`.

**Examples**
Terraform code on which the check should pass:
```terraform
resource "aws_db_instance" "pass3" {
  allocated_storage                   = 20
  storage_type                        = "gp2"
  engine                              = "mysql"
  engine_version                      = "5.7"
  instance_class                      = "db.t2.micro"
  db_name                             = "mydb"
  username                            = "foo"
  password                            = "foobarbaz"
  iam_database_authentication_enabled = true
  storage_encrypted                   = true
  ca_cert_identifier                  = "rds-ca-rsa2048-g1"
}
```
When I run checkov on this Terraform example, I get an error whereas the test should pass:

```
Check: CKV_AWS_211: "Ensure RDS uses a modern CaCert"
	FAILED for resource: aws_db_instance.pass3
	File: /main.tf:43-55
	Guide: https://docs.paloaltonetworks.com/content/techdocs/en_US/prisma/prisma-cloud/prisma-cloud-code-security-policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-uses-a-modern-cacert.html

		43 | resource "aws_db_instance" "pass3" {
		44 |   allocated_storage                   = 20
		45 |   storage_type                        = "gp2"
		46 |   engine                              = "mysql"
		47 |   engine_version                      = "5.7"
		48 |   instance_class                      = "db.t2.micro"
		49 |   db_name                             = "mydb"
		50 |   username                            = "foo"
		51 |   password                            = "foobarbaz"
		52 |   iam_database_authentication_enabled = true
		53 |   storage_encrypted                   = true
		54 |   ca_cert_identifier                  = "rds-ca-rsa2048-g1"
		55 | }
```

**Version (please complete the following information):**
 - Checkov Version 2.0.930


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py`
Content:
```
1 from checkov.common.models.enums import CheckCategories, CheckResult
2 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
3 from typing import Any, List
4 
5 
6 class RDSCACertIsRecent(BaseResourceValueCheck):
7     def __init__(self):
8         name = "Ensure RDS uses a modern CaCert"
9         id = "CKV_AWS_211"
10         supported_resources = ["aws_db_instance"]
11         categories = [CheckCategories.GENERAL_SECURITY]
12         super().__init__(
13             name=name,
14             id=id,
15             categories=categories,
16             supported_resources=supported_resources,
17             missing_block_result=CheckResult.PASSED
18         )
19 
20     def get_inspected_key(self) -> str:
21         return "ca_cert_identifier"
22 
23     def get_expected_values(self) -> List[Any]:
24         return ["rds-ca-2019"]
25 
26 
27 check = RDSCACertIsRecent()
28
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py b/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py
--- a/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py
+++ b/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py
@@ -21,7 +21,7 @@
         return "ca_cert_identifier"
 
     def get_expected_values(self) -> List[Any]:
-        return ["rds-ca-2019"]
+        return ["rds-ca-rsa2048-g1", "rds-ca-rsa4096-g1", "rds-ca-ecc384-g1"]
 
 
 check = RDSCACertIsRecent()

{"golden_diff": "diff --git a/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py b/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py\n--- a/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py\n+++ b/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py\n@@ -21,7 +21,7 @@\n         return \"ca_cert_identifier\"\n \n     def get_expected_values(self) -> List[Any]:\n-        return [\"rds-ca-2019\"]\n+        return [\"rds-ca-rsa2048-g1\", \"rds-ca-rsa4096-g1\", \"rds-ca-ecc384-g1\"]\n \n \n check = RDSCACertIsRecent()\n", "issue": "Missing AWS RDS CA in CKV_AWS_211\n**Describe the issue**\r\nIn check CKV_AWS_211, checkov currently only checks for one possible CA on AWS RDS instances, namely `rds-ca-2019` (see [associated code](https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py#L24)) whereas RDS supports several (see [AWS docs](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.RegionCertificateAuthorities)). The check should accept those CAs: `rds-ca-rsa2048-g1`, `rds-ca-rsa4096-g1` and `rds-ca-ecc384-g1`.\r\n\r\n**Examples**\r\nTerraform code on which the check should pass:\r\n```terraform\r\nresource \"aws_db_instance\" \"pass3\" {\r\n  allocated_storage                   = 20\r\n  storage_type                        = \"gp2\"\r\n  engine                              = \"mysql\"\r\n  engine_version                      = \"5.7\"\r\n  instance_class                      = \"db.t2.micro\"\r\n  db_name                             = \"mydb\"\r\n  username                            = \"foo\"\r\n  password                            = \"foobarbaz\"\r\n  iam_database_authentication_enabled = true\r\n  storage_encrypted                   = true\r\n  ca_cert_identifier                  = \"rds-ca-rsa2048-g1\"\r\n}\r\n```\r\nWhen I run checkov on this Terraform example, I get an error whereas the test should pass:\r\n\r\n```\r\nCheck: CKV_AWS_211: \"Ensure RDS uses a modern CaCert\"\r\n\tFAILED for resource: aws_db_instance.pass3\r\n\tFile: /main.tf:43-55\r\n\tGuide: https://docs.paloaltonetworks.com/content/techdocs/en_US/prisma/prisma-cloud/prisma-cloud-code-security-policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-uses-a-modern-cacert.html\r\n\r\n\t\t43 | resource \"aws_db_instance\" \"pass3\" {\r\n\t\t44 |   allocated_storage                   = 20\r\n\t\t45 |   storage_type                        = \"gp2\"\r\n\t\t46 |   engine                              = \"mysql\"\r\n\t\t47 |   engine_version                      = \"5.7\"\r\n\t\t48 |   instance_class                      = \"db.t2.micro\"\r\n\t\t49 |   db_name                             = \"mydb\"\r\n\t\t50 |   username                            = \"foo\"\r\n\t\t51 |   password                            = \"foobarbaz\"\r\n\t\t52 |   iam_database_authentication_enabled = true\r\n\t\t53 |   storage_encrypted                   = true\r\n\t\t54 |   ca_cert_identifier                  = \"rds-ca-rsa2048-g1\"\r\n\t\t55 | }\r\n```\r\n\r\n**Version (please complete the following information):**\r\n - Checkov Version 2.0.930\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\nfrom typing import Any, List\n\n\nclass RDSCACertIsRecent(BaseResourceValueCheck):\n    def __init__(self):\n        name = \"Ensure RDS uses a modern CaCert\"\n        id = \"CKV_AWS_211\"\n        supported_resources = [\"aws_db_instance\"]\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(\n            name=name,\n            id=id,\n            categories=categories,\n            supported_resources=supported_resources,\n            missing_block_result=CheckResult.PASSED\n        )\n\n    def get_inspected_key(self) -> str:\n        return \"ca_cert_identifier\"\n\n    def get_expected_values(self) -> List[Any]:\n        return [\"rds-ca-2019\"]\n\n\ncheck = RDSCACertIsRecent()\n", "path": "checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck\nfrom typing import Any, List\n\n\nclass RDSCACertIsRecent(BaseResourceValueCheck):\n    def __init__(self):\n        name = \"Ensure RDS uses a modern CaCert\"\n        id = \"CKV_AWS_211\"\n        supported_resources = [\"aws_db_instance\"]\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(\n            name=name,\n            id=id,\n            categories=categories,\n            supported_resources=supported_resources,\n            missing_block_result=CheckResult.PASSED\n        )\n\n    def get_inspected_key(self) -> str:\n        return \"ca_cert_identifier\"\n\n    def get_expected_values(self) -> List[Any]:\n        return [\"rds-ca-rsa2048-g1\", \"rds-ca-rsa4096-g1\", \"rds-ca-ecc384-g1\"]\n\n\ncheck = RDSCACertIsRecent()\n", "path": "checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py"}]}