We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Checkov Managed Disk Encryption check in Bicep IaC failing
**Describe the issue**
Checkov Managed Disk Encryption check will fail despite having the required check in Bicep code. It will only be successful if both checks are in the code, but need to be hashed out.

**Examples**
```
resource Disks 'Microsoft.Compute/disks@2022-07-02' = [for (disk, i) in dataDisks: {
  name: disk.diskName
  location: location
  tags: tags
  sku: {
    name: disk.storageAccountType
  }
  zones: [
    avZone
  ]
  properties: {
    creationData: {
      createOption: 'Empty'
    }
    diskSizeGB: disk.diskSizeGB
    // encryption: {
    //   type: 'EncryptionAtRestWithCustomerKey'
    //   diskEncryptionSetId: diskEncryptionSetId
    // }
    encryption: {
      type: 'EncryptionAtRestWithCustomerKey'
      diskEncryptionSetId: diskEncryptionSetId
    }
    // encryptionSettingsCollection: {
    //   enabled: true
    //   encryptionSettings: [
    //     {
    //       diskEncryptionKey: {
    //         secretUrl: keyURL
    //         sourceVault: {
    //           id: keyVaultId
    //         }
    //       }
    //     }
    //   ]
    // }
  }
}]
```

**Version :**
 - Latest

**Additional context**
Even if I remove the commented out sections, the check will fail. If I have the "encryptionSettingsCollection" block, the check will fail. It will only work if it is formatted like the above.


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/arm/checks/resource/AzureManagedDiscEncryption.py`
Content:
```
1 from __future__ import annotations
2 
3 from typing import Any
4 
5 from checkov.common.models.enums import CheckResult, CheckCategories
6 from checkov.arm.base_resource_check import BaseResourceCheck
7 
8 
9 class AzureManagedDiscEncryption(BaseResourceCheck):
10     def __init__(self) -> None:
11         name = "Ensure Azure managed disk have encryption enabled"
12         id = "CKV_AZURE_2"
13         supported_resources = ("Microsoft.Compute/disks",)
14         categories = (CheckCategories.ENCRYPTION,)
15         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
16 
17     def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
18         if "properties" in conf:
19             if "encryptionSettingsCollection" in conf["properties"]:
20                 if "enabled" in conf["properties"]["encryptionSettingsCollection"]:
21                     if str(conf["properties"]["encryptionSettingsCollection"]["enabled"]).lower() == "true":
22                         return CheckResult.PASSED
23             elif "encryptionSettings" in conf["properties"]:
24                 if "enabled" in conf["properties"]["encryptionSettings"]:
25                     if str(conf["properties"]["encryptionSettings"]["enabled"]).lower() == "true":
26                         return CheckResult.PASSED
27         return CheckResult.FAILED
28 
29 
30 check = AzureManagedDiscEncryption()
31
```

Path: `checkov/arm/base_resource_check.py`
Content:
```
1 from __future__ import annotations
2 
3 from abc import abstractmethod
4 from collections.abc import Iterable
5 from typing import Any, Callable
6 
7 from checkov.arm.registry import arm_resource_registry
8 from checkov.bicep.checks.resource.registry import registry as bicep_registry
9 from checkov.common.checks.base_check import BaseCheck
10 from checkov.common.models.enums import CheckCategories, CheckResult
11 from checkov.common.multi_signature import multi_signature
12 
13 
14 class BaseResourceCheck(BaseCheck):
15     def __init__(
16         self,
17         name: str,
18         id: str,
19         categories: "Iterable[CheckCategories]",
20         supported_resources: "Iterable[str]",
21         guideline: str | None = None,
22     ) -> None:
23         super().__init__(
24             name=name,
25             id=id,
26             categories=categories,
27             supported_entities=supported_resources,
28             block_type="resource",
29             guideline=guideline,
30         )
31         self.supported_resources = supported_resources
32         arm_resource_registry.register(self)
33         # leverage ARM checks to use with bicep runner
34         bicep_registry.register(self)
35 
36     def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult:  # type:ignore[override]  # it's ok
37         self.entity_type = entity_type
38 
39         # the "existing" key indicates a Bicep resource
40         if "existing" in conf:
41             if conf["existing"] is True:
42                 # the existing keyword is used to retrieve information about an already deployed resource
43                 return CheckResult.UNKNOWN
44 
45             self.api_version = conf["api_version"]
46             conf["config"]["apiVersion"] = conf["api_version"]  # set for better reusability of existing ARM checks
47 
48             return self.scan_resource_conf(conf["config"], entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation
49 
50         self.api_version = None
51 
52         return self.scan_resource_conf(conf, entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation
53 
54     @multi_signature()
55     @abstractmethod
56     def scan_resource_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult:
57         raise NotImplementedError()
58 
59     @classmethod
60     @scan_resource_conf.add_signature(args=["self", "conf"])
61     def _scan_resource_conf_self_conf(cls, wrapped: Callable[..., CheckResult]) -> Callable[..., CheckResult]:
62         def wrapper(self: BaseCheck, conf: dict[str, Any], entity_type: str | None = None) -> CheckResult:
63             # keep default argument for entity_type so old code, that doesn't set it, will work.
64             return wrapped(self, conf)
65 
66         return wrapper
67
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/arm/base_resource_check.py b/checkov/arm/base_resource_check.py
--- a/checkov/arm/base_resource_check.py
+++ b/checkov/arm/base_resource_check.py
@@ -45,7 +45,12 @@
             self.api_version = conf["api_version"]
             conf["config"]["apiVersion"] = conf["api_version"]  # set for better reusability of existing ARM checks
 
-            return self.scan_resource_conf(conf["config"], entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation
+            resource_conf = conf["config"]
+            if "loop_type" in resource_conf:
+                # this means the whole resource block is surrounded by a for loop
+                resource_conf = resource_conf["config"]
+
+            return self.scan_resource_conf(resource_conf, entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation
 
         self.api_version = None
 
diff --git a/checkov/arm/checks/resource/AzureManagedDiscEncryption.py b/checkov/arm/checks/resource/AzureManagedDiscEncryption.py
--- a/checkov/arm/checks/resource/AzureManagedDiscEncryption.py
+++ b/checkov/arm/checks/resource/AzureManagedDiscEncryption.py
@@ -4,6 +4,7 @@
 
 from checkov.common.models.enums import CheckResult, CheckCategories
 from checkov.arm.base_resource_check import BaseResourceCheck
+from checkov.common.util.data_structures_utils import find_in_dict
 
 
 class AzureManagedDiscEncryption(BaseResourceCheck):
@@ -15,15 +16,21 @@
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
     def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
-        if "properties" in conf:
-            if "encryptionSettingsCollection" in conf["properties"]:
-                if "enabled" in conf["properties"]["encryptionSettingsCollection"]:
-                    if str(conf["properties"]["encryptionSettingsCollection"]["enabled"]).lower() == "true":
-                        return CheckResult.PASSED
-            elif "encryptionSettings" in conf["properties"]:
-                if "enabled" in conf["properties"]["encryptionSettings"]:
-                    if str(conf["properties"]["encryptionSettings"]["enabled"]).lower() == "true":
-                        return CheckResult.PASSED
+        properties = conf.get("properties")
+        if properties:
+            encryption = properties.get("encryption")
+            if encryption:
+                # if the block exists, then it is enabled
+                return CheckResult.PASSED
+
+            encryption_enabled = find_in_dict(input_dict=properties, key_path="encryptionSettingsCollection/enabled")
+            if str(encryption_enabled).lower() == "true":
+                return CheckResult.PASSED
+
+            encryption_enabled = find_in_dict(input_dict=properties, key_path="encryptionSettings/enabled")
+            if str(encryption_enabled).lower() == "true":
+                return CheckResult.PASSED
+
         return CheckResult.FAILED

{"golden_diff": "diff --git a/checkov/arm/base_resource_check.py b/checkov/arm/base_resource_check.py\n--- a/checkov/arm/base_resource_check.py\n+++ b/checkov/arm/base_resource_check.py\n@@ -45,7 +45,12 @@\n             self.api_version = conf[\"api_version\"]\n             conf[\"config\"][\"apiVersion\"] = conf[\"api_version\"]  # set for better reusability of existing ARM checks\n \n-            return self.scan_resource_conf(conf[\"config\"], entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation\n+            resource_conf = conf[\"config\"]\n+            if \"loop_type\" in resource_conf:\n+                # this means the whole resource block is surrounded by a for loop\n+                resource_conf = resource_conf[\"config\"]\n+\n+            return self.scan_resource_conf(resource_conf, entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation\n \n         self.api_version = None\n \ndiff --git a/checkov/arm/checks/resource/AzureManagedDiscEncryption.py b/checkov/arm/checks/resource/AzureManagedDiscEncryption.py\n--- a/checkov/arm/checks/resource/AzureManagedDiscEncryption.py\n+++ b/checkov/arm/checks/resource/AzureManagedDiscEncryption.py\n@@ -4,6 +4,7 @@\n \n from checkov.common.models.enums import CheckResult, CheckCategories\n from checkov.arm.base_resource_check import BaseResourceCheck\n+from checkov.common.util.data_structures_utils import find_in_dict\n \n \n class AzureManagedDiscEncryption(BaseResourceCheck):\n@@ -15,15 +16,21 @@\n         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n \n     def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:\n-        if \"properties\" in conf:\n-            if \"encryptionSettingsCollection\" in conf[\"properties\"]:\n-                if \"enabled\" in conf[\"properties\"][\"encryptionSettingsCollection\"]:\n-                    if str(conf[\"properties\"][\"encryptionSettingsCollection\"][\"enabled\"]).lower() == \"true\":\n-                        return CheckResult.PASSED\n-            elif \"encryptionSettings\" in conf[\"properties\"]:\n-                if \"enabled\" in conf[\"properties\"][\"encryptionSettings\"]:\n-                    if str(conf[\"properties\"][\"encryptionSettings\"][\"enabled\"]).lower() == \"true\":\n-                        return CheckResult.PASSED\n+        properties = conf.get(\"properties\")\n+        if properties:\n+            encryption = properties.get(\"encryption\")\n+            if encryption:\n+                # if the block exists, then it is enabled\n+                return CheckResult.PASSED\n+\n+            encryption_enabled = find_in_dict(input_dict=properties, key_path=\"encryptionSettingsCollection/enabled\")\n+            if str(encryption_enabled).lower() == \"true\":\n+                return CheckResult.PASSED\n+\n+            encryption_enabled = find_in_dict(input_dict=properties, key_path=\"encryptionSettings/enabled\")\n+            if str(encryption_enabled).lower() == \"true\":\n+                return CheckResult.PASSED\n+\n         return CheckResult.FAILED\n", "issue": "Checkov Managed Disk Encryption check in Bicep IaC failing\n**Describe the issue**\r\nCheckov Managed Disk Encryption check will fail despite having the required check in Bicep code. It will only be successful if both checks are in the code, but need to be hashed out.\r\n\r\n**Examples**\r\n```\r\nresource Disks 'Microsoft.Compute/disks@2022-07-02' = [for (disk, i) in dataDisks: {\r\n  name: disk.diskName\r\n  location: location\r\n  tags: tags\r\n  sku: {\r\n    name: disk.storageAccountType\r\n  }\r\n  zones: [\r\n    avZone\r\n  ]\r\n  properties: {\r\n    creationData: {\r\n      createOption: 'Empty'\r\n    }\r\n    diskSizeGB: disk.diskSizeGB\r\n    // encryption: {\r\n    //   type: 'EncryptionAtRestWithCustomerKey'\r\n    //   diskEncryptionSetId: diskEncryptionSetId\r\n    // }\r\n    encryption: {\r\n      type: 'EncryptionAtRestWithCustomerKey'\r\n      diskEncryptionSetId: diskEncryptionSetId\r\n    }\r\n    // encryptionSettingsCollection: {\r\n    //   enabled: true\r\n    //   encryptionSettings: [\r\n    //     {\r\n    //       diskEncryptionKey: {\r\n    //         secretUrl: keyURL\r\n    //         sourceVault: {\r\n    //           id: keyVaultId\r\n    //         }\r\n    //       }\r\n    //     }\r\n    //   ]\r\n    // }\r\n  }\r\n}]\r\n```\r\n\r\n**Version :**\r\n - Latest\r\n\r\n**Additional context**\r\nEven if I remove the commented out sections, the check will fail. If I have the \"encryptionSettingsCollection\" block, the check will fail. It will only work if it is formatted like the above.\r\n\n", "before_files": [{"content": "from __future__ import annotations\n\nfrom typing import Any\n\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.arm.base_resource_check import BaseResourceCheck\n\n\nclass AzureManagedDiscEncryption(BaseResourceCheck):\n    def __init__(self) -> None:\n        name = \"Ensure Azure managed disk have encryption enabled\"\n        id = \"CKV_AZURE_2\"\n        supported_resources = (\"Microsoft.Compute/disks\",)\n        categories = (CheckCategories.ENCRYPTION,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:\n        if \"properties\" in conf:\n            if \"encryptionSettingsCollection\" in conf[\"properties\"]:\n                if \"enabled\" in conf[\"properties\"][\"encryptionSettingsCollection\"]:\n                    if str(conf[\"properties\"][\"encryptionSettingsCollection\"][\"enabled\"]).lower() == \"true\":\n                        return CheckResult.PASSED\n            elif \"encryptionSettings\" in conf[\"properties\"]:\n                if \"enabled\" in conf[\"properties\"][\"encryptionSettings\"]:\n                    if str(conf[\"properties\"][\"encryptionSettings\"][\"enabled\"]).lower() == \"true\":\n                        return CheckResult.PASSED\n        return CheckResult.FAILED\n\n\ncheck = AzureManagedDiscEncryption()\n", "path": "checkov/arm/checks/resource/AzureManagedDiscEncryption.py"}, {"content": "from __future__ import annotations\n\nfrom abc import abstractmethod\nfrom collections.abc import Iterable\nfrom typing import Any, Callable\n\nfrom checkov.arm.registry import arm_resource_registry\nfrom checkov.bicep.checks.resource.registry import registry as bicep_registry\nfrom checkov.common.checks.base_check import BaseCheck\nfrom checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.common.multi_signature import multi_signature\n\n\nclass BaseResourceCheck(BaseCheck):\n    def __init__(\n        self,\n        name: str,\n        id: str,\n        categories: \"Iterable[CheckCategories]\",\n        supported_resources: \"Iterable[str]\",\n        guideline: str | None = None,\n    ) -> None:\n        super().__init__(\n            name=name,\n            id=id,\n            categories=categories,\n            supported_entities=supported_resources,\n            block_type=\"resource\",\n            guideline=guideline,\n        )\n        self.supported_resources = supported_resources\n        arm_resource_registry.register(self)\n        # leverage ARM checks to use with bicep runner\n        bicep_registry.register(self)\n\n    def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult:  # type:ignore[override]  # it's ok\n        self.entity_type = entity_type\n\n        # the \"existing\" key indicates a Bicep resource\n        if \"existing\" in conf:\n            if conf[\"existing\"] is True:\n                # the existing keyword is used to retrieve information about an already deployed resource\n                return CheckResult.UNKNOWN\n\n            self.api_version = conf[\"api_version\"]\n            conf[\"config\"][\"apiVersion\"] = conf[\"api_version\"]  # set for better reusability of existing ARM checks\n\n            return self.scan_resource_conf(conf[\"config\"], entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation\n\n        self.api_version = None\n\n        return self.scan_resource_conf(conf, entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation\n\n    @multi_signature()\n    @abstractmethod\n    def scan_resource_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult:\n        raise NotImplementedError()\n\n    @classmethod\n    @scan_resource_conf.add_signature(args=[\"self\", \"conf\"])\n    def _scan_resource_conf_self_conf(cls, wrapped: Callable[..., CheckResult]) -> Callable[..., CheckResult]:\n        def wrapper(self: BaseCheck, conf: dict[str, Any], entity_type: str | None = None) -> CheckResult:\n            # keep default argument for entity_type so old code, that doesn't set it, will work.\n            return wrapped(self, conf)\n\n        return wrapper\n", "path": "checkov/arm/base_resource_check.py"}], "after_files": [{"content": "from __future__ import annotations\n\nfrom typing import Any\n\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.arm.base_resource_check import BaseResourceCheck\nfrom checkov.common.util.data_structures_utils import find_in_dict\n\n\nclass AzureManagedDiscEncryption(BaseResourceCheck):\n    def __init__(self) -> None:\n        name = \"Ensure Azure managed disk have encryption enabled\"\n        id = \"CKV_AZURE_2\"\n        supported_resources = (\"Microsoft.Compute/disks\",)\n        categories = (CheckCategories.ENCRYPTION,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:\n        properties = conf.get(\"properties\")\n        if properties:\n            encryption = properties.get(\"encryption\")\n            if encryption:\n                # if the block exists, then it is enabled\n                return CheckResult.PASSED\n\n            encryption_enabled = find_in_dict(input_dict=properties, key_path=\"encryptionSettingsCollection/enabled\")\n            if str(encryption_enabled).lower() == \"true\":\n                return CheckResult.PASSED\n\n            encryption_enabled = find_in_dict(input_dict=properties, key_path=\"encryptionSettings/enabled\")\n            if str(encryption_enabled).lower() == \"true\":\n                return CheckResult.PASSED\n\n        return CheckResult.FAILED\n\n\ncheck = AzureManagedDiscEncryption()\n", "path": "checkov/arm/checks/resource/AzureManagedDiscEncryption.py"}, {"content": "from __future__ import annotations\n\nfrom abc import abstractmethod\nfrom collections.abc import Iterable\nfrom typing import Any, Callable\n\nfrom checkov.arm.registry import arm_resource_registry\nfrom checkov.bicep.checks.resource.registry import registry as bicep_registry\nfrom checkov.common.checks.base_check import BaseCheck\nfrom checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.common.multi_signature import multi_signature\n\n\nclass BaseResourceCheck(BaseCheck):\n    def __init__(\n        self,\n        name: str,\n        id: str,\n        categories: \"Iterable[CheckCategories]\",\n        supported_resources: \"Iterable[str]\",\n        guideline: str | None = None,\n    ) -> None:\n        super().__init__(\n            name=name,\n            id=id,\n            categories=categories,\n            supported_entities=supported_resources,\n            block_type=\"resource\",\n            guideline=guideline,\n        )\n        self.supported_resources = supported_resources\n        arm_resource_registry.register(self)\n        # leverage ARM checks to use with bicep runner\n        bicep_registry.register(self)\n\n    def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult:  # type:ignore[override]  # it's ok\n        self.entity_type = entity_type\n\n        # the \"existing\" key indicates a Bicep resource\n        if \"existing\" in conf:\n            if conf[\"existing\"] is True:\n                # the existing keyword is used to retrieve information about an already deployed resource\n                return CheckResult.UNKNOWN\n\n            self.api_version = conf[\"api_version\"]\n            conf[\"config\"][\"apiVersion\"] = conf[\"api_version\"]  # set for better reusability of existing ARM checks\n\n            resource_conf = conf[\"config\"]\n            if \"loop_type\" in resource_conf:\n                # this means the whole resource block is surrounded by a for loop\n                resource_conf = resource_conf[\"config\"]\n\n            return self.scan_resource_conf(resource_conf, entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation\n\n        self.api_version = None\n\n        return self.scan_resource_conf(conf, entity_type)  # type:ignore[no-any-return]  # issue with multi_signature annotation\n\n    @multi_signature()\n    @abstractmethod\n    def scan_resource_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult:\n        raise NotImplementedError()\n\n    @classmethod\n    @scan_resource_conf.add_signature(args=[\"self\", \"conf\"])\n    def _scan_resource_conf_self_conf(cls, wrapped: Callable[..., CheckResult]) -> Callable[..., CheckResult]:\n        def wrapper(self: BaseCheck, conf: dict[str, Any], entity_type: str | None = None) -> CheckResult:\n            # keep default argument for entity_type so old code, that doesn't set it, will work.\n            return wrapped(self, conf)\n\n        return wrapper\n", "path": "checkov/arm/base_resource_check.py"}]}