aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
https://aquasecurity.github.io/trivy
Apache License 2.0
23.79k stars 2.34k forks source link

fix(misconf): do not erase variable type for child modules #7941

Closed nikpivkin closed 2 hours ago

nikpivkin commented 4 days ago

Description

Example config:

module "aws-rds" {
  source         = "terraform-aws-modules/rds/aws"
  version        = "~> 6.10.0"
  identifier     = "mydb"
  engine         = "postgres"
  family         = "postgres13"
  instance_class = "db.t4g.medium"
}

Before:

trivy conf -d . > log1.txt 2>&1
cat log1.txt |grep "Failed to expand"
2024-11-18T20:36:26+06:00       ERROR   [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.  block="module.aws-rds.module.db_instance.dynamic.restore_to_point_in_time" value="cty.NilVal"
2024-11-18T20:36:26+06:00       ERROR   [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.  block="module.aws-rds.module.db_instance.dynamic.s3_import" value="cty.NilVal"
2024-11-18T20:36:26+06:00       ERROR   [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.  block="module.aws-rds.module.db_instance.dynamic.restore_to_point_in_time" value="cty.NilVal"
2024-11-18T20:36:26+06:00       ERROR   [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.  block="module.aws-rds.module.db_instance.dynamic.s3_import" value="cty.NilVal"
2024-11-18T20:36:26+06:00       ERROR   [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.  block="module.aws-rds.module.db_instance.dynamic.restore_to_point_in_time" value="cty.NilVal"
2024-11-18T20:36:26+06:00       ERROR   [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.  block="module.aws-rds.module.db_instance.dynamic.s3_import" value="cty.NilVal"
2024-11-18T20:36:26+06:00       ERROR   [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.  block="module.aws-rds.module.db_instance.dynamic.restore_to_point_in_time" value="cty.NilVal"
2024-11-18T20:36:26+06:00       ERROR   [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.  block="module.aws-rds.module.db_instance.dynamic.s3_import" value="cty.NilVal"

After:

cat log2.txt |grep "Failed to expand"

Related issues

Checklist