search

bridgecrewio / checkov

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
https://www.checkov.io/
Apache License 2.0
7.03k stars 1.1k forks source link

False positive on CKV_TF_2 using shallow clone #6308

Closed mouellet closed 4 months ago

mouellet commented 4 months ago

Describe the issue

Introduced in #6213, CKV_TF_2 generates a false positive when using shallow clone.

Examples

module "bogus" {
  source = "git::https://example.com/bogus.git?depth=1&ref=v1.2.0"
}

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number"
    FAILED for resource: bogus
    File: /bogus.tf:28-59

Version (please complete the following information):

mikeurbanski1 commented 4 months ago

Hey @mouellet - sorry about that. Thanks for raising it. We'll merge a fix shortly.

mikeurbanski1 commented 4 months ago

Apologies for the delay - I am having an issue with an unrelated integration test that I want to make sure gets fixed.

rubfcsilva commented 4 months ago

Hello, does this fix also apply when you have the version after the source? I think my case is a false positive for this as well.

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number" FAILED for resource: module.key.module.keyring_label.label File: /common/label/main.tf:12-27 Calling File: /gcp/components/kms/key/main.tf:5-12 12 | module "label" { 13 | source = "cloudposse/label/null" 14 | version = "0.25.0"

mikeurbanski1 commented 4 months ago

Hello, does this fix also apply when you have the version after the source? I think my case is a false positive for this as well.

Check: CKV_TF_2: "Ensure Terraform module sources use a tag with a version number" FAILED for resource: module.key.module.keyring_label.label File: /common/label/main.tf:12-27 Calling File: /gcp/components/kms/key/main.tf:5-12 12 | module "label" { 13 | source = "cloudposse/label/null" 14 | version = "0.25.0"

Hmm... Does CKV_TF_1 also fail?

rubfcsilva commented 4 months ago

Hmm... Does CKV_TF_1 also fail?

We are skipping that rule, as of now.