Open massimiliano96 opened 2 months ago
Good afternoon @massimiliano96 would you please be able to share a test file or dir to reproduce this issue?
main.tf:
provider "aws" {
region = var.region
}
data "aws_vpc" "selected" {
filter {
name = "tag:Name"
values = [var.vpc_name]
}
}
resource "aws_security_group" "not_compliant" {
name = "not_compliant"
description = "Security group to allow custom access"
vpc_id = data.aws_vpc.selected.id
ingress {
description = "Unlimited SSH access"
from_port = var.port
to_port = var.port
protocol = "tcp"
cidr_blocks = [var.cidr]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
tags = {
name = "security-group"
}
}
resource "aws_security_group" "compliant" {
name = "compliant"
description = "Security group to allow custom access only from 1.1.1.1"
vpc_id = data.aws_vpc.selected.id
ingress {
description = "Custom Access"
from_port = var.port
to_port = var.port
protocol = "tcp"
cidr_blocks = ["1.1.1.1/32"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
variables.tf:
variable "region" {
description = "The AWS region to create resources in"
type = string
default = "eu-central-1"
}
variable "vpc_name" {
description = "The name of the VPC to use"
type = string
default = "vpc-idp-poc-de-int"
}
variable "cidr" {
description = "The CIDR block to allow access"
type = string
default = "0.0.0.0/0"
}
variable "port" {
description = "The port to allow access"
type = number
default = 22
}
checkov -d src/static --external-checks-dir src/policies/checkov/custom_tag_check -o junitxml --output-file-path output/ --check CKV_AWS_24
Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in <module>
from checkov.main import Checkov
File "/usr/local/lib/python3.10/dist-packages/checkov/main.py", line 52, in <module>
from checkov.common.runners.runner_registry import RunnerRegistry
File "/usr/local/lib/python3.10/dist-packages/checkov/common/runners/runner_registry.py", line 54, in <module>
from checkov.terraform.context_parsers.registry import parser_registry
File "/usr/local/lib/python3.10/dist-packages/checkov/terraform/context_parsers/__init__.py", line 1, in <module>
from checkov.terraform.context_parsers.parsers import * # noqa
File "/usr/local/lib/python3.10/dist-packages/checkov/terraform/context_parsers/parsers/data_context_parser.py", line 3, in <module>
from hcl2 import START_LINE, END_LINE
ImportError: cannot import name 'START_LINE' from 'hcl2' (unknown location)
hey @massimiliano96 this has nothing to do with your scanned files, but rather with your Python environment. You probably installed also other packages and this messed checkov
up. Please check, if you have bc-python-hcl2
installed with version 0.4.2
and there shouldn't be the package python-hcl2
otherwise you need to delete it.
In genreal I highly recommend to use dedicated venvs for CLI tools, pipx
is a great tool for it.
Describe the issue Checkov is failing to run, crashing with issues related to Python imports. This problem is occurring on both Ubuntu and Windows systems, and different error traces are provided for each.
Examples checkov -d src/static -o junitxml --output-file-path output/ --check CKV_AWS_24
Exception Trace On Ubuntu:
On Windows:
Desktop (please complete the following information):