jkrauze
commented
9 months ago The scenario to reproduce the issue
File structure:
% tree terraform
terraform
├── main.tf
├── my-module
│ ├── module.tf
│ ├── my-data-module
│ │ └── output.tf
│ ├── my-nested-module
│ │ └── sg.tf
│ └── sg.tf
└── terraform.tfLets say our terraform module uses a my-module module
main.tf
module "component" {
source = "./my-module"
}the my-module module creates its own security group using the my-data-module as a data source
my-module/sg.tf
module "data-common" {
source = "./my-data-module"
}
resource "aws_security_group" "example_sg" {
name = "example_sg"
description = "Example security group"
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = module.data-common.cidr_blocks
}
}also it uses the my-nested-module to create another security group
my-module/module.tf
module "nested-component" {
source = "./my-nested-module"
}my-module/my-nested-module/sg.tf
resource "aws_security_group" "example_sg_nested_host" {
name = "example_sg_nested_host"
description = "Example security group nested"
}
resource "aws_security_group" "example_sg_nested_client" {
name = "example_sg_nested_client"
description = "Example security group nested"
}
resource "aws_security_group_rule" "example_sg_nested_host_ingress_client" {
source_security_group_id = aws_security_group.example_sg_nested_client.id
security_group_id = aws_security_group.example_sg_nested_host.id
type = "ingress"
from_port = 443
to_port = 443
protocol = "tcp"
}
resource "aws_security_group_rule" "example_sg_nested_client_egress_host" {
source_security_group_id = aws_security_group.example_sg_nested_host.id
security_group_id = aws_security_group.example_sg_nested_client.id
type = "egress"
from_port = 443
to_port = 443
protocol = "tcp"
}This setup causes the error described in the issue and a following warning
❗ WARNING (mounting): The reference "module.data-common" in resource aws_security_group.example_sg is ambiguous. It will not be mounted.
Observation
If we stop using my-data-module the issue disappears. After replacing the my-module/sg.tf file with a following content
my-module/sg.tf
resource "aws_security_group" "example_sg" {
name = "example_sg"
description = "Example security group"
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}it starts working fine again.
Description
Getting the following error when running tf-compliance after checks:
The same Terraform code works fine in a different environment:
and here it runs the scenarios as expected.
To Reproduce
Is there a secure location I can upload the plan to?
Tested Versions: