Replies: 2 comments 8 replies
-
|
cc @nikpivkin |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Hi @TimatGDC ! How do you call the As for the |
Beta Was this translation helpful? Give feedback.
8 replies
-
|
Hi! I think this error occurs when child modules use input variables of complex type and one of the attributes is null. I have never been able to reproduce this. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @nikpivkin, quite close. However it seems that even after resolving the complex types to not have a When I run trivy there are no warning/debugs after fixing those |
Beta Was this translation helpful? Give feedback.
-
|
I've managed to point out where the issue is comming from. module "serverless_variables" {
source = "../../terraform/modules/lambda-cloudformation-outputs"
name = local.name
security_group_id = aws_security_group.lambda.id
outputs = {
"DatabaseHost" : {
"Value" : module.rds.writer_endpoint
},
"SnsNotificationArn" : {
"Value" : data.aws_sns_topic.notification_service.arn
},
# "OpensearchEndpoint" : {
# "Value" : data.aws_opensearch_domain.main.endpoint
# },
"SnsInternalEventsTopicArn" : {
"Value" : aws_sns_topic.internal_events.arn
},
}
}
data "aws_opensearch_domain" "main" {
domain_name = "main"
}
If i uncomment the 2025-02-20T10:36:40+01:00 DEBUG [terraform evaluator] Context unchanged iteration=1
2025-02-20T10:36:40+01:00 DEBUG [terraform evaluator] Submodule inputs unchanged name="classifieds__classified_visit_events"
2025-02-20T10:36:40+01:00 DEBUG [terraform evaluator] Submodule inputs unchanged name="classifieds__messaging_events"
2025-02-20T10:36:40+01:00 DEBUG [terraform evaluator] Submodule inputs unchanged name="classifieds__monolith_classified_events"
2025-02-20T10:36:40+01:00 DEBUG [terraform evaluator] Submodule inputs unchanged name="classifieds__opensearch_index_events"
2025-02-20T10:36:40+01:00 DEBUG [terraform evaluator] Submodule inputs unchanged name="classifieds__opensearch_reindex_events"
2025-02-20T10:36:40+01:00 DEBUG [terraform evaluator] Submodule inputs unchanged name="classifieds__vacation_events"
2025-02-20T10:36:40+01:00 DEBUG [terraform evaluator] Submodule inputs unchanged name="iam"
2025-02-20T10:36:40+01:00 DEBUG [terraform evaluator] Submodule inputs unchanged name="kms"
2025-02-20T10:36:40+01:00 DEBUG [terraform evaluator] Submodule inputs unchanged name="poc_image_quality_bucket"
2025-02-20T10:36:40+01:00 DEBUG [terraform evaluator] Submodule inputs unchanged name="rds"
2025-02-20T10:36:40+01:00 DEBUG [terraform evaluator] Evaluating submodule name="serverless_variables"
2025-02-20T10:36:40+01:00 DEBUG [terraform evaluator] Starting module evaluation... path="../../terraform/modules/lambda-cloudformation-outputs"
2025-02-20T10:36:40+01:00 DEBUG [terraform evaluator] Starting iteration iteration=0
panic: WithoutOptionalAttributesDeep does not support the given type
goroutine 1 [running]:
github.com/zclconf/go-cty/cty.Type.WithoutOptionalAttributesDeep({{0x0?, 0x0?}})
/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/type.go:152 +0x320
github.com/zclconf/go-cty/cty/convert.conversionObjectToObject.func1({{{0x107bd82e0?, 0x14007d47040?}}, {0x10726c340?, 0x14007d39320?}}, {0x14007d47490, 0x1, 0x1})
/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/convert/conversion_object.go:86 +0x2a4
github.com/zclconf/go-cty/cty/convert.getConversion.func1({{{0x107bd82e0?, 0x14007d47040?}}, {0x10726c340?, 0x14007d39320?}}, {0x14007d47490, 0x1, 0x1})
/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/convert/conversion.go:57 +0x1fc
github.com/zclconf/go-cty/cty/convert.conversionObjectToMap.func2({{{0x107bd82e0?, 0x14007d47100?}}, {0x10726c340?, 0x14007d394a0?}}, {0x0, 0x0, 0x0})
/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/convert/conversion_collection.go:424 +0x2ac
github.com/zclconf/go-cty/cty/convert.getConversion.func1({{{0x107bd82e0?, 0x14007d47100?}}, {0x10726c340?, 0x14007d394a0?}}, {0x0, 0x0, 0x0})
/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/convert/conversion.go:57 +0x1fc
github.com/zclconf/go-cty/cty/convert.GetConversionUnsafe.retConversion.func1({{{0x107bd82e0?, 0x14007d47100?}}, {0x10726c340?, 0x14007d394a0?}})
/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/convert/conversion.go:203 +0x40
github.com/zclconf/go-cty/cty/convert.Convert({{{0x107bd82e0?, 0x14007d47100?}}, {0x10726c340?, 0x14007d394a0?}}, {{0x107bd8238?, 0x14007d472b0?}})
/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/convert/public.go:51 +0x1e8
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateVariable(0x14001bb6820, 0x14003780fc0)
/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:487 +0x378
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).getValuesByBlockType(0x14001bb6820, {0x105bb22a6, 0x8})
/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:520 +0x74c
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateStep(0x14001bb6820)
/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:95 +0x30
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateSteps(0x14001bb6820)
/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:246 +0x108
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).EvaluateAll(0x14001bb6820, {0x107bd6088, 0x1400192a390})
/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:135 +0x16c
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateSubmodule(0x140058008c0, {0x107bd6088, 0x1400192a390}, 0x140043b0380)
/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:228 +0x170
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateSubmodules(0x140058008c0, {0x107bd6088, 0x1400192a390}, 0x14006552690)
/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:164 +0x374
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).EvaluateAll(0x140058008c0, {0x107bd6088, 0x1400192a390})
/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:142 +0x20c
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*Parser).EvaluateAll(0x140062a4d80, {0x107bd6088, 0x1400192a390})
/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/parser.go:346 +0x78
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform.(*Scanner).ScanFS(0x1400171d3b0, {0x107bd6088, 0x1400192a390}, {0x107b77c80, 0x140011af7b8}, {0x106c8f560, 0x1})
/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/scanner.go:133 +0x580
github.com/aquasecurity/trivy/pkg/misconf.(*Scanner).Scan(0x140016e6e40, {0x107bd6130, 0x14000b071f0}, {0x107b77c80, 0x140011ae978})
/home/runner/work/trivy/trivy/pkg/misconf/scanner.go:151 +0x220
github.com/aquasecurity/trivy/pkg/fanal/analyzer/config.(*Analyzer).PostAnalyze(0x1400002c420, {0x107bd6130?, 0x14000b071f0?}, {{0x107b77c80?, 0x140011ae978?}, {0x9?, 0x0?}})
/home/runner/work/trivy/trivy/pkg/fanal/analyzer/config/config.go:44 +0x38
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze({0x14001020d50, {0x140014842c0, 0x4, 0x4}, {0x140016f8af0, 0x1, 0x1}, 0x14000d17c80, {0x0, 0x0}}, ...)
/home/runner/work/trivy/trivy/pkg/fanal/analyzer/analyzer.go:505 +0x280
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect({{0x16db6336a, 0x1}, 0x140018d5b20, {0x132205190, 0x14001484280}, {0x107b77ba0, 0x10aab9360}, {0x14001020d50, {0x140014842c0, 0x4, ...}, ...}, ...}, ...)
/home/runner/work/trivy/trivy/pkg/fanal/artifact/local/fs.go:204 +0x574
github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0x0, 0x0, 0x0}, {0x0, ...}, ...})
/home/runner/work/trivy/trivy/pkg/scanner/scan.go:156 +0xa4
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan(_, {_, _}, {{{0x105bc00f3, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:627 +0x2e4
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x105bc00f3, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:259 +0x94
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanFS(_, {_, _}, {{{0x105bc00f3, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:204 +0xa4
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanFilesystem(_, {_, _}, {{{0x105bc00f3, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:184 +0x1b0
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x105bc00f3, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x140001389c0, ...}, ...}, ...}, ...)
/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:400 +0x7f4
github.com/aquasecurity/trivy/pkg/commands.NewConfigCommand.func2(0x14000158008, {0x140014024b0, 0x1, 0x5})
/home/runner/work/trivy/trivy/pkg/commands/app.go:719 +0x284
github.com/spf13/cobra.(*Command).execute(0x14000158008, {0x14001402460, 0x5, 0x5})
/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:985 +0x834
github.com/spf13/cobra.(*Command).ExecuteC(0x14000fdb208)
/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1117 +0x344
github.com/spf13/cobra.(*Command).Execute(0x105c15da9?)
/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1041 +0x1c
main.run()
/home/runner/work/trivy/trivy/cmd/trivy/main.go:45 +0x124
main.main()
/home/runner/work/trivy/trivy/cmd/trivy/main.go:19 +0x20And when i comment it: 2025-02-20T10:38:11+01:00 DEBUG [terraform evaluator] Context unchanged iteration=1
2025-02-20T10:38:11+01:00 DEBUG [terraform evaluator] Module evaluation complete.
2025-02-20T10:38:11+01:00 DEBUG [terraform parser] Finished parsing module module="root"
2025-02-20T10:38:11+01:00 DEBUG [terraform executor] Adapting modules...
2025-02-20T10:38:11+01:00 DEBUG [terraform executor] Adapted module(s) into state data. count=18
2025-02-20T10:38:11+01:00 DEBUG [rego] Scanning inputs count=1
2025-02-20T10:38:12+01:00 DEBUG [terraform executor] Finished applying rules.
2025-02-20T10:38:12+01:00 DEBUG [terraform executor] Applying ignores...
2025-02-20T10:38:12+01:00 INFO [terraform executor] Ignore finding rule="aws-ec2-no-public-egress-sgr" range="security-groups.tf:33"
2025-02-20T10:38:12+01:00 INFO [terraform executor] Ignore finding rule="aws-ec2-add-description-to-security-group-rule" range="../../terraform/modules/security-group-rules-v2/security_group_rules.tf:13"
2025-02-20T10:38:12+01:00 INFO [terraform executor] Ignore finding rule="aws-ec2-add-description-to-security-group-rule" range="../../terraform/modules/security-group-rules-v2/security_group_rules.tf:13"
2025-02-20T10:38:12+01:00 INFO [terraform executor] Ignore finding rule="aws-ec2-add-description-to-security-group-rule" range="../../terraform/modules/security-group-rules-v2/security_group_rules.tf:13"
2025-02-20T10:38:12+01:00 INFO [terraform executor] Ignore finding rule="aws-ec2-add-description-to-security-group-rule" range="../../terraform/modules/security-group-rules-v2/security_group_rules.tf:13"
2025-02-20T10:38:12+01:00 INFO [terraform executor] Ignore finding rule="aws-ec2-add-description-to-security-group-rule" range="../../terraform/modules/security-group-rules-v2/security_group_rules.tf:28"
2025-02-20T10:38:12+01:00 INFO [terraform executor] Ignore finding rule="aws-s3-encryption-customer-key" range="../../terraform/modules/s3-bucket/main.tf:118-139"
2025-02-20T10:38:12+01:00 DEBUG OS is not detected.
2025-02-20T10:38:12+01:00 INFO Detected config files num=5
2025-02-20T10:38:12+01:00 DEBUG Scanned config file file_path="."
2025-02-20T10:38:12+01:00 DEBUG Scanned config file file_path="../../terraform/modules/aurora-database/rds.tf"
2025-02-20T10:38:12+01:00 DEBUG Scanned config file file_path="../../terraform/modules/s3-bucket/main.tf"
2025-02-20T10:38:12+01:00 DEBUG Scanned config file file_path="../../terraform/modules/security-group-rules-v2/security_group_rules.tf"
2025-02-20T10:38:12+01:00 DEBUG Scanned config file file_path="security-groups.tf"
2025-02-20T10:38:12+01:00 DEBUG Specified ignore file does not exist file=".trivyignore"
2025-02-20T10:38:12+01:00 DEBUG [vex] VEX filtering is disabled
{
"SchemaVersion": 2,
"CreatedAt": "2025-02-20T10:38:12.183901+01:00",
"ArtifactName": ".",
"ArtifactType": "filesystem",
"Metadata": {
"ImageConfig": {
"architecture": "",
"created": "0001-01-01T00:00:00Z",
"os": "",
"rootfs": {
"type": "",
"diff_ids": null
},
"config": {}
}
},
"Results": [
{
"Target": ".",
"Class": "config",
"Type": "terraform",
"MisconfSummary": {
"Successes": 75,
"Failures": 0
}
},
{
"Target": "../../terraform/modules/aurora-database/rds.tf",
"Class": "config",
"Type": "terraform",
"MisconfSummary": {
"Successes": 0,
"Failures": 2
},
"Misconfigurations": [
{
...I found out a lots of other 'outputs' that are not working, like: SqsBabysittingSynchronizeProfileEventArn = {
Value = module.synchronize_profile_events.queue_arn
} SqsBabysittingSynchronizeProfileEventUrl = {
Value = module.synchronize_profile_events.queue_url
}... |
Beta Was this translation helpful? Give feedback.
-
|
@TimatGDC what type is the |
Beta Was this translation helpful? Give feedback.
-
|
It's a variable "outputs" {
description = "The outputs will be used by the serverless.ts of the lambda using this CF template"
type = map(any)
default = {}
validation {
condition = alltrue([for k in keys(var.outputs) : length(regexall("^[A-Z](([a-z0-9]+[A-Z]?)*)$", k)) > 0])
error_message = "The output key must be in PascalCase without any special characters."
}
} |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Question
Hello,
I'm quite new to trivy as i used before Tfsec. I'm trying to do some security checks on my Terraform IaC.
i use this command:
trivy config --misconfig-scanners=terraform --format json --debug .But i have an error everytime:
So i look into
terraform/modules/lambda-iam-roleand i have:I don't really know what is the problem here, and how can i do a Terraform Security check without changing my Terraform configuration?
Target
AWS
Scanner
Misconfiguration
Output Format
JSON
Mode
Standalone
Operating System
macOS Sequoia Version 15.2
Version
Beta Was this translation helpful? Give feedback.
All reactions