panic: WithoutOptionalAttributesDeep does not support the given type #8414

Redm0nd · 2025-02-17T18:10:56Z

Redm0nd
Feb 17, 2025

Description

Similar issue to 6689 & 6697

We run trivy across all our Git repos using Terraform before a Terraform apply. All repositories are scanning fine without issues however some larger repositories we have fail with the below error on running Trivy:

panic: WithoutOptionalAttributesDeep does not support the given type

From the cty go package here.

On previous versions of trivy we are able to run without issues.

This config is valid in terms of Terraform and there are no errors when planning/applying without Trivy:

$ terraform validate
Success! The configuration is valid.

$ find . -type f | wc -l
      73
$ du -sh .
1.6M    .

Let me know if any further information is required.

Desired Behavior

Trivy to scan repository for misconfig and report findings.

Actual Behavior

Trivy crashes with panic exception

Reproduction Steps

Run trivy config . in a directory containing multiple Terraform files.

Observe the output, which results in a panic instead of a normal scan result.

Target

Git Repository

Scanner

Misconfiguration

Output Format

Table

Mode

Standalone

Debug Output

We run trivy as part of our tf wrapper with this command:

runTrivy() {
  if [[ "$TF_ACTION" != "plan" ]] && [[ "$TF_ACTION" != "apply" ]] ; then
    return 0
  fi
  if [[ "$SKIP_TRIVY" == "true" ]]; then
    return 0
  fi
  trivy conf \
    --tf-vars $TF_VARS_PATH/terraform.tfvars \
    --misconfig-scanners terraform \
    --skip-dirs .terraform \
    --output .terraform/trivy-report.txt \
    --format table \
    --exit-code 1 .
  if [ "$?" != "0" ]; then
    cat .terraform/trivy-report.txt
    exit 1
  fi
}

Although simply running trivy -d conf . also fails:

[redacted@dev:eu-west-1 dms]$ tf plan
2025-02-17T17:07:56Z    DEBUG   No plugins loaded
2025-02-17T17:07:56Z    DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2025-02-17T17:07:56Z    DEBUG   Cache dir       dir="/Users/[REDACTED]/Library/Caches/trivy"
2025-02-17T17:07:56Z    DEBUG   Cache dir       dir="/Users/[REDACTED]/Library/Caches/trivy"
2025-02-17T17:07:56Z    DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-02-17T17:07:56Z    INFO    [misconfig] Misconfiguration scanning is enabled
2025-02-17T17:07:56Z    DEBUG   [misconfig] Checks successfully loaded from disk
2025-02-17T17:07:56Z    DEBUG   Enabling misconfiguration scanners      scanners=[terraform]
2025-02-17T17:07:56Z    DEBUG   Initializing scan cache...      type="memory"
2025-02-17T17:07:56Z    DEBUG   [fs] Analyzing...       root="."
2025-02-17T17:07:56Z    DEBUG   [fs] Random cache key will be used      err="repository is dirty"
2025-02-17T17:07:56Z    DEBUG   Skipping path   path=".git"
2025-02-17T17:07:56Z    DEBUG   Skipping path   path=".terraform"
2025-02-17T17:07:56Z    DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Terraform"
2025-02-17T17:07:56Z    DEBUG   [terraform scanner] Scanning directory  file_path="."
...
2025-02-17T17:07:57Z    DEBUG   [terraform parser] Setting project/module root  module="root" file_path="."
2025-02-17T17:07:57Z    DEBUG   [terraform parser] Parsing FS   module="root" file_path="."
2025-02-17T17:07:57Z    DEBUG   [terraform parser] Parsing      module="root" file_path="[REDACTED].tf"
2025-02-17T17:07:57Z    DEBUG   [terraform parser] Added file   module="root" file_path="[REDACTED].tf"
...
2025-02-17T17:07:57Z    DEBUG   [terraform evaluator] Module resolved   block="module.[REDACTED]" source="git::ssh://[email protected]/[REDACTED]/terraform/modules/[REDACTED].git?ref=master" prefix="git::ssh:/[email protected]/[REDACTED]/terraform/modules/[REDACTED].git?ref=master" file_path="."
...
2025-02-17T17:07:57Z    DEBUG   [terraform evaluator] Added module output       block="api_domain" value="cty.StringVal(\"[REDACTED].com\")"
2025-02-17T17:07:57Z    DEBUG   [terraform evaluator] Added module output       block="api_endpoint_config" value="cty.StringVal(\"PRIVATE\")"
2025-02-17T17:07:57Z    DEBUG   [terraform evaluator] Added module output       block="api_subdomain" value="cty.StringVal(\"api-internal\")"
2025-02-17T17:07:57Z    DEBUG   [terraform evaluator] Added module output       block="app" value="cty.StringVal(\"[REDACTED]-app\")"
...
2025-02-17T17:07:57Z    DEBUG   [terraform evaluator] Added module output       block="subnets" value="cty.StringVal(\"[REDACTED]\")"
2025-02-17T17:07:57Z    DEBUG   [terraform evaluator] Added module output       block="vpc_id" value="cty.StringVal(\"[REDACTED]\")"
...
2025-02-17T17:07:57Z    DEBUG   [terraform evaluator] Added module output       block="kinesis_firehose" value="cty.StringVal(\"[REDACTED]\")"
...
2025-02-17T17:07:57Z    DEBUG   [terraform evaluator] Added module output       block="backup_bucket" value="cty.StringVal(\"arn:aws:s3:::\")"
...
panic: WithoutOptionalAttributesDeep does not support the given type

goroutine 1 [running]:
github.com/zclconf/go-cty/cty.Type.WithoutOptionalAttributesDeep({{0x0?, 0x0?}})
        /home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/type.go:152 +0x320
...
cat: .terraform/trivy-report.txt: No such file or directory


===== via Jenkins on both 0.58.1 and 0.59.1 =====

@/home/workhuman/workspace/terraform/terraform/data-lake/dms/trivy-html-template.tpl --exit-code 1 .
2025-02-17T15:33:57Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-02-17T15:33:57Z	INFO	[misconfig] Need to update the built-in checks
2025-02-17T15:33:57Z	INFO	[misconfig] Downloading the built-in checks...
162.46 KiB / 162.46 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-02-17T15:34:01Z	INFO	[terraform scanner] Scanning root module	file_path="."
panic: WithoutOptionalAttributesDeep does not support the given type

goroutine 1 [running]:
github.com/zclconf/go-cty/cty.Type.WithoutOptionalAttributesDeep({{0x0?, 0x0?}})
	/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/type.go:152 +0x320
github.com/zclconf/go-cty/cty/convert.conversionObjectToObject.func1({{{0x5130850?, 0x4003ca2440?}}, {0x386a800?, 0x400356d860?}}, {0x4003da0680, 0x1, 0x1})
	/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/convert/conversion_object.go:86 +0x2ac
github.com/zclconf/go-cty/cty/convert.getConversion.func1({{{0x5130850?, 0x4003ca2440?}}, {0x386a800?, 0x400356d860?}}, {0x4003da0680, 0x1, 0x1})
	/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/convert/conversion.go:57 +0x1fc
github.com/zclconf/go-cty/cty/convert.conversionTupleToList.func2({{{0x51307e0?, 0x400588ab88?}}, {0x35f67c0?, 0x400588aba0?}}, {0x0, 0x0, 0x0})
	/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/convert/conversion_collection.go:341 +0x298
github.com/zclconf/go-cty/cty/convert.getConversion.func1({{{0x51307e0?, 0x400588ab88?}}, {0x35f67c0?, 0x400588aba0?}}, {0x0, 0x0, 0x0})
	/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/convert/conversion.go:57 +0x1fc
github.com/zclconf/go-cty/cty/convert.GetConversionUnsafe.retConversion.func1({{{0x51307e0?, 0x400588ab88?}}, {0x35f67c0?, 0x400588aba0?}})
	/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/convert/conversion.go:199 +0x40
github.com/zclconf/go-cty/cty/convert.Convert({{{0x51307e0?, 0x400588ab88?}}, {0x35f67c0?, 0x400588aba0?}}, {{0x5130770?, 0x4003da0600?}})
	/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/convert/public.go:51 +0x1e8
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateVariable(0x40010e0000, 0x400636c540)
	/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:487 +0x378
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).getValuesByBlockType(0x40010e0000, {0x3ff2bd5, 0x8})
	/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:520 +0x744
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateStep(0x40010e0000)
	/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:95 +0x30
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateSteps(0x40010e0000)
	/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:246 +0x108
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).EvaluateAll(0x40010e0000, {0x512e868, 0x40011fa0f0})
	/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:135 +0x16c
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateSubmodule(0x4002d26320, {0x512e868, 0x40011fa0f0}, 0x400640d8c0)
	/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:228 +0x170
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateSubmodules(0x4002d26320, {0x512e868, 0x40011fa0f0}, 0x4004423530)
	/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:164 +0x374
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).EvaluateAll(0x4002d26320, {0x512e868, 0x40011fa0f0})
	/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:142 +0x20c
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*Parser).EvaluateAll(0x4005c5eb40, {0x512e868, 0x40011fa0f0})
	/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/parser.go:342 +0x78
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform.(*Scanner).ScanFS(0x4000eb37a0, {0x512e868, 0x40011fa0f0}, {0x50ec800, 0x4001206fd8}, {0x50d1350, 0x1})
	/home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/scanner.go:132 +0x588
github.com/aquasecurity/trivy/pkg/misconf.(*Scanner).Scan(0x40013422c0, {0x512e910, 0x40006ca000}, {0x50ec800, 0x40012063c0})
	/home/runner/work/trivy/trivy/pkg/misconf/scanner.go:151 +0x228
github.com/aquasecurity/trivy/pkg/fanal/analyzer/config.(*Analyzer).PostAnalyze(0x4000ac0320, {0x512e910?, 0x40006ca000?}, {{0x50ec800?, 0x40012063c0?}, {0x9?, 0x0?}})
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/config/config.go:44 +0x38
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze({0x4001424510, {0x4001444180, 0x4, 0x4}, {0x4000848ed0, 0x1, 0x1}, 0x4000eee3c0, {0x0, 0x0}}, ...)
	/home/runner/work/trivy/trivy/pkg/fanal/analyzer/analyzer.go:505 +0x28c
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect({{0xffffe93636ef, 0x1}, {0xfffe4f4860a0, 0x4001444140}, {0x50ec720, 0x7a5c3e0}, {0x4001424510, {0x4001444180, 0x4, 0x4}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/fanal/artifact/local/fs.go:121 +0x378
github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0x0, 0x0, 0x0}, {0x0, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/scanner/scan.go:156 +0xa4
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan(_, {_, _}, {{{0x40007e7, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:620 +0x2d0
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x40007e7, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:259 +0x9c
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanFS(_, {_, _}, {{{0x40007e7, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:204 +0xac
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanFilesystem(_, {_, _}, {{{0x40007e7, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:184 +0x1b8
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x40007e7, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, {0xffffe936359b, ...}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:385 +0x7d0
github.com/aquasecurity/trivy/pkg/commands.NewConfigCommand.func2(0x400032db08, {0x4000a705a0, 0x1, 0x11})
	/home/runner/work/trivy/trivy/pkg/commands/app.go:719 +0x294
github.com/spf13/cobra.(*Command).execute(0x400032db08, {0x4000a70480, 0x11, 0x11})
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:985 +0x840
github.com/spf13/cobra.(*Command).ExecuteC(0x4000cc6c08)
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1117 +0x344
github.com/spf13/cobra.(*Command).Execute(0x4053705?)
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1041 +0x1c
main.run()
	/home/runner/work/trivy/trivy/cmd/trivy/main.go:39 +0x124
main.main()
	/home/runner/work/trivy/trivy/cmd/trivy/main.go:19 +0x20

Operating System

Multiple - Linux, MacOS

Version

$ trivy --version
Version: 0.59.1
Check Bundle:
  Digest: sha256:ef2d9ad4fce0f933b20a662004d7e55bf200987c180e7f2cd531af631f408bb3
  DownloadedAt: 2025-02-17 16:16:42.690613 +0000 UTC

Checklist

Run trivy clean --all
Read the troubleshooting

nikpivkin · 2025-02-18T05:00:40Z

nikpivkin
Feb 18, 2025
Maintainer

Hi @Redm0nd ! Thanks for the report.

I'm already investigating the problem.

0 replies

nikpivkin · 2025-02-18T05:00:54Z

nikpivkin
Feb 18, 2025
Maintainer

Duplicate of #8383

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

panic: WithoutOptionalAttributesDeep does not support the given type #8414

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments

{{title}}

{{title}}

Select a reply

panic: WithoutOptionalAttributesDeep does not support the given type #8414

Redm0nd Feb 17, 2025

Description

Desired Behavior

Actual Behavior

Reproduction Steps

Target

Scanner

Output Format

Mode

Debug Output

Operating System

Version

Checklist

Replies: 2 comments

nikpivkin Feb 18, 2025 Maintainer

nikpivkin Feb 18, 2025 Maintainer

Redm0nd
Feb 17, 2025

nikpivkin
Feb 18, 2025
Maintainer

nikpivkin
Feb 18, 2025
Maintainer