Does Trivy correctly handle variables in terraform configuration files? #7731
Answered
by
nikpivkin
ledmonster
asked this question in
Q&A
-
QuestionDoes Trivy correctly handle variables in terraform configuration files? When I run I see many following errors on for_each blocks which use variables. Does PR #7612 fix the issue? Exampleresource "google_project_iam_custom_role" "example" {
role_id = "example"
title = "example"
description = "example"
permissions = []
}
resource "google_project_iam_member" "example" {
for_each = toset([
google_project_iam_custom_role.example.name,
])
project = "example"
member = "group:foo@example.com"
role = each.value
}If I remove following two cases have no error logs. TargetFilesystem ScannerMisconfiguration Output FormatTable ModeStandalone Operating SystemUbuntu 22.04 Version$ trivy --version
Version: 0.56.2
Vulnerability DB:
Version: 2
UpdatedAt: 2024-06-13 06:11:38.07539382 +0000 UTC
NextUpdate: 2024-06-13 12:11:38.075393419 +0000 UTC
DownloadedAt: 2024-06-13 09:08:49.199239607 +0000 UTC
Java DB:
Version: 1
UpdatedAt: 2024-06-13 01:03:26.782257844 +0000 UTC
NextUpdate: 2024-06-16 01:03:26.782257723 +0000 UTC
DownloadedAt: 2024-06-13 05:25:38.436633939 +0000 UTC
Check Bundle:
Digest: sha256:ae151c4eecf35c507d8f866121ddfbf46540b041bc7bca7cdd8d9f70ceb6f12c
DownloadedAt: 2024-10-14 13:40:42.38290652 +0000 UTC |
Beta Was this translation helpful? Give feedback.
Answered by
nikpivkin
Oct 15, 2024
Replies: 1 comment 1 reply
-
|
Hi @ledmonster ! Trivy performs a static scan of the Terraform configuration, so it knows nothing about the state of the resources. In the example, you are referring to the resource "google_project_iam_member" "example" {
for_each = toset([
google_project_iam_custom_role.example.id,
])
project = "example"
member = "group:foo@example.com"
role = each.value
}
|
Beta Was this translation helpful? Give feedback.
1 reply
-
|
Thank you for the useful tips. I'll try with |
Beta Was this translation helpful? Give feedback.
Answer selected by
ledmonster
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi @ledmonster !
Trivy performs a static scan of the Terraform configuration, so it knows nothing about the state of the resources. In the example, you are referring to the
nameattribute of thegoogle_project_iam_custom_roleresource, about which nothing is known at the time of the scan, so it is null. Beforehand, we fill in the id of the resources and some other attributes. If I refer to theidattribute, which is equivalent toname, I don't get any errors: