Terraform files not detected

[tetienne]

Description

trivy does not seems to detect my terraform files, while tfsec yes.

Desired Behavior

My Terraform code must be detected.

Actual Behavior

❯ ls -a
.                   ..                  .terraform          .terraform.lock.hcl main.tf             outputs.tf          security_groups.tf  subnets.tf          variables.tf        versions.tf         vpc.tf

❯ trivy config --skip-dirs="**/.terraform" -d .
2023-11-14T17:39:24.315+0100	DEBUG	Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-11-14T17:39:24.326+0100	DEBUG	cache dir:  /Users/thibautetienne/Library/Caches/trivy
2023-11-14T17:39:24.326+0100	INFO	Misconfiguration scanning is enabled
2023-11-14T17:39:24.326+0100	DEBUG	Policies successfully loaded from disk
2023-11-14T17:39:24.345+0100	DEBUG	The nuget packages directory couldn't be found. License search disabled
2023-11-14T17:39:24.345+0100	DEBUG	Walk the file tree rooted at '.' in parallel
2023-11-14T17:39:24.346+0100	DEBUG	Skipping directory: .terraform
2023-11-14T17:39:24.346+0100	DEBUG	Scanning Terraform files for misconfigurations...
2023-11-14T17:39:24.824+0100	DEBUG	OS is not detected.
2023-11-14T17:39:24.824+0100	INFO	Detected config files: 0

❯ tfsec --exclude-downloaded-modules .

...


  4 passed, 128 ignored, 2 potential problem(s) detected.

Reproduction Steps

1. trivy config --skip-dirs="**/.terraform"  .

Target

None

Scanner

Misconfiguration

Output Format

None

Mode

Standalone

Debug Output

❯ trivy config --skip-dirs="**/.terraform" -d .
2023-11-14T17:37:06.510+0100	DEBUG	Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-11-14T17:37:06.521+0100	DEBUG	cache dir:  /Users/thibautetienne/Library/Caches/trivy
2023-11-14T17:37:06.521+0100	INFO	Misconfiguration scanning is enabled
2023-11-14T17:37:06.522+0100	DEBUG	Policies successfully loaded from disk
2023-11-14T17:37:06.536+0100	DEBUG	The nuget packages directory couldn't be found. License search disabled
2023-11-14T17:37:06.543+0100	DEBUG	Walk the file tree rooted at '.' in parallel
2023-11-14T17:37:06.544+0100	DEBUG	Skipping directory: .terraform
2023-11-14T17:37:06.544+0100	DEBUG	Scanning Terraform files for misconfigurations...
2023-11-14T17:37:07.023+0100	DEBUG	OS is not detected.
2023-11-14T17:37:07.023+0100	INFO	Detected config files: 0

Operating System

MacOS Ventura 13.4

Version

Version: 0.47.0
Policy Bundle:
  Digest: sha256:1df8ade71efc830877ca3b1130f83e0c6368e3a45b0d4c0f0418955501644054
  DownloadedAt: 2023-11-14 16:21:14.443268 +0000 UTC

Checklist

• Run trivy image --reset
• Read the troubleshooting

[simar7]

Can you share your terraform code with us so we can reproduce?

[tetienne]

Sure, here it is.

If you comment the vpc module declaration, you will got the default vpc error returned. But if you keep it, no error are returned, and no detected config files too.

terraform {
  required_version = ">= 1.5.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.24.0"
    }
  }
}

provider "aws" {
  region = "eu-west-1"

  default_tags {
    tags = {
      Managed-By = "terraform"
    }
  }
}

data "aws_availability_zones" "available" {}

locals {
  vpc_cidr = "10.0.0.0/16"
  azs      = slice(data.aws_availability_zones.available.names, 0, 3)
}

resource "aws_default_vpc" "default" {
  assign_generated_ipv6_cidr_block = true
  tags = {
    "DEPARTMENT"  = "IT",
    "NAME"        = "VPC"
    "TYPE"        = "VPC"
    "ENVIRONMENT" = "PROD"
    "Name"        = "Main VPC"
  }
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.1.2"

  name             = "on-demand-vpc"
  cidr             = local.vpc_cidr
  azs              = local.azs
  private_subnets  = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]
  public_subnets   = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k + 4)]
  database_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k + 8)]

  enable_nat_gateway = true

  create_database_subnet_route_table = true

  enable_ipv6 = true

  public_subnet_ipv6_prefixes   = [0, 1, 2]
  private_subnet_ipv6_prefixes  = [3, 4, 5]
  database_subnet_ipv6_prefixes = [6, 7, 8]
}

[nikpivkin]

Hi @tetienne !

This issue will be fixed in the next release #5414

or you can use the canary release:

docker run --rm -it -v .:/workspace --workdir /workspace -v $HOME/Library/Caches:/root/.cache/ ghcr.io/aquasecurity/trivy:canary conf . -d
2023-11-15T08:04:37.391Z        DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-11-15T08:04:37.392Z        DEBUG   cache dir:  /root/.cache/trivy
2023-11-15T08:04:37.392Z        INFO    Misconfiguration scanning is enabled
2023-11-15T08:04:37.393Z        DEBUG   Policies successfully loaded from disk
2023-11-15T08:04:37.547Z        DEBUG   The nuget packages directory couldn't be found. License search disabled
2023-11-15T08:04:37.547Z        DEBUG   Walk the file tree rooted at '.' in series
2023-11-15T08:04:37.548Z        DEBUG   Scanning Terraform files for misconfigurations...
2023-11-15T08:04:41.215Z        DEBUG   OS is not detected.
2023-11-15T08:04:41.215Z        INFO    Detected config files: 3
2023-11-15T08:04:41.215Z        DEBUG   Scanned config file: main.tf
2023-11-15T08:04:41.215Z        DEBUG   Scanned config file: .
2023-11-15T08:04:41.215Z        DEBUG   Scanned config file: git::https:/github.com/terraform-aws-modules/terraform-aws-vpc?ref=v5.1.2/main.tf

[tetienne]

@nikpivkin Many thx, it’s indeed the same root cause, and the canary version is well working for me.
I’m just now wondering if a hahe to add the flag --tf-exclude-downloaded-modules flag to my command line as I got so many issues :)