Trivy errors while scanning for misconfiguration in terraform

[majchrzw]

Question

Hi, I'm trying to use trivy to perform checks in my terraform configuration in CI pipelines, but I'm encountering a few things that I don't understand. Main issue for me is that when using command trivy config . which should scan all files from this directory, I encounter error:

ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.

I am aware of what this error means (same as in other issues here), but I don't understand trivy behavior after this error. I have let's say 10 directories I want to scan but I can see trivy scanning only first two when encountering this error based on this log:

INFO Detected config files num=2

When I delete terraform configs that cause the error, trivy scans only 3 modules and stops working which is also strange for me, because there are many more config files in this directory.

INFO Detected config files num=3

So I assume that trivy failed after this error and stopped working, yet returned status 0. This leads my pipeline to thinking that job was successful, but in my opinion it failed. Therefore I want to ask, whether this is expected, and how should I handle such errors in my pipeline. Also how can I ensure that all directories are scanned. The issue is present in my CI pipeline, but also occurs when running locally.

Target

Container Image

Scanner

Misconfiguration

Output Format

None

Mode

Standalone

Operating System

macOS Sonoma

Version

Version: 0.57.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-11-13 12:18:59.293858632 +0000 UTC
  NextUpdate: 2024-11-14 12:18:59.293858261 +0000 UTC
  DownloadedAt: 2024-11-14 13:06:40.368737 +0000 UTC
Check Bundle:
  Digest: sha256:9cc30e6eb1c0dc0b4a4791b61c3dbff8799d08daeac893c08317e7b054ecab14
  DownloadedAt: 2024-11-14 12:23:55.90071 +0000 UTC

[simar7]

hi @majchrzw are you able to share your project layout? It'll help us understand better but to answer your questions:

I want to scan but I can see trivy scanning only first two when encountering this error based on this log:
INFO Detected config files num=2

Not quite, it means it found 2 relevant config files. The others might not be relevant or valid for the kind scan you are running.

So I assume that trivy failed after this error and stopped working, yet returned status 0. This leads my pipeline to thinking that job was successful, but in my opinion it failed. Therefore I want to ask, whether this is expected, and how should I handle such errors in my pipeline.

This output simply shows how many config files were scanned. It doesn't convey anything about success or failure.

[majchrzw]

Thanks for answering @simar7, my project layout look like this:

terraform-modules
├── README.md
├── junit.tpl
└── modules
    ├── network
    │   ├── context.tf
    │   ├── dns_namespace.tf
    │   ├── gateway_endpoinst.tf
    │   ├── igw.tf
    │   ├── mappings.tf
    │   ├── nat.tf
    │   ├── outputs.tf
    │   ├── route_tables.tf
    │   ├── subnets.tf
    │   ├── variables.tf
    │   ├── versions.tf
    │   └── vpc.tf
    ├── cloudwatch
    │   ├── cloudwatch.tf
    │   ├── context.tf
    │   ├── mappings.tf
    │   ├── outputs.tf
    │   ├── variables.tf
    │   └── versions.tf
    ├── default-security-group
    │   ├── context.tf
    │   ├── default_security_group.tf
    │   ├── mappings.tf
    │   ├── outputs.tf
    │   ├── variables.tf
    │   └── versions.tf
    ├── discovery-private-dns-namespace
    │   ├── context.tf
    │   ├── mappings.tf
    │   ├── namespace.tf
    │   ├── outputs.tf
    │   └── variables.tf
    ├── elastic-ip-address
    │   ├── context.tf
    │   ├── eip.tf
    │   ├── mappings.tf
    │   ├── outputs.tf
    │   ├── variables.tf
    │   └── versions.tf
    ├── flow-log
    │   ├── context.tf
    │   ├── flow_log.tf
    │   ├── flow_log_assume_policy.tf
    │   ├── flow_log_cloudwatch.tf
    │   ├── flow_log_role.tf
    │   ├── mappings.tf
    │   ├── outputs.tf
    │   ├── variables.tf
    │   └── versions.tf
    ├── iam-role
    │   ├── context.tf
    │   ├── mappings.tf
    │   ├── outputs.tf
    │   ├── role.tf
    │   ├── role_default_assume_role_policy.tf
    │   ├── variables.tf
    │   └── versions.tf
    ├── internet-gateway
    │   ├── context.tf
    │   ├── igw.tf
    │   ├── mappings.tf
    │   ├── outputs.tf
    │   ├── variables.tf
    │   └── versions.tf
    ├── key-management-service
    │   ├── context.tf
    │   ├── kms.tf
    │   ├── mappings.tf
    │   ├── outputs.tf
    │   ├── variables.tf
    │   └── versions.tf
    ├── network-address-translation
    │   ├── context.tf
    │   ├── eip.tf
    │   ├── mappings.tf
    │   ├── nat.tf
    │   ├── outputs.tf
    │   ├── variables.tf
    │   └── versions.tf
    ├── route-table
    │   ├── context.tf
    │   ├── mappings.tf
    │   ├── outputs.tf
    │   ├── route_table.tf
    │   ├── variables.tf
    │   └── versions.tf
    ├── subnet
    │   ├── context.tf
    │   ├── mappings.tf
    │   ├── outputs.tf
    │   ├── subnet.tf
    │   ├── variables.tf
    │   └── versions.tf
    ├── virtual-private-cloud
    │   ├── context.tf
    │   ├── default_security_group.tf
    │   ├── flow_log.tf
    │   ├── mappings.tf
    │   ├── outputs.tf
    │   ├── variables.tf
    │   ├── versions.tf
    │   └── vpc.tf
    └── vpc-gateway-endpoint
        ├── context.tf
        ├── mappings.tf
        ├── outputs.tf
        ├── variables.tf
        ├── versions.tf
        └── vpc_gateway_endpoint.tf

And I'm running trivy from terraform-modules directory, so I assume that it should pick up all config files from all directories inside it, therefore I thought that outputting info about scanning 2 config files means some kind of failure.