Trivy crashes when scanning a configuration with unknown var values

[nikpivkin]

Description

Example config:

resource "aws_iam_role" "stepfunction_ecs_task_execution_role" {
  name = "${var.app_prefix}-ECS-TaskExecution-Role"
  assume_role_policy = {}
}

resource "aws_iam_role_policy_attachment" "ecs-task-execution-role-policy-attachment" {
  role       = "${aws_iam_role.stepfunction_ecs_task_execution_role.name}"
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

Desired Behavior

Scanning without falling

Actual Behavior

Scanning failed

Reproduction Steps

1. go build ./cmd/trivy
2. ./trivy conf main.tf

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

❯ ./trivy conf . -d
2025-04-25T20:35:40+06:00       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2025-04-25T20:35:40+06:00       DEBUG   Cache dir       dir="/Users/nikita/Library/Caches/trivy"
2025-04-25T20:35:40+06:00       DEBUG   Cache dir       dir="/Users/nikita/Library/Caches/trivy"
2025-04-25T20:35:40+06:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-04-25T20:35:40+06:00       INFO    [misconfig] Misconfiguration scanning is enabled
2025-04-25T20:35:40+06:00       DEBUG   [misconfig] Checks successfully loaded from disk
2025-04-25T20:35:40+06:00       DEBUG   [rego] Overriding filesystem for checks
2025-04-25T20:35:40+06:00       DEBUG   [rego] Embedded libraries are loaded    count=17
2025-04-25T20:35:40+06:00       DEBUG   [rego] Embedded checks are loaded       count=516
2025-04-25T20:35:40+06:00       DEBUG   [rego] Checks from disk are loaded      count=533
2025-04-25T20:35:40+06:00       DEBUG   [rego] Overriding filesystem for data
2025-04-25T20:35:40+06:00       DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-04-25T20:35:40+06:00       DEBUG   Initializing scan cache...      type="memory"
2025-04-25T20:35:40+06:00       DEBUG   [fs] Analyzing...       root="."
2025-04-25T20:35:40+06:00       DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Terraform"
2025-04-25T20:35:40+06:00       DEBUG   [terraform scanner] Scanning directory  file_path="."
2025-04-25T20:35:40+06:00       DEBUG   [terraform parser] Setting project/module root  module="root" file_path="."
2025-04-25T20:35:40+06:00       DEBUG   [terraform parser] Parsing FS   module="root" file_path="."
2025-04-25T20:35:40+06:00       DEBUG   [terraform parser] Parsing      module="root" file_path="main.tf"
2025-04-25T20:35:40+06:00       DEBUG   [terraform parser] Added file   module="root" file_path="main.tf"
2025-04-25T20:35:40+06:00       INFO    [terraform scanner] Scanning root module        file_path="."
2025-04-25T20:35:40+06:00       DEBUG   [terraform parser] Setting project/module root  module="root" file_path="."
2025-04-25T20:35:40+06:00       DEBUG   [terraform parser] Parsing FS   module="root" file_path="."
2025-04-25T20:35:40+06:00       DEBUG   [terraform parser] Parsing      module="root" file_path="main.tf"
2025-04-25T20:35:40+06:00       DEBUG   [terraform parser] Added file   module="root" file_path="main.tf"
2025-04-25T20:35:40+06:00       DEBUG   [terraform parser] Loading module       module="root" module="root"
2025-04-25T20:35:40+06:00       DEBUG   [terraform parser] Read block(s) and ignore(s)  module="root" blocks=2 ignores=0
2025-04-25T20:35:40+06:00       DEBUG   [terraform parser] Added input variables from tfvars    module="root" count=0
2025-04-25T20:35:40+06:00       DEBUG   [terraform parser] Working directory for module evaluation      module="root" file_path="/Users/nikita/projects/trivy-test/tf-iam"
2025-04-25T20:35:40+06:00       DEBUG   [terraform evaluator] Starting module evaluation...     module="root" path="."
2025-04-25T20:35:40+06:00       DEBUG   [terraform evaluator] Starting iteration        module="root" iteration=0
2025-04-25T20:35:40+06:00       DEBUG   [terraform evaluator] Starting iteration        module="root" iteration=1
2025-04-25T20:35:40+06:00       DEBUG   [terraform evaluator] Starting iteration        module="root" iteration=2
2025-04-25T20:35:40+06:00       DEBUG   [terraform evaluator] Context unchanged module="root" iteration=2
2025-04-25T20:35:40+06:00       DEBUG   [terraform evaluator] Starting post-submodules evaluation...    module="root"
2025-04-25T20:35:40+06:00       DEBUG   [terraform evaluator] Starting iteration        module="root" iteration=0
2025-04-25T20:35:40+06:00       DEBUG   [terraform evaluator] Starting iteration        module="root" iteration=1
2025-04-25T20:35:40+06:00       DEBUG   [terraform evaluator] Context unchanged module="root" iteration=1
2025-04-25T20:35:40+06:00       DEBUG   [terraform evaluator] Module evaluation complete.       module="root"
2025-04-25T20:35:40+06:00       DEBUG   [terraform parser] Finished parsing module      module="root"
2025-04-25T20:35:40+06:00       DEBUG   [terraform executor] Adapting modules...
panic: value is unknown

goroutine 1 [running]:
github.com/zclconf/go-cty/cty.Value.AsString({{{0x10b757b60?, 0x140003293a9?}}, {0x10ab62e80?, 0x1400572fb90?}})
        /Users/nikita/go/pkg/mod/github.com/zclconf/[email protected]/cty/value_ops.go:1416 +0x100
github.com/aquasecurity/trivy/pkg/iac/terraform.(*Attribute).Equals(0x14005728500, {0x10a891fa0, 0x140057564e0}, {0x0, 0x0, 0x0?})
        /Users/nikita/projects/trivy/pkg/iac/terraform/attribute.go:618 +0x220
github.com/aquasecurity/trivy/pkg/iac/adapters/terraform/aws/iam.isDependentBlock(0x14000602fc0, {0x109060c03?, 0x4?}, 0x14005728500)
        /Users/nikita/projects/trivy/pkg/iac/adapters/terraform/aws/iam/policies.go:97 +0xf8
github.com/aquasecurity/trivy/pkg/iac/adapters/terraform/aws/iam.applyForDependentResource[...]({0x14004ac27e0?, 0x1, 0x2}, {0x14003ecb9e0?, 0x24}, {0x109060c03, 0x4}, {0x10915506b, 0x14002c8cd40?}, {0x1090610b3?, ...}, ...)
        /Users/nikita/projects/trivy/pkg/iac/adapters/terraform/aws/iam/policies.go:87 +0x174
github.com/aquasecurity/trivy/pkg/iac/adapters/terraform/aws/iam.adaptRoles({0x14004ac27e0, 0x1, 0x1})
        /Users/nikita/projects/trivy/pkg/iac/adapters/terraform/aws/iam/roles.go:28 +0x49c
github.com/aquasecurity/trivy/pkg/iac/adapters/terraform/aws/iam.Adapt({_, _, _})
        /Users/nikita/projects/trivy/pkg/iac/adapters/terraform/aws/iam/adapt.go:14 +0xcc
github.com/aquasecurity/trivy/pkg/iac/adapters/terraform/aws.Adapt({_, _, _})
        /Users/nikita/projects/trivy/pkg/iac/adapters/terraform/aws/adapt.go:64 +0x4cc
github.com/aquasecurity/trivy/pkg/iac/adapters/terraform.Adapt({0x14004ac27e0, 0x1, 0x1})
        /Users/nikita/projects/trivy/pkg/iac/adapters/terraform/adapt.go:20 +0x3c
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/executor.(*Executor).Execute(0x14005717480, {0x10b7554a8, 0x1400570c5a0}, {0x14004ac27e0, 0x1, 0x1}, {0x10a3df0e8, 0x1})
        /Users/nikita/projects/trivy/pkg/iac/scanners/terraform/executor/executor.go:44 +0x84
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform.(*Scanner).ScanFS(0x1400539d950, {0x10b7554a8, 0x1400570c5a0}, {0x10b6daca0, 0x14003d97008}, {0x10a3df0e8, 0x1})
        /Users/nikita/projects/trivy/pkg/iac/scanners/terraform/scanner.go:134 +0x854
github.com/aquasecurity/trivy/pkg/misconf.(*Scanner).Scan(0x14005705a00, {0x10b755550, 0x140005ac000}, {0x10b6daca0, 0x14003d96fd8})
        /Users/nikita/projects/trivy/pkg/misconf/scanner.go:153 +0x220
github.com/aquasecurity/trivy/pkg/fanal/analyzer/config.(*Analyzer).PostAnalyze(0x14005703860, {0x10b755550?, 0x140005ac000?}, {{0x10b6daca0, 0x14003d96fd8}, {0x0, 0x0, 0x0}, {0x0, 0x0}})
        /Users/nikita/projects/trivy/pkg/fanal/analyzer/config/config.go:44 +0x50
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze({0x14005700ee0, {0x14005705900, 0x3, 0x4}, {0x14001c0bc00, 0x8, 0x8}, 0x140056f1350, {0x0, 0x0}}, ...)
        /Users/nikita/projects/trivy/pkg/fanal/analyzer/analyzer.go:521 +0x2f8
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect({{0x16b942dc5, 0x1}, 0x140057015a0, {0x11b0852f0, 0x140039a54a0}, {0x10b6dabc0, 0x10f126248}, {0x14005700ee0, {0x14005705900, 0x3, ...}, ...}, ...}, ...)
        /Users/nikita/projects/trivy/pkg/fanal/artifact/local/fs.go:193 +0x580
github.com/aquasecurity/trivy/pkg/scan.Service.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0x0, 0x0, 0x0}, {0x0, ...}, ...})
        /Users/nikita/projects/trivy/pkg/scan/service.go:164 +0xa0
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan(_, {_, _}, {{{0x10908abaa, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
        /Users/nikita/projects/trivy/pkg/commands/artifact/run.go:651 +0x2b4
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x10908abaa, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
        /Users/nikita/projects/trivy/pkg/commands/artifact/run.go:261 +0x8c
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanFS(_, {_, _}, {{{0x10908abaa, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
        /Users/nikita/projects/trivy/pkg/commands/artifact/run.go:206 +0x9c
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanFilesystem(_, {_, _}, {{{0x10908abaa, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
        /Users/nikita/projects/trivy/pkg/commands/artifact/run.go:186 +0x1a8
github.com/aquasecurity/trivy/pkg/commands/artifact.run({_, _}, {{{0x10908abaa, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x14001201bf0, ...}, ...}, ...}, ...)
        /Users/nikita/projects/trivy/pkg/commands/artifact/run.go:422 +0x634
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x10908abaa, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x14001201bf0, ...}, ...}, ...}, ...)
        /Users/nikita/projects/trivy/pkg/commands/artifact/run.go:384 +0x2dc
github.com/aquasecurity/trivy/pkg/commands.NewConfigCommand.func2(0x14000bbc908, {0x14000031b40, 0x1, 0x2})
        /Users/nikita/projects/trivy/pkg/commands/app.go:748 +0x27c
github.com/spf13/cobra.(*Command).execute(0x14000bbc908, {0x14000031ae0, 0x2, 0x2})
        /Users/nikita/go/pkg/mod/github.com/spf13/[email protected]/command.go:1015 +0x828
github.com/spf13/cobra.(*Command).ExecuteC(0x14001084908)
        /Users/nikita/go/pkg/mod/github.com/spf13/[email protected]/command.go:1148 +0x350
github.com/spf13/cobra.(*Command).Execute(0x1090edd68?)
        /Users/nikita/go/pkg/mod/github.com/spf13/[email protected]/command.go:1071 +0x1c
main.run()
        /Users/nikita/projects/trivy/cmd/trivy/main.go:45 +0x124
main.main()
        /Users/nikita/projects/trivy/cmd/trivy/main.go:19 +0x20

Operating System

macOS

Version

canary, 427a18ef06f6d5adaa0c4c1265e4817143a1c4b0

Checklist

• Run trivy clean --all
• Read the troubleshooting

[nikpivkin]

Track #8779