[terraform evaluator] Failed to load module (no such file or directory)

[jpdoria]

Description

Trivy reports that the modules don't exist but Terraform works fine. Related issue: #7920.

Desired Behavior

Modules and submodules should be detected.

Actual Behavior

2025-06-24T20:20:00+08:00	INFO	[misconfig] Misconfiguration scanning is enabled
2025-06-24T20:23:49+08:00	INFO	[terraform scanner] Scanning root module	file_path="01-central"
2025-06-24T20:23:50+08:00	WARN	[terraform parser] Variable values were not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="aws_accounts, aws_profile, container_version, environment, failover_region, namespace, region, siem_geolite2_license_key, vpc_cidr_man"
2025-06-24T20:23:50+08:00	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	module="root" err="open aws/modules/acm-request-certificate: no such file or directory"
2025-06-24T20:23:50+08:00	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	module="root" err="open aws/modules/acm-request-certificate: no such file or directory"
2025-06-24T20:23:50+08:00	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	module="root" err="open aws/modules/acm-request-certificate: no such file or directory"

Reproduction Steps

1.trivy clean --all
2.terraform init
3.trivy conf .

Target

None

Scanner

Misconfiguration

Output Format

None

Mode

Standalone

Debug Output

2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Expanded block into clones via 'count' attribute.	module="root" block="gpg_encrypted_message.elasticsearch_admin_password" clones=0
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Expanded block into clones via 'count' attribute.	module="root" block="module.codebuild_state_notifications_ecr_replication" clones=1
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Expanded block into clones via 'count' attribute.	module="root" block="module.ecr_replication" clones=1
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Expanded block into clones via 'for_each' attribute.	module="root" block="aws_secretsmanager_secret.this" clones=0
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Module resolved using modules.json	module="root" block="module.acm" source="github.com/foobar/infra.git//aws/modules/acm-request-certificate?ref=v12.0.1" modulePath="01-central/.terraform/modules/acm/aws/modules/acm-request-certificate/aws/modules/acm-request-certificate?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[terraform parser] Parsing FS	module="root" module="acm" file_path="01-central/.terraform/modules/acm/aws/modules/acm-request-certificate/aws/modules/acm-request-certificate?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Locating non-initialized module	module="root" source="github.com/foobar/infra.git//aws/modules/acm-request-certificate?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Resolving module	module="root" name="module.acm" source="github.com/foobar/infra.git//aws/modules/acm-request-certificate?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Trying to resolve module via cache	module="root" key="13a196ff613a9e65d2513eaf61ec107b"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Module resolved from cache	module="root" key="13a196ff613a9e65d2513eaf61ec107b"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Module resolved	module="root" file_path="aws/modules/acm-request-certificate"
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Module resolved	module="root" block="module.acm" source="github.com/foobar/infra.git//aws/modules/acm-request-certificate?ref=v12.0.1" prefix="github.com/foobar/infra.git/aws/modules/acm-request-certificate?ref=v12.0.1" file_path="aws/modules/acm-request-certificate"
2025-06-24T23:40:06+08:00	DEBUG	[terraform parser] Parsing FS	module="root" module="acm" file_path="aws/modules/acm-request-certificate"
2025-06-24T23:40:06+08:00	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	module="root" err="open aws/modules/acm-request-certificate: no such file or directory"
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Module resolved using modules.json	module="root" block="module.acm_internal" source="github.com/foobar/infra.git//aws/modules/acm-request-certificate?ref=v12.0.1" modulePath="01-central/.terraform/modules/acm_internal/aws/modules/acm-request-certificate/aws/modules/acm-request-certificate?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[terraform parser] Parsing FS	module="root" module="acm_internal" file_path="01-central/.terraform/modules/acm_internal/aws/modules/acm-request-certificate/aws/modules/acm-request-certificate?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Locating non-initialized module	module="root" source="github.com/foobar/infra.git//aws/modules/acm-request-certificate?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Resolving module	module="root" name="module.acm_internal" source="github.com/foobar/infra.git//aws/modules/acm-request-certificate?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Trying to resolve module via cache	module="root" key="13a196ff613a9e65d2513eaf61ec107b"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Module resolved from cache	module="root" key="13a196ff613a9e65d2513eaf61ec107b"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Module resolved	module="root" file_path="aws/modules/acm-request-certificate"
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Module resolved	module="root" block="module.acm_internal" source="github.com/foobar/infra.git//aws/modules/acm-request-certificate?ref=v12.0.1" prefix="github.com/foobar/infra.git/aws/modules/acm-request-certificate?ref=v12.0.1" file_path="aws/modules/acm-request-certificate"
2025-06-24T23:40:06+08:00	DEBUG	[terraform parser] Parsing FS	module="root" module="acm_internal" file_path="aws/modules/acm-request-certificate"
2025-06-24T23:40:06+08:00	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	module="root" err="open aws/modules/acm-request-certificate: no such file or directory"
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Module resolved using modules.json	module="root" block="module.acm_us_east_1" source="github.com/foobar/infra.git//aws/modules/acm-request-certificate?ref=v12.0.1" modulePath="01-central/.terraform/modules/acm_us_east_1/aws/modules/acm-request-certificate/aws/modules/acm-request-certificate?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[terraform parser] Parsing FS	module="root" module="acm_us_east_1" file_path="01-central/.terraform/modules/acm_us_east_1/aws/modules/acm-request-certificate/aws/modules/acm-request-certificate?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Locating non-initialized module	module="root" source="github.com/foobar/infra.git//aws/modules/acm-request-certificate?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Resolving module	module="root" name="module.acm_us_east_1" source="github.com/foobar/infra.git//aws/modules/acm-request-certificate?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Trying to resolve module via cache	module="root" key="13a196ff613a9e65d2513eaf61ec107b"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Module resolved from cache	module="root" key="13a196ff613a9e65d2513eaf61ec107b"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Module resolved	module="root" file_path="aws/modules/acm-request-certificate"
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Module resolved	module="root" block="module.acm_us_east_1" source="github.com/foobar/infra.git//aws/modules/acm-request-certificate?ref=v12.0.1" prefix="github.com/foobar/infra.git/aws/modules/acm-request-certificate?ref=v12.0.1" file_path="aws/modules/acm-request-certificate"
2025-06-24T23:40:06+08:00	DEBUG	[terraform parser] Parsing FS	module="root" module="acm_us_east_1" file_path="aws/modules/acm-request-certificate"
2025-06-24T23:40:06+08:00	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	module="root" err="open aws/modules/acm-request-certificate: no such file or directory"
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Module resolved using modules.json	module="root" block="module.alb_man_external" source="github.com/foobar/infra.git//aws/modules/alb?ref=v12.0.1" modulePath="01-central/.terraform/modules/alb_man_external/aws/modules/alb/aws/modules/alb?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[terraform parser] Parsing FS	module="root" module="alb_man_external" file_path="01-central/.terraform/modules/alb_man_external/aws/modules/alb/aws/modules/alb?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Locating non-initialized module	module="root" source="github.com/foobar/infra.git//aws/modules/alb?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Resolving module	module="root" name="module.alb_man_external" source="github.com/foobar/infra.git//aws/modules/alb?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Trying to resolve module via cache	module="root" key="13a196ff613a9e65d2513eaf61ec107b"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Module resolved from cache	module="root" key="13a196ff613a9e65d2513eaf61ec107b"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Module resolved	module="root" file_path="aws/modules/alb"
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Module resolved	module="root" block="module.alb_man_external" source="github.com/foobar/infra.git//aws/modules/alb?ref=v12.0.1" prefix="github.com/foobar/infra.git/aws/modules/alb?ref=v12.0.1" file_path="aws/modules/alb"
2025-06-24T23:40:06+08:00	DEBUG	[terraform parser] Parsing FS	module="root" module="alb_man_external" file_path="aws/modules/alb"
2025-06-24T23:40:06+08:00	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	module="root" err="open aws/modules/alb: no such file or directory"
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Module resolved using modules.json	module="root" block="module.alpha_ci_access_keys" source="github.com/foobar/infra.git//aws/modules/iam-rotatable-access-keys?ref=v12.0.1" modulePath="01-central/.terraform/modules/alpha_ci_access_keys/aws/modules/iam-rotatable-access-keys/aws/modules/iam-rotatable-access-keys?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[terraform parser] Parsing FS	module="root" module="alpha_ci_access_keys" file_path="01-central/.terraform/modules/alpha_ci_access_keys/aws/modules/iam-rotatable-access-keys/aws/modules/iam-rotatable-access-keys?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[terraform evaluator] Locating non-initialized module	module="root" source="github.com/foobar/infra.git//aws/modules/iam-rotatable-access-keys?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Resolving module	module="root" name="module.alpha_ci_access_keys" source="github.com/foobar/infra.git//aws/modules/iam-rotatable-access-keys?ref=v12.0.1"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Trying to resolve module via cache	module="root" key="13a196ff613a9e65d2513eaf61ec107b"
2025-06-24T23:40:06+08:00	DEBUG	[module resolver] Module resolved from cache	module="root" key="13a196ff613a9e65d2513eaf61ec107b"

Operating System

macOS Sequioa 15.5 (24F74)

Version

❯ trivy --version
Version: 0.63.0
Check Bundle:
  Digest: sha256:a471e90b7c7335e914ec9075b74cf8f65e4c91e6cecfa7e39c587382808d2684
  DownloadedAt: 2025-06-24 12:00:56.752182 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[nikpivkin]

Hi @jpdoria !

Is github.com/foobar/infra a private repository?

[nikpivkin]

So the acm-request-certificate module contains the label module with a source like ../label ? I am confused by the path file_path=‘01-central/.terraform/modules/acm_internal/aws/modules/acm-request-certificate/aws/modules/acm-request-certificate?ref=v12.0.1’ . It looks as if acm-request-certificate is referencing itself.

I think the structure and relationships of the modules will help reproduce the problem.

[jpdoria]

Apologies for my late response. Yes, the label module is in the same repository as acm-request-certificate, and this uses the terraform-null-label as the source.

Here's the acm-request-certificate's main.tf:

module "label" {
  source      = "../label"
  ...
}

resource "aws_acm_certificate" "default" {
  ...
}

resource "aws_route53_record" "default" {
  ...
}

resource "aws_acm_certificate_validation" "default" {
  ...
}

And, here's the label's main.tf:

module "label" {
  source  = "cloudposse/label/null"
  version = "0.25.0"
  ...
}

[jpdoria]

Hi @nikpivkin, I'd like to know if you were able to reproduce the issue. Please let me know if you need additional info. Thank you.

[nikpivkin]

Hi! Sorry for my late reply. I have created a configuration with a structure similar to yours, but I have not been able to reproduce the problem and all modules are loading successfully. Could there be something non-standard in your terraform setup? For example, redefining the default settings? Sometimes the most difficult thing in solving a problem is reproducing it.

Can you show the contents of the .terraform/modules/modules.json file?

[nikpivkin]

@jpdoria I seem to have reproduced the problem.

[nikpivkin]

Track #9297

[jpdoria]

Thanks a lot, @nikpivkin. Really appreciate your help.