terraform module ${path.module} panic

[alyvusal]

Description

I have used such import in terraform code

module "test" {
  source      = "${path.module}/../../modules/local"
  environment = "PROD"
}

got

2025-08-28T13:44:44+04:00       DEBUG   Cleaning up temp directory      path="/tmp/trivy-89702"
panic: value is unknown

goroutine 1 [running]:
github.com/zclconf/go-cty/cty.Value.AsString({{{0x6611310?, 0xc0002a51c9?}}, {0x4a2fc00?, 0xc00678b1d0?}})
        /home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/value_ops.go:1416 +0xf8
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.buildGraph({0xc00679a820, 0x4, 0x1?}, {0xc00678ac20, 0x1, 0xc00040be30?})
        /home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/modules.go:55 +0x305
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*Parser).FindRootModules(0xc0067aa000, {0x660eda8, 0xc006797500}, {0xc00678ab90, 0x1, 0x2?})
        /home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/modules.go:34 +0x245
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform.(*Scanner).ScanFS(0xc0067902d0, {0x660eda8, 0xc006797500}, {0x65ad0a0, 0xc0067801f8}, {0x658ddc0, 0x1})
        /home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/scanner.go:105 +0x3bf
github.com/aquasecurity/trivy/pkg/misconf.(*Scanner).Scan(0xc00679e280, {0x660ee50, 0xc000937ea0}, {0x65ad0a0, 0xc0067801e0})
        /home/runner/work/trivy/trivy/pkg/misconf/scanner.go:149 +0x297
github.com/aquasecurity/trivy/pkg/fanal/analyzer/config.(*Analyzer).PostAnalyze(0xc00679a3a0, {0x660ee50?, 0xc000937ea0?}, {{0x65ad0a0, 0xc0067801e0}, {0x0, 0x0, 0x0}, {0x0, 0x0}})
        /home/runner/work/trivy/trivy/pkg/fanal/analyzer/config/config.go:44 +0x45
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze({0xc00678a0e0, {0xc00679a0a0, 0x2, 0x2}, {0xc00678a760, 0x1, 0x1}, 0xc006796240, {0x0, 0x0}}, ...)
        /home/runner/work/trivy/trivy/pkg/fanal/analyzer/analyzer.go:519 +0x399
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect({{0x7fff8bac9673, 0x39}, 0xc00678a880, {0x73074138b670, 0xc002143800}, {0x65acfc0, 0x9817b60}, {0xc00678a0e0, {0xc00679a0a0, 0x2, ...}, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/local/fs.go:235 +0x809
github.com/aquasecurity/trivy/pkg/scan.Service.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0x0, 0x0, 0x0}, {0x0, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/scan/service.go:164 +0xe7
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan(_, {_, _}, {{{0x541d106, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:677 +0x377
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x541d106, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:287 +0xc9
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanFS(_, {_, _}, {{{0x541d106, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:232 +0xc7
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanFilesystem(_, {_, _}, {{{0x541d106, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:212 +0x211
github.com/aquasecurity/trivy/pkg/commands/artifact.run({_, _}, {{{0x541d106, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0xc000d85998, ...}, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:448 +0x710
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x541d106, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0xc000d85998, ...}, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:410 +0x399
github.com/aquasecurity/trivy/pkg/commands.NewConfigCommand.func2(0xc000a1c908, {0xc0005a1170, 0x1, 0x9})
        /home/runner/work/trivy/trivy/pkg/commands/app.go:740 +0x2d3
github.com/spf13/cobra.(*Command).execute(0xc000a1c908, {0xc0005a10e0, 0x9, 0x9})
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1015 +0xaaa
github.com/spf13/cobra.(*Command).ExecuteC(0xc0008e7508)
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1148 +0x46f
github.com/spf13/cobra.(*Command).Execute(...)
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1071
github.com/spf13/cobra.(*Command).ExecuteContext(0x660ed70?, {0x660f160?, 0xc000ec72c0?})
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1064 +0x47
main.run()
        /home/runner/work/trivy/trivy/cmd/trivy/main.go:51 +0x19f
main.main()
        /home/runner/work/trivy/trivy/cmd/trivy/main.go:19 +0x1f

after remoing ${path.module} it worked

Desired Behavior

Scan and output result

Actual Behavior

Got panic

Reproduction Steps

1. Create simple terrafocm module
2. Use created module with ${path.module} in different folder
3. Scan with `trivy conf .`
...

Target

Filesystem

Scanner

Misconfiguration

Output Format

None

Mode

Standalone

Debug Output

2025-08-28T13:29:22+04:00       DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Terraform"
2025-08-28T13:29:22+04:00       DEBUG   [terraform scanner] Scanning directory  file_path="."
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Setting project/module root  module="root" file_path=".gitlab-ci-local/builds/.docker/envs/dev"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Parsing FS   module="root" file_path=".gitlab-ci-local/builds/.docker/envs/dev"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Parsing      module="root" file_path=".gitlab-ci-local/builds/.docker/envs/dev/main.tf"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Added file   module="root" file_path=".gitlab-ci-local/builds/.docker/envs/dev/main.tf"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Parsing FS   module="root" file_path=".gitlab-ci-local/builds/.docker/envs/prod"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Parsing      module="root" file_path=".gitlab-ci-local/builds/.docker/envs/prod/badcode.tf"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Added file   module="root" file_path=".gitlab-ci-local/builds/.docker/envs/prod/badcode.tf"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Parsing      module="root" file_path=".gitlab-ci-local/builds/.docker/envs/prod/main.tf"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Added file   module="root" file_path=".gitlab-ci-local/builds/.docker/envs/prod/main.tf"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Parsing FS   module="root" file_path=".gitlab-ci-local/builds/.docker/modules/local"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Parsing      module="root" file_path=".gitlab-ci-local/builds/.docker/modules/local/main.tf"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Added file   module="root" file_path=".gitlab-ci-local/builds/.docker/modules/local/main.tf"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Parsing FS   module="root" file_path="envs/dev"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Parsing      module="root" file_path="envs/dev/main.tf"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Added file   module="root" file_path="envs/dev/main.tf"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Parsing FS   module="root" file_path="envs/prod"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Parsing      module="root" file_path="envs/prod/badcode.tf"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Added file   module="root" file_path="envs/prod/badcode.tf"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Parsing      module="root" file_path="envs/prod/main.tf"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Added file   module="root" file_path="envs/prod/main.tf"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Parsing FS   module="root" file_path="modules/local"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Parsing      module="root" file_path="modules/local/main.tf"
2025-08-28T13:29:22+04:00       DEBUG   [terraform parser] Added file   module="root" file_path="modules/local/main.tf"
2025-08-28T13:29:22+04:00       DEBUG   Cleaning up temp directory      path="/tmp/trivy-76236"
panic: value is unknown

goroutine 1 [running]:
github.com/zclconf/go-cty/cty.Value.AsString({{{0x6611310?, 0xc000307089?}}, {0x4a2fc00?, 0xc003035250?}})
        /home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/value_ops.go:1416 +0xf8
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.buildGraph({0xc006a81700, 0x1c, 0x8?}, {0xc004588f60, 0x6, 0xc000ce45b0?})
        /home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/modules.go:55 +0x305
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*Parser).FindRootModules(0xc0008e8500, {0x660eda8, 0xc0028f3d40}, {0xc004588f00, 0x6, 0x2?})
        /home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/parser/modules.go:34 +0x245
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform.(*Scanner).ScanFS(0xc005246750, {0x660eda8, 0xc0028f3d40}, {0x65ad0a0, 0xc0043b5170}, {0x658ddc0, 0x1})
        /home/runner/work/trivy/trivy/pkg/iac/scanners/terraform/scanner.go:105 +0x3bf
github.com/aquasecurity/trivy/pkg/misconf.(*Scanner).Scan(0xc0055c2580, {0x660ee50, 0xc000aa0150}, {0x65ad0a0, 0xc003889bf0})
        /home/runner/work/trivy/trivy/pkg/misconf/scanner.go:149 +0x297
github.com/aquasecurity/trivy/pkg/fanal/analyzer/config.(*Analyzer).PostAnalyze(0xc005559080, {0x660ee50?, 0xc000aa0150?}, {{0x65ad0a0, 0xc003889bf0}, {0x0, 0x0, 0x0}, {0x0, 0x0}})
        /home/runner/work/trivy/trivy/pkg/fanal/analyzer/config/config.go:44 +0x45
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze({0xc0055b4b20, {0xc005558e40, 0x2, 0x2}, {0xc002273200, 0xa, 0x10}, 0xc0055c06c0, {0x0, 0x0}}, ...)
        /home/runner/work/trivy/trivy/pkg/fanal/analyzer/analyzer.go:519 +0x399
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect({{0x7ffe0c2eb597, 0x30}, 0xc0055b52c0, {0x7a3f051f0c20, 0xc0047fa900}, {0x65acfc0, 0x9817b60}, {0xc0055b4b20, {0xc005558e40, 0x2, ...}, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/local/fs.go:235 +0x809
github.com/aquasecurity/trivy/pkg/scan.Service.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0x0, 0x0, 0x0}, {0x0, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/scan/service.go:164 +0xe7
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan(_, {_, _}, {{{0x541d106, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:677 +0x377
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x541d106, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:287 +0xc9
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanFS(_, {_, _}, {{{0x541d106, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:232 +0xc7
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanFilesystem(_, {_, _}, {{{0x541d106, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:212 +0x211
github.com/aquasecurity/trivy/pkg/commands/artifact.run({_, _}, {{{0x541d106, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0xc000c0f9f8, ...}, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:448 +0x710
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x541d106, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0xc000c0f9f8, ...}, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:410 +0x399
github.com/aquasecurity/trivy/pkg/commands.NewConfigCommand.func2(0xc0011b6f08, {0xc001002e00, 0x1, 0xe})
        /home/runner/work/trivy/trivy/pkg/commands/app.go:740 +0x2d3
github.com/spf13/cobra.(*Command).execute(0xc0011b6f08, {0xc001002d20, 0xe, 0xe})
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1015 +0xaaa
github.com/spf13/cobra.(*Command).ExecuteC(0xc0009c1208)
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1148 +0x46f
github.com/spf13/cobra.(*Command).Execute(...)
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1071
github.com/spf13/cobra.(*Command).ExecuteContext(0x660ed70?, {0x660f160?, 0xc000ef2e40?})
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1064 +0x47
main.run()
        /home/runner/work/trivy/trivy/cmd/trivy/main.go:51 +0x19f
main.main()
        /home/runner/work/trivy/trivy/cmd/trivy/main.go:19 +0x1f

Operating System

Ubuntu 25.04

Version

0.65.0

Checklist

• Run trivy clean --all
• Read the troubleshooting

[nikpivkin]

Hi @alyvusal !

Thanks for the report! We will fix the panic. However, Terraform doesn’t allow using variables in the source attribute, so this configuration isn't valid.

[nikpivkin]

Track #9397