Replies: 3 comments 6 replies
-
|
Can you share a small reproducible example for this issue? |
Beta Was this translation helpful? Give feedback.
-
|
Hi @rogi-sh ! I cannot reproduce this issue on the latest version: ❯ cat main.tf
provider "aws" {
default_tags {
tags = {}
}
}%
❯ trivy conf main.tf
2025-09-25T15:18:50+06:00 INFO [misconfig] Misconfiguration scanning is enabled
2025-09-25T15:18:51+06:00 INFO [terraform scanner] Scanning root module file_path="."
2025-09-25T15:18:51+06:00 INFO Detected config files num=1
Report Summary
┌────────┬───────────┬───────────────────┐
│ Target │ Type │ Misconfigurations │
├────────┼───────────┼───────────────────┤
│ . │ terraform │ 0 │
└────────┴───────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected) |
Beta Was this translation helpful? Give feedback.
-
|
Is Can you show how the variable |
Beta Was this translation helpful? Give feedback.
-
|
Yes default.json is just a place where variables are set |
Beta Was this translation helpful? Give feedback.
-
|
Provider is like this |
Beta Was this translation helpful? Give feedback.
-
|
Mapping is then over output: |
Beta Was this translation helpful? Give feedback.
-
|
How is local.input defined? Do module variables have types? To reproduce the problem, we need a little more configuration data. |
Beta Was this translation helpful? Give feedback.
-
Additional Reproduction CaseHi @nikpivkin Configuration StructureProvider configuration: provider "aws" {
region = "us-west-2"
default_tags {
tags = module.default_tags.tags
}
}Module: locals {
default_tags = {
Project = var.project
Environment = var.environment
Owner = var.owner
}
vcs_tags = {
"VCS:Source" = data.git_repository.this.url
"VCS:Branch" = data.git_repository.this.branch
"VCS:Path" = data.git_repository.this.relative_path
"VCS:Clean" = data.git_repository.this.clean
"VCS:Commit" = data.git_repository.this.commit_sha
}
tags = merge(local.default_tags, local.vcs_tags)
}
data "git_repository" "this" {
}
output "tags" {
value = local.tags
description = "Default tags map including Project and Git related info."
}Root CauseWhen Trivy performs static analysis, the These null values get merged into the tags map and passed to the AWS provider's Stack TraceEnvironment
WorkaroundCurrently using - uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
with:
scan-type: 'config'
skip-dirs: 'terraform/modules/default_tags'Expected Behavior
|
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Description
If a map is empty or null trivy config fails with value is null (go-cty/cty.Value.AsString)
Desired Behavior
Should skip null values
Actual Behavior
panic: value is null
goroutine 1 [running]:
github.com/zclconf/go-cty/cty.Value.AsString({{{0x6654470?, 0xc000289099?}}, {0x0?, 0x0?}})
/home/runner/go/pkg/mod/github.com/zclconf/[email protected]/cty/value_ops.go:1413 +0x10b
github.com/aquasecurity/trivy/pkg/iac/adapters/terraform/aws/provider.adaptDefaultTags.(*Attribute).AsMapValue.func1.1({{{0x6654470?, 0xc000289099?}}, {0x4839700?, 0xc0026ec6e0?}}, {{{0x6654470?, 0xc000289099?}}, {0x0?, 0x0?}})
/home/runner/work/trivy/trivy/pkg/iac/terrafo
Reproduction Steps
Target
None
Scanner
None
Output Format
None
Mode
None
Debug Output
Operating System
aquasec/trivy:0.66.0 in Gitlab Pipeline
Version
Checklist
trivy clean --allBeta Was this translation helpful? Give feedback.
All reactions