Parse Terraform *.auto.tfvars

[andersnm]

Description

Terraform automatically parses variables from *.auto.tfvars and it would be convenient if Trivy could do the same. In the meantime I'll use the --tf-vars argument.

2025-09-25T08:08:44Z	WARN	[terraform parser] Variable values were not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="image"

Reference: https://developer.hashicorp.com/terraform/tutorials/configuration-language/variables#assign-values-with-a-file

Terraform automatically loads all files in the current directory with the exact name terraform.tfvars or matching *.auto.tfvars. You can also use the -var-file flag to specify other files by name.

Target

None

Scanner

None

[nikpivkin]

Hi @andersnm !

Yes, I think this is a useful feature and will be compatible with Terraform.

@simar7 WDYT?

[simar7]

I agree but I would like to better understand the following behaviours:

1. What happens if there's more than one *.auto.tfvars present in a directory setting the same variable across multiple files?
2. If terraform.tfvars is a symlink present in a nested subdirectory pointing to a parent directory, what is the expected behaviour?
3. If a user passes in --tf-vars in addition to a terraform.tfvars present on disk, do we override the file on disk with the passed in file or do something else?

[andersnm]

Hi!

1. What happens if there's more than one *.auto.tfvars present in a directory setting the same variable across multiple files?
2. If a user passes in --tf-vars in addition to a terraform.tfvars present on disk, do we override the file on disk with the passed in file or do something else?

https://developer.hashicorp.com/terraform/language/parameterize#assign-values-to-input-variables

Terraform uses the following order of precedence:

• Any -var and -var-file options on the command line in the order provided and variables from HCP Terraform
• Any *.auto.tfvars or *.auto.tfvars.json files in lexical order
• The terraform.tfvars.json file
• The terraform.tfvars file
• Environment variables
• The default argument of the variable block

2. If terraform.tfvars is a symlink present in a nested subdirectory pointing to a parent directory, what is the expected behaviour?

I could not find a direct reference for for this. There are reddit threads and stackoverflows suggesting it works as expected.

[andersnm]

2. If terraform.tfvars is a symlink present in a nested subdirectory pointing to a parent directory, what is the expected behaviour?

I probably misunderstood this point in my previous reply. I assumed Terraform does not load any *.tfvars from nested subdirectories, but I can't find a direct reference for this.

This article discusses a related product and mentions:

Auto-loaded configuration files: We auto-load *.auto.tfvars and terraform.tfvars files found in the current working directory. Refer to the Terraform documentation for details.

But there are no details in that link: Hashicorp seems to have updated their documentation recently to remove this point, so maybe latest Terraform versions support *.tfvars anywhere.