AVD-AZU-0012 finding when scanning any terraform code #9619
Closed
Malcolm-GetAHead
started this conversation in
False Detection
Replies: 5 comments 4 replies
-
|
Just debugged the same problem. Was about the write the same issue. Problem is the new 1.12.0 ruleset. When you use the old ruleset it works again: |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
It looks like this is resolved now: |
Beta Was this translation helpful? Give feedback.
3 replies
-
|
Still not working for me: ➜ trivy git:(main) ✗ rm -rf /home/niklas/.cache/trivy
➜ trivy git:(main) ✗ trivy config . --debug
2025-10-08T17:38:15+02:00 DEBUG No plugins loaded
2025-10-08T17:38:15+02:00 DEBUG Default config file "file_path=trivy.yaml" not found, using built in values
2025-10-08T17:38:15+02:00 DEBUG Cache dir dir="/home/niklas/.cache/trivy"
2025-10-08T17:38:15+02:00 DEBUG Cache dir dir="/home/niklas/.cache/trivy"
2025-10-08T17:38:15+02:00 DEBUG Parsed severities severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-10-08T17:38:15+02:00 INFO [misconfig] Misconfiguration scanning is enabled
2025-10-08T17:38:15+02:00 DEBUG [misconfig] Failed to open the check metadata err="open /home/niklas/.cache/trivy/policy/metadata.json: no such file or directory"
2025-10-08T17:38:15+02:00 INFO [misconfig] Need to update the checks bundle
2025-10-08T17:38:15+02:00 INFO [misconfig] Downloading the checks bundle...
2025-10-08T17:38:15+02:00 DEBUG [misconfig] Loading check bundle repository="mirror.gcr.io/aquasec/trivy-checks:1"
2025-10-08T17:38:15+02:00 DEBUG [notification] Running version check
2025-10-08T17:38:15+02:00 DEBUG [notification] Version check completed latest_version="0.67.0"
2025-10-08T17:38:15+02:00 DEBUG Created process-specific temp directory path="/tmp/trivy-217846"
215.56 KiB / 215.56 KiB [---------------------------------------------------------------------------------------------------------------------------] 100.00% ? p/s 100ms
2025-10-08T17:38:15+02:00 DEBUG [misconfig] Digest of the built-in checks digest="sha256:a6dab0ee0b117e3996773177db88cb35788da55385186e1fc6aace3c3a64d9dd"
2025-10-08T17:38:15+02:00 DEBUG [misconfig] Checks successfully loaded from disk
2025-10-08T17:38:16+02:00 DEBUG [rego] Overriding filesystem for checks
2025-10-08T17:38:16+02:00 DEBUG [rego] Embedded libraries are loaded count=17
2025-10-08T17:38:16+02:00 DEBUG [rego] Embedded checks are loaded count=519
2025-10-08T17:38:16+02:00 DEBUG [rego] Checks from disk are loaded count=559
2025-10-08T17:38:16+02:00 DEBUG [rego] Overriding filesystem for data
2025-10-08T17:38:16+02:00 DEBUG Enabling misconfiguration scanners scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-10-08T17:38:16+02:00 DEBUG Initializing scan cache... type="memory"
2025-10-08T17:38:16+02:00 DEBUG [fs] Analyzing... root="."
2025-10-08T17:38:16+02:00 DEBUG [misconfig] Scanning files for misconfigurations... scanner="Terraform"
2025-10-08T17:38:16+02:00 DEBUG [terraform scanner] Scanning directory file_path="."
2025-10-08T17:38:16+02:00 DEBUG [terraform parser] Setting project/module root module="root" file_path="."
2025-10-08T17:38:16+02:00 DEBUG [terraform parser] Parsing FS module="root" file_path="."
2025-10-08T17:38:16+02:00 DEBUG [terraform parser] Parsing module="root" file_path="main.tf"
2025-10-08T17:38:16+02:00 DEBUG [terraform parser] Added file module="root" file_path="main.tf"
2025-10-08T17:38:16+02:00 INFO [terraform scanner] Scanning root module file_path="."
2025-10-08T17:38:16+02:00 DEBUG [terraform parser] Setting project/module root module="root" file_path="."
2025-10-08T17:38:16+02:00 DEBUG [terraform parser] Parsing FS module="root" file_path="."
2025-10-08T17:38:16+02:00 DEBUG [terraform parser] Parsing module="root" file_path="main.tf"
2025-10-08T17:38:16+02:00 DEBUG [terraform parser] Added file module="root" file_path="main.tf"
2025-10-08T17:38:16+02:00 DEBUG [terraform parser] Loading module module="root" module="root"
2025-10-08T17:38:16+02:00 DEBUG [terraform parser] Read block(s) and ignore(s) module="root" blocks=1 ignores=0
2025-10-08T17:38:16+02:00 DEBUG [terraform parser] Added input variables from tfvars module="root" count=0
2025-10-08T17:38:16+02:00 WARN [terraform parser] Variable values were not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="test"
2025-10-08T17:38:16+02:00 DEBUG [terraform parser] Working directory for module evaluation module="root" file_path="/home/niklas/Workspace/DevOps/debug-files/trivy"
2025-10-08T17:38:16+02:00 DEBUG [terraform evaluator] Starting module evaluation... module="root" path="."
2025-10-08T17:38:16+02:00 DEBUG [terraform evaluator] Starting iteration module="root" iteration=0
2025-10-08T17:38:16+02:00 DEBUG [terraform evaluator] Starting iteration module="root" iteration=1
2025-10-08T17:38:16+02:00 DEBUG [terraform evaluator] Context unchanged module="root" iteration=1
2025-10-08T17:38:16+02:00 DEBUG [terraform evaluator] Starting post-submodules evaluation... module="root"
2025-10-08T17:38:16+02:00 DEBUG [terraform evaluator] Starting iteration module="root" iteration=0
2025-10-08T17:38:16+02:00 DEBUG [terraform evaluator] Starting iteration module="root" iteration=1
2025-10-08T17:38:16+02:00 DEBUG [terraform evaluator] Context unchanged module="root" iteration=1
2025-10-08T17:38:16+02:00 DEBUG [terraform evaluator] Module evaluation complete. module="root"
2025-10-08T17:38:16+02:00 DEBUG [terraform parser] Finished parsing module module="root"
2025-10-08T17:38:16+02:00 DEBUG [terraform executor] Adapting modules...
2025-10-08T17:38:16+02:00 DEBUG [terraform executor] Adapted module(s) into state data. count=1
2025-10-08T17:38:16+02:00 DEBUG [terraform executor] Scan state data
2025-10-08T17:38:16+02:00 DEBUG [rego] Scanning inputs count=1
2025-10-08T17:38:16+02:00 DEBUG [terraform executor] Finished applying checks
2025-10-08T17:38:16+02:00 DEBUG [terraform executor] Applying ignores...
2025-10-08T17:38:16+02:00 DEBUG [terraform executor] No matching Terraform block found cause_range=""
2025-10-08T17:38:16+02:00 DEBUG OS is not detected.
2025-10-08T17:38:16+02:00 INFO Detected config files num=2
2025-10-08T17:38:16+02:00 DEBUG Scanned config file file_path=""
2025-10-08T17:38:16+02:00 DEBUG Scanned config file file_path="."
2025-10-08T17:38:16+02:00 DEBUG Specified ignore file does not exist file=".trivyignore"
2025-10-08T17:38:16+02:00 DEBUG [vex] VEX filtering is disabled
Report Summary
┌────────┬───────────┬───────────────────┐
│ Target │ Type │ Misconfigurations │
├────────┼───────────┼───────────────────┤
│ │ terraform │ 1 │
├────────┼───────────┼───────────────────┤
│ . │ terraform │ 0 │
└────────┴───────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)
(terraform)
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1)
AVD-AZU-0012 (CRITICAL): No network rules defined and default action allows access.
═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
The default_action for network rules should come into effect when no other rules are matched.
The default action should be set to Deny.
See https://avd.aquasec.com/misconfig/avd-azu-0012
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
2025-10-08T17:38:16+02:00 DEBUG Cleaning up temp directory path="/tmp/trivy-217846"There is also no new ruleset published: https://github.com/aquasecurity/trivy-checks/pkgs/container/trivy-checks/versions |
Beta Was this translation helpful? Give feedback.
-
|
Same issue here. I created a new directory with only an empty variables.tf file. My cache directory is different but deleting it also didn't help. |
Beta Was this translation helpful? Give feedback.
-
|
You're all correct - I rebuilt my dev container and it failing again so it must have been something cached elsewhere in the container I was running. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @Malcolm-GetAHead ! Thanks for the report, this bug has been introduced in one of the commits. It will be fixed soon. Related PR aquasecurity/trivy-checks#494 |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
Awesome! Thanks for the quick fix. Let's hope for quick merge and release 🤞 |
Beta Was this translation helpful? Give feedback.
-
|
We've released v1.12.1 which should address this issue. It will be available shortly. https://github.com/aquasecurity/trivy-checks/releases/tag/v1.12.1 |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Fixed via aquasecurity/trivy-checks#494 |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
IDs
AVD-AZU-0012
Description
When running a config scan against any terraform code and receive false-positive AVD-AZU-0012 finding:
Target
AWS
Scanner
Misconfiguration
Target OS
N/A
Debug Output
Version
Checklist
-f jsonthat shows data sources and confirmed that the security advisory in data sources was correctBeta Was this translation helpful? Give feedback.
All reactions