getting Azure vulnerabilities in scan of Terraform folder

[pfrydids]

IDs

AVD-AZU-0012

Description

┌──────────────────────────────────────────────────────────────────────────────────┬────────────┬───────────────────┐
│                                      Target                                      │    Type    │ Misconfigurations │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼───────────────────┤
│                                                                                  │ terraform  │         1         │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼───────────────────┤

And

AVD-AZU-0012 (CRITICAL): No network rules defined and default action allows access.

Reproduction Steps

mkdir test
cd test
echo 'terraform {
  required_version = "~> 1.13"
}' > main.tf
docker run -v $PWD:/myapp aquasec/trivy config --severity CRITICAL --exit-code 1 .

Target

Filesystem

Scanner

Vulnerability

Target OS

No response

Debug Output

2025-10-08T13:51:55Z	DEBUG	No plugins loaded
2025-10-08T13:51:55Z	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-10-08T13:51:55Z	DEBUG	Cache dir	dir="/root/.cache/trivy"
2025-10-08T13:51:55Z	DEBUG	Cache dir	dir="/root/.cache/trivy"
2025-10-08T13:51:55Z	DEBUG	Parsed severities	severities=[CRITICAL]
2025-10-08T13:51:55Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-10-08T13:51:55Z	DEBUG	[misconfig] Failed to open the check metadata	err="open /root/.cache/trivy/policy/metadata.json: no such file or directory"
2025-10-08T13:51:55Z	INFO	[misconfig] Need to update the checks bundle
2025-10-08T13:51:55Z	INFO	[misconfig] Downloading the checks bundle...
2025-10-08T13:51:55Z	DEBUG	[misconfig] Loading check bundle	repository="mirror.gcr.io/aquasec/trivy-checks:1"
2025-10-08T13:51:55Z	DEBUG	[notification] Running version check
2025-10-08T13:51:55Z	DEBUG	[notification] Version check completed	latest_version="0.67.0"
2025-10-08T13:51:55Z	DEBUG	Created process-specific temp directory	path="/tmp/trivy-1"
215.56 KiB / 215.56 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2025-10-08T13:51:55Z	DEBUG	[misconfig] Digest of the built-in checks	digest="sha256:a6dab0ee0b117e3996773177db88cb35788da55385186e1fc6aace3c3a64d9dd"
2025-10-08T13:51:55Z	DEBUG	[misconfig] Checks successfully loaded from disk
2025-10-08T13:51:56Z	DEBUG	[rego] Overriding filesystem for checks
2025-10-08T13:51:56Z	DEBUG	[rego] Embedded libraries are loaded	count=17
2025-10-08T13:51:56Z	DEBUG	[rego] Embedded checks are loaded	count=519
2025-10-08T13:51:56Z	DEBUG	[rego] Checks from disk are loaded	count=559
2025-10-08T13:51:56Z	DEBUG	[rego] Overriding filesystem for data
2025-10-08T13:51:56Z	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-10-08T13:51:56Z	DEBUG	Initializing scan cache...	type="memory"
2025-10-08T13:51:56Z	DEBUG	[fs] Analyzing...	root="."
2025-10-08T13:51:56Z	DEBUG	Skipping path	path="dev"
2025-10-08T13:51:56Z	DEBUG	Skipping path	path="proc"
2025-10-08T13:51:56Z	DEBUG	Skipping path	path="sys"
2025-10-08T13:51:56Z	DEBUG	[misconfig] Scanning files for misconfigurations...	scanner="Terraform"
2025-10-08T13:51:56Z	DEBUG	[terraform scanner] Scanning directory	file_path="."
2025-10-08T13:51:56Z	DEBUG	[terraform parser] Setting project/module root	module="root" file_path="myapp"
2025-10-08T13:51:56Z	DEBUG	[terraform parser] Parsing FS	module="root" file_path="myapp"
2025-10-08T13:51:56Z	DEBUG	[terraform parser] Parsing	module="root" file_path="myapp/main.tf"
2025-10-08T13:51:56Z	DEBUG	[terraform parser] Added file	module="root" file_path="myapp/main.tf"
2025-10-08T13:51:56Z	INFO	[terraform scanner] Scanning root module	file_path="myapp"
2025-10-08T13:51:56Z	DEBUG	[terraform parser] Setting project/module root	module="root" file_path="myapp"
2025-10-08T13:51:56Z	DEBUG	[terraform parser] Parsing FS	module="root" file_path="myapp"
2025-10-08T13:51:56Z	DEBUG	[terraform parser] Parsing	module="root" file_path="myapp/main.tf"
2025-10-08T13:51:56Z	DEBUG	[terraform parser] Added file	module="root" file_path="myapp/main.tf"
2025-10-08T13:51:56Z	DEBUG	[terraform parser] Loading module	module="root" module="root"
2025-10-08T13:51:56Z	DEBUG	[terraform parser] Read block(s) and ignore(s)	module="root" blocks=1 ignores=0
2025-10-08T13:51:56Z	DEBUG	[terraform parser] Added input variables from tfvars	module="root" count=0
2025-10-08T13:51:56Z	DEBUG	[terraform parser] Working directory for module evaluation	module="root" file_path="/"
2025-10-08T13:51:56Z	DEBUG	[terraform evaluator] Starting module evaluation...	module="root" path="myapp"
2025-10-08T13:51:56Z	DEBUG	[terraform evaluator] Starting iteration	module="root" iteration=0
2025-10-08T13:51:56Z	DEBUG	[terraform evaluator] Starting iteration	module="root" iteration=1
2025-10-08T13:51:56Z	DEBUG	[terraform evaluator] Context unchanged	module="root" iteration=1
2025-10-08T13:51:56Z	DEBUG	[terraform evaluator] Starting post-submodules evaluation...	module="root"
2025-10-08T13:51:56Z	DEBUG	[terraform evaluator] Starting iteration	module="root" iteration=0
2025-10-08T13:51:56Z	DEBUG	[terraform evaluator] Starting iteration	module="root" iteration=1
2025-10-08T13:51:56Z	DEBUG	[terraform evaluator] Context unchanged	module="root" iteration=1
2025-10-08T13:51:56Z	DEBUG	[terraform evaluator] Module evaluation complete.	module="root"
2025-10-08T13:51:56Z	DEBUG	[terraform parser] Finished parsing module	module="root"
2025-10-08T13:51:56Z	DEBUG	[terraform executor] Adapting modules...
2025-10-08T13:51:56Z	DEBUG	[terraform executor] Adapted module(s) into state data.	count=1
2025-10-08T13:51:56Z	DEBUG	[terraform executor] Scan state data
2025-10-08T13:51:56Z	DEBUG	[rego] Scanning inputs	count=1
2025-10-08T13:51:56Z	DEBUG	[terraform executor] Finished applying checks
2025-10-08T13:51:56Z	DEBUG	[terraform executor] Applying ignores...
2025-10-08T13:51:56Z	DEBUG	[terraform executor] No matching Terraform block found	cause_range=""
2025-10-08T13:51:56Z	DEBUG	[misconfig] Scanning files for misconfigurations...	scanner="Helm"
2025-10-08T13:51:56Z	DEBUG	OS is not detected.
2025-10-08T13:51:56Z	INFO	Detected config files	num=2
2025-10-08T13:51:56Z	DEBUG	Scanned config file	file_path=""
2025-10-08T13:51:56Z	DEBUG	Scanned config file	file_path="myapp"
2025-10-08T13:51:56Z	DEBUG	Specified ignore file does not exist	file=".trivyignore"
2025-10-08T13:51:56Z	DEBUG	[vex] VEX filtering is disabled
2025-10-08T13:51:56Z	DEBUG	Cleaning up temp directory	path="/tmp/trivy-1"

Report Summary

┌────────┬───────────┬───────────────────┐
│ Target │   Type    │ Misconfigurations │
├────────┼───────────┼───────────────────┤
│        │ terraform │         1         │
├────────┼───────────┼───────────────────┤
│ myapp  │ terraform │         0         │
└────────┴───────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


 (terraform)
============
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (CRITICAL: 1)

AVD-AZU-0012 (CRITICAL): No network rules defined and default action allows access.
════════════════════════════════════════
The default_action for network rules should come into effect when no other rules are matched.
The default action should be set to Deny.


See https://avd.aquasec.com/misconfig/avd-azu-0012
────────────────────────────────────────

Version

Version: 0.67.0

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[pfrydids]

#9619