Trivy Terraform config scan reporting a finding with an Azure resource, when Azure is not used

[adrawbond-alto]

IDs

AVD-AZU-0012

Description

A Terraform config scan is reporting the AVD-AZU-0012 finding, which pertains to Azure resources, when Azure resources do not exist in the project.

Reproduction Steps

1. In an empty directory run: `echo "terraform {}" > main.test.tf`
2. Then run: `terraform init`.
3. Then run: `trivy config --format json .`

Target

Filesystem

Scanner

Misconfiguration

Target OS

Ubuntu 22.04 and MacOS 15.7.1

Debug Output

2025-10-08T15:38:40-05:00	DEBUG	No plugins loaded
2025-10-08T15:38:40-05:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-10-08T15:38:40-05:00	DEBUG	Cache dir	dir="..."
2025-10-08T15:38:40-05:00	DEBUG	Cache dir	dir="..."
2025-10-08T15:38:40-05:00	DEBUG	Parsed severities	severities=[CRITICAL HIGH]
2025-10-08T15:38:40-05:00	INFO	[misconfig] Misconfiguration scanning is enabled
2025-10-08T15:38:40-05:00	DEBUG	[notification] Running version check
2025-10-08T15:38:40-05:00	DEBUG	[misconfig] Checks successfully loaded from disk
2025-10-08T15:38:40-05:00	DEBUG	[rego] Overriding filesystem for checks
2025-10-08T15:38:40-05:00	DEBUG	[rego] Embedded libraries are loaded	count=17
2025-10-08T15:38:40-05:00	DEBUG	[notification] Version check completed	latest_version="0.67.0"
2025-10-08T15:38:40-05:00	DEBUG	[rego] Embedded checks are loaded	count=519
2025-10-08T15:38:41-05:00	DEBUG	[rego] Checks from disk are loaded	count=559
2025-10-08T15:38:41-05:00	DEBUG	[rego] Overriding filesystem for data
2025-10-08T15:38:41-05:00	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-10-08T15:38:41-05:00	DEBUG	Initializing scan cache...	type="memory"
2025-10-08T15:38:41-05:00	DEBUG	[fs] Analyzing...	root="."
2025-10-08T15:38:41-05:00	DEBUG	Created process-specific temp directory	path="/var/folders/0c/4vxshjcd38g450vm4drsh2kw0000gp/T/trivy-66946"
2025-10-08T15:38:41-05:00	DEBUG	[misconfig] Scanning files for misconfigurations...	scanner="Terraform"
2025-10-08T15:38:41-05:00	DEBUG	[terraform scanner] Scanning directory	file_path="."
2025-10-08T15:38:41-05:00	DEBUG	[terraform parser] Setting project/module root	module="root" file_path="."
2025-10-08T15:38:41-05:00	DEBUG	[terraform parser] Parsing FS	module="root" file_path="."
2025-10-08T15:38:41-05:00	DEBUG	[terraform parser] Parsing	module="root" file_path="main.test.tf"
2025-10-08T15:38:41-05:00	DEBUG	[terraform parser] Added file	module="root" file_path="main.test.tf"
2025-10-08T15:38:41-05:00	INFO	[terraform scanner] Scanning root module	file_path="."
2025-10-08T15:38:41-05:00	DEBUG	[terraform parser] Setting project/module root	module="root" file_path="."
2025-10-08T15:38:41-05:00	DEBUG	[terraform parser] Parsing FS	module="root" file_path="."
2025-10-08T15:38:41-05:00	DEBUG	[terraform parser] Parsing	module="root" file_path="main.test.tf"
2025-10-08T15:38:41-05:00	DEBUG	[terraform parser] Added file	module="root" file_path="main.test.tf"
2025-10-08T15:38:41-05:00	DEBUG	[terraform parser] Loading module	module="root" module="root"
2025-10-08T15:38:41-05:00	DEBUG	[terraform parser] Read block(s) and ignore(s)	module="root" blocks=1 ignores=0
2025-10-08T15:38:41-05:00	DEBUG	[terraform parser] Added input variables from tfvars	module="root" count=0
2025-10-08T15:38:41-05:00	DEBUG	[terraform parser] Working directory for module evaluation	module="root" file_path="/tmp/tf-lab"
2025-10-08T15:38:41-05:00	DEBUG	[terraform evaluator] Starting module evaluation...	module="root" path="."
2025-10-08T15:38:41-05:00	DEBUG	[terraform evaluator] Starting iteration	module="root" iteration=0
2025-10-08T15:38:41-05:00	DEBUG	[terraform evaluator] Starting iteration	module="root" iteration=1
2025-10-08T15:38:41-05:00	DEBUG	[terraform evaluator] Context unchanged	module="root" iteration=1
2025-10-08T15:38:41-05:00	DEBUG	[terraform evaluator] Starting post-submodules evaluation...	module="root"
2025-10-08T15:38:41-05:00	DEBUG	[terraform evaluator] Starting iteration	module="root" iteration=0
2025-10-08T15:38:41-05:00	DEBUG	[terraform evaluator] Starting iteration	module="root" iteration=1
2025-10-08T15:38:41-05:00	DEBUG	[terraform evaluator] Context unchanged	module="root" iteration=1
2025-10-08T15:38:41-05:00	DEBUG	[terraform evaluator] Module evaluation complete.	module="root"
2025-10-08T15:38:41-05:00	DEBUG	[terraform parser] Finished parsing module	module="root"
2025-10-08T15:38:41-05:00	DEBUG	[terraform executor] Adapting modules...
2025-10-08T15:38:41-05:00	DEBUG	[terraform executor] Adapted module(s) into state data.	count=1
2025-10-08T15:38:41-05:00	DEBUG	[terraform executor] Scan state data
2025-10-08T15:38:41-05:00	DEBUG	[rego] Scanning inputs	count=1
2025-10-08T15:38:41-05:00	DEBUG	[terraform executor] Finished applying checks
2025-10-08T15:38:41-05:00	DEBUG	[terraform executor] Applying ignores...
2025-10-08T15:38:41-05:00	DEBUG	[terraform executor] No matching Terraform block found	cause_range=""
2025-10-08T15:38:41-05:00	DEBUG	OS is not detected.
2025-10-08T15:38:41-05:00	INFO	Detected config files	num=2
2025-10-08T15:38:41-05:00	DEBUG	Scanned config file	file_path=""
2025-10-08T15:38:41-05:00	DEBUG	Scanned config file	file_path="."
2025-10-08T15:38:41-05:00	DEBUG	Specified ignore file does not exist	file=".trivyignore"
2025-10-08T15:38:41-05:00	DEBUG	[vex] VEX filtering is disabled
{
  "version": "2.1.0",
  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
  "runs": [
    {
      "tool": {
        "driver": {
          "fullName": "Trivy Vulnerability Scanner",
          "informationUri": "https://github.com/aquasecurity/trivy",
          "name": "Trivy",
          "rules": [
            {
              "id": "AVD-AZU-0012",
              "name": "Misconfiguration",
              "shortDescription": {
                "text": "The default action on Storage account network rules should be set to deny"
              },
              "fullDescription": {
                "text": "The default_action for network rules should come into effect when no other rules are matched.\nThe default action should be set to Deny.\n"
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/misconfig/avd-azu-0012",
              "help": {
                "text": "Misconfiguration AVD-AZU-0012\nType: Terraform Security Check\nSeverity: CRITICAL\nCheck: The default action on Storage account network rules should be set to deny\nMessage: No network rules defined and default action allows access.\nLink: [AVD-AZU-0012](https://avd.aquasec.com/misconfig/avd-azu-0012)\nThe default_action for network rules should come into effect when no other rules are matched.\nThe default action should be set to Deny.\n",
                "markdown": "**Misconfiguration AVD-AZU-0012**\n| Type | Severity | Check | Message | Link |\n| --- | --- | --- | --- | --- |\n|Terraform Security Check|CRITICAL|The default action on Storage account network rules should be set to deny|No network rules defined and default action allows access.|[AVD-AZU-0012](https://avd.aquasec.com/misconfig/avd-azu-0012)|\n\nThe default_action for network rules should come into effect when no other rules are matched.\nThe default action should be set to Deny.\n"
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "9.5",
                "tags": [
                  "misconfiguration",
                  "security",
                  "CRITICAL"
                ]
              }
            }
          ],
          "version": "0.67.0"
        }
      },
      "results": [
        {
          "ruleId": "AVD-AZU-0012",
          "ruleIndex": 0,
          "level": "error",
          "message": {
            "text": "Artifact: \nType: terraform\nVulnerability AVD-AZU-0012\nSeverity: CRITICAL\nMessage: No network rules defined and default action allows access.\nLink: [AVD-AZU-0012](https://avd.aquasec.com/misconfig/avd-azu-0012)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "message": {
                "text": ""
              }
            }
          ]
        }
      ],
      "columnKind": "utf16CodeUnits",
      "originalUriBaseIds": {
        "ROOTPATH": {
          "uri": "file:///tmp/tf-lab/"
        }
      }
    }
  ]
}2025-10-08T15:38:41-05:00	DEBUG	Cleaning up temp directory	path="/var/folders/0c/4vxshjcd38g450vm4drsh2kw0000gp/T/trivy-66946"

Version

Version: 0.67.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-11-04 12:17:27.793540796 +0000 UTC
  NextUpdate: 2024-11-05 12:17:27.793540426 +0000 UTC
  DownloadedAt: 2024-11-04 14:35:24.842397 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-10-30 02:47:47.934616859 +0000 UTC
  NextUpdate: 2024-11-02 02:47:47.934616568 +0000 UTC
  DownloadedAt: 2024-10-30 21:06:21.083276 +0000 UTC
Check Bundle:
  Digest: sha256:a6dab0ee0b117e3996773177db88cb35788da55385186e1fc6aace3c3a64d9dd
  DownloadedAt: 2025-10-08 19:45:20.833118 +0000 UTC

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct