Trivy panics on aws_s3_bucket resource with bucket = null #8091

abohne · 2024-12-12T19:24:46Z

abohne
Dec 12, 2024

Description

When running misconfiguration scans on terraform that contains an aws_s3_bucket resource with null as the bucket attribute, trivy panics, even if the resource would not be created.

Desired Behavior

Show an error or informational message

Actual Behavior

panic: value is null

goroutine 1 [running]:
github.com/zclconf/go-cty/cty.Value.AsString({{{0x109282ab8?, 0x1400029f351?}}, {0x0?, 0x0?}})
	/Users/andy.bohne/go/pkg/mod/github.com/zclconf/[email protected]/cty/value_ops.go:1390 +0x114
github.com/aquasecurity/trivy/pkg/iac/terraform.postProcessValues(0x14000ff5500, 0x1400266cae0)
	/Users/andy.bohne/repos/trivy/pkg/iac/terraform/presets.go:70 +0x440
github.com/aquasecurity/trivy/pkg/iac/terraform.(*Block).Values(0x14000ff5500)
	/Users/andy.bohne/repos/trivy/pkg/iac/terraform/block.go:580 +0x174
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).getResources(0x14002002640)
	/Users/andy.bohne/repos/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:581 +0x178
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateStep(0x14002002640)
	/Users/andy.bohne/repos/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:99 +0x150
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateSteps(0x14002002640)
	/Users/andy.bohne/repos/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:246 +0x108
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).EvaluateAll(0x14002002640, {0x109280a18, 0x140016a9800})
	/Users/andy.bohne/repos/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:135 +0x16c
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*Parser).EvaluateAll(0x140009c0ea0, {0x109280a18, 0x140016a9800})
	/Users/andy.bohne/repos/trivy/pkg/iac/scanners/terraform/parser/parser.go:342 +0x78
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform.(*Scanner).ScanFS(0x1400124cbd0, {0x109280a18, 0x140016a9800}, {0x10923d9e0, 0x14000da0360}, {0x108584888, 0x1})
	/Users/andy.bohne/repos/trivy/pkg/iac/scanners/terraform/scanner.go:132 +0x580
github.com/aquasecurity/trivy/pkg/misconf.(*Scanner).Scan(0x140011ffe80, {0x109280ac0, 0x140004d2700}, {0x10923d9e0, 0x14000da0348})
	/Users/andy.bohne/repos/trivy/pkg/misconf/scanner.go:151 +0x220
github.com/aquasecurity/trivy/pkg/fanal/analyzer/config.(*Analyzer).PostAnalyze(0x1400070f260, {0x109280ac0?, 0x140004d2700?}, {{0x10923d9e0?, 0x14000da0348?}, {0x9?, 0x0?}})
	/Users/andy.bohne/repos/trivy/pkg/fanal/analyzer/config/config.go:44 +0x38
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze({0x14001582860, {0x14000c66780, 0x4, 0x4}, {0x140012c1b80, 0x8, 0x8}, 0x1400125bda0, {0x0, 0x0}}, ...)
	/Users/andy.bohne/repos/trivy/pkg/fanal/analyzer/analyzer.go:505 +0x280
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect({{0x16b9b337a, 0x1c}, {0x132fb71d8, 0x14000c66740}, {0x10923d900, 0x10bb46300}, {0x14001582860, {0x14000c66780, 0x4, 0x4}, ...}, ...}, ...)
	/Users/andy.bohne/repos/trivy/pkg/fanal/artifact/local/fs.go:121 +0x370
github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0x0, 0x0, 0x0}, {0x0, ...}, ...})
	/Users/andy.bohne/repos/trivy/pkg/scanner/scan.go:156 +0xa4
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan(_, {_, _}, {{{0x107828032, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
	/Users/andy.bohne/repos/trivy/pkg/commands/artifact/run.go:626 +0x2e4
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x107828032, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
	/Users/andy.bohne/repos/trivy/pkg/commands/artifact/run.go:259 +0x94
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanFS(_, {_, _}, {{{0x107828032, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
	/Users/andy.bohne/repos/trivy/pkg/commands/artifact/run.go:204 +0xa4
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanFilesystem(_, {_, _}, {{{0x107828032, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
	/Users/andy.bohne/repos/trivy/pkg/commands/artifact/run.go:184 +0x1b0
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x107828032, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x1400007b950, ...}, ...}, ...}, ...)
	/Users/andy.bohne/repos/trivy/pkg/commands/artifact/run.go:400 +0x7f4
github.com/aquasecurity/trivy/pkg/commands.NewConfigCommand.func2(0x1400053ac08, {0x14000710520, 0x1, 0x2})
	/Users/andy.bohne/repos/trivy/pkg/commands/app.go:721 +0x278
github.com/spf13/cobra.(*Command).execute(0x1400053ac08, {0x14000710500, 0x2, 0x2})
	/Users/andy.bohne/go/pkg/mod/github.com/spf13/[email protected]/command.go:985 +0x834
github.com/spf13/cobra.(*Command).ExecuteC(0x140009da608)
	/Users/andy.bohne/go/pkg/mod/github.com/spf13/[email protected]/command.go:1117 +0x344
github.com/spf13/cobra.(*Command).Execute(0x10787aa90?)
	/Users/andy.bohne/go/pkg/mod/github.com/spf13/[email protected]/command.go:1041 +0x1c
main.run()
	/Users/andy.bohne/repos/trivy/cmd/trivy/main.go:39 +0x124
main.main()
	/Users/andy.bohne/repos/trivy/cmd/trivy/main.go:19 +0x20

Reproduction Steps

Create the following as main.tf:

variable "enabled" {
  type    = bool
  default = false
}

variable "name" {
  type    = string
  default = null
}

resource "aws_s3_bucket" "example" {
  count  = var.enabled ? 1 : 0
  bucket = var.name
}

trivy config main.tf

Target

None

Scanner

Misconfiguration

Output Format

None

Mode

Standalone

Debug Output

trivy config main.tf -d
2024-12-12T14:19:43-05:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2024-12-12T14:19:43-05:00	DEBUG	Cache dir	dir="/Users/andy.bohne/Library/Caches/trivy"
2024-12-12T14:19:43-05:00	DEBUG	Cache dir	dir="/Users/andy.bohne/Library/Caches/trivy"
2024-12-12T14:19:43-05:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-12-12T14:19:43-05:00	INFO	[misconfig] Misconfiguration scanning is enabled
2024-12-12T14:19:43-05:00	DEBUG	[misconfig] Checks successfully loaded from disk
2024-12-12T14:19:43-05:00	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-12-12T14:19:43-05:00	DEBUG	Initializing scan cache...	type="memory"
2024-12-12T14:19:43-05:00	DEBUG	[misconfig] Scanning files for misconfigurations...	scanner="Terraform"
2024-12-12T14:19:43-05:00	DEBUG	[terraform scanner] Scanning directory	file_path="."
2024-12-12T14:19:43-05:00	DEBUG	[rego] Overriding filesystem for checks
2024-12-12T14:19:43-05:00	DEBUG	[rego] Embedded libraries are loaded	count=15
2024-12-12T14:19:43-05:00	DEBUG	[rego] Embedded checks are loaded	count=511
2024-12-12T14:19:43-05:00	DEBUG	[rego] Checks from disk are loaded	count=526
2024-12-12T14:19:43-05:00	DEBUG	[rego] Overriding filesystem for data
2024-12-12T14:19:44-05:00	DEBUG	[terraform parser] Setting project/module root	module="root" file_path="."
2024-12-12T14:19:44-05:00	DEBUG	[terraform parser] Parsing FS	module="root" file_path="."
2024-12-12T14:19:44-05:00	DEBUG	[terraform parser] Parsing	module="root" file_path="main.tf"
2024-12-12T14:19:44-05:00	DEBUG	[terraform parser] Added file	module="root" file_path="main.tf"
2024-12-12T14:19:44-05:00	INFO	[terraform scanner] Scanning root module	file_path="."
2024-12-12T14:19:44-05:00	DEBUG	[terraform parser] Setting project/module root	module="root" file_path="."
2024-12-12T14:19:44-05:00	DEBUG	[terraform parser] Parsing FS	module="root" file_path="."
2024-12-12T14:19:44-05:00	DEBUG	[terraform parser] Parsing	module="root" file_path="main.tf"
2024-12-12T14:19:44-05:00	DEBUG	[terraform parser] Added file	module="root" file_path="main.tf"
2024-12-12T14:19:44-05:00	DEBUG	[terraform parser] Loading module	module="root" module="root"
2024-12-12T14:19:44-05:00	DEBUG	[terraform parser] Read block(s) and ignore(s)	module="root" blocks=3 ignores=0
2024-12-12T14:19:44-05:00	DEBUG	[terraform parser] Added input variables from tfvars	module="root" count=0
2024-12-12T14:19:44-05:00	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="enabled"
2024-12-12T14:19:44-05:00	DEBUG	[terraform parser] Working directory for module evaluation	module="root" file_path="/Users/andy.bohne/trivy-test"
2024-12-12T14:19:44-05:00	DEBUG	[terraform evaluator] Starting module evaluation...	path="."
2024-12-12T14:19:44-05:00	DEBUG	[terraform evaluator] Starting iteration	iteration=0
panic: value is null

goroutine 1 [running]:
github.com/zclconf/go-cty/cty.Value.AsString({{{0x10a755528?, 0x140003f69c9?}}, {0x0?, 0x0?}})
	github.com/zclconf/[email protected]/cty/value_ops.go:1390 +0x114
github.com/aquasecurity/trivy/pkg/iac/terraform.postProcessValues(0x14000682380, 0x14004953ad0)
	github.com/aquasecurity/trivy/pkg/iac/terraform/presets.go:52 +0x39c
github.com/aquasecurity/trivy/pkg/iac/terraform.(*Block).Values(0x14000682380)
	github.com/aquasecurity/trivy/pkg/iac/terraform/block.go:580 +0x174
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).getResources(0x14006114140)
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:581 +0x178
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateStep(0x14006114140)
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:99 +0x150
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateSteps(0x14006114140)
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:246 +0x108
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).EvaluateAll(0x14006114140, {0x10a753368, 0x1400180e540})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:135 +0x16c
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*Parser).EvaluateAll(0x14002436b40, {0x10a753368, 0x1400180e540})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/parser.go:342 +0x78
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform.(*Scanner).ScanFS(0x140015a78c0, {0x10a753368, 0x1400180e540}, {0x10a6f5520, 0x14001496330}, {0x1096c5248, 0x1})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/scanner.go:132 +0x580
github.com/aquasecurity/trivy/pkg/misconf.(*Scanner).Scan(0x14000f8bd00, {0x10a753410, 0x14000cec5b0}, {0x10a6f5520, 0x14001496318})
	github.com/aquasecurity/trivy/pkg/misconf/scanner.go:151 +0x220
github.com/aquasecurity/trivy/pkg/fanal/analyzer/config.(*Analyzer).PostAnalyze(0x14000468f80, {0x10a753410?, 0x14000cec5b0?}, {{0x10a6f5520?, 0x14001496318?}, {0x9?, 0x0?}})
	github.com/aquasecurity/trivy/pkg/fanal/analyzer/config/config.go:44 +0x38
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze({0x14000085060, {0x140014a3740, 0x4, 0x4}, {0x14001b4f600, 0x8, 0x8}, 0x14000a72270, {0x0, 0x0}}, ...)
	github.com/aquasecurity/trivy/pkg/fanal/analyzer/analyzer.go:505 +0x280
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect({{0x16bbf7367, 0x7}, {0x1553b3150, 0x140014a3700}, {0x10a6f5440, 0x10d9458e8}, {0x14000085060, {0x140014a3740, 0x4, 0x4}, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/fanal/artifact/local/fs.go:121 +0x370
github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0x0, 0x0, 0x0}, {0x0, ...}, ...})
	github.com/aquasecurity/trivy/pkg/scanner/scan.go:156 +0xa4
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan(_, {_, _}, {{{0x108777080, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:620 +0x2c8
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x108777080, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:259 +0x9c
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanFS(_, {_, _}, {{{0x108777080, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:204 +0xac
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanFilesystem(_, {_, _}, {{{0x108777080, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:184 +0x1b8
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x108777080, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x140001ca2d0, ...}, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:385 +0x7ac
github.com/aquasecurity/trivy/pkg/commands.NewConfigCommand.func2(0x14000a6f508, {0x14000468fa0, 0x1, 0x2})
	github.com/aquasecurity/trivy/pkg/commands/app.go:719 +0x294
github.com/spf13/cobra.(*Command).execute(0x14000a6f508, {0x14000468f80, 0x2, 0x2})
	github.com/spf13/[email protected]/command.go:985 +0x834
github.com/spf13/cobra.(*Command).ExecuteC(0x14000c3a308)
	github.com/spf13/[email protected]/command.go:1117 +0x344
github.com/spf13/cobra.(*Command).Execute(0x1087d75b3?)
	github.com/spf13/[email protected]/command.go:1041 +0x1c
main.run()
	github.com/aquasecurity/trivy/cmd/trivy/main.go:39 +0x124
main.main()
	github.com/aquasecurity/trivy/cmd/trivy/main.go:19 +0x20

Operating System

macos sonoma 14.6.1

Version

trivy -v
Version: 0.58.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-12-10 18:17:07.099343314 +0000 UTC
  NextUpdate: 2024-12-11 18:17:07.099342904 +0000 UTC
  DownloadedAt: 2024-12-10 21:43:16.71729 +0000 UTC
Check Bundle:
  Digest: sha256:f6901e03f486a48f47aa17a78d89d18e6c31ded82aff83ed19d0d73935a1a059
  DownloadedAt: 2024-12-12 14:19:25.883656 +0000 UTC

Checklist

Run trivy clean --all
Read the troubleshooting

nikpivkin · 2024-12-13T04:18:16Z

nikpivkin
Dec 13, 2024
Maintainer

Hi @abohne ! Thanks for the report

Track #8093

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Trivy panics on aws_s3_bucket resource with bucket = null #8091

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 1 comment

{{title}}

Select a reply

Trivy panics on aws_s3_bucket resource with bucket = null #8091

abohne Dec 12, 2024

Description

Desired Behavior

Actual Behavior

Reproduction Steps

Target

Scanner

Output Format

Mode

Debug Output

Operating System

Version

Checklist

Replies: 1 comment

nikpivkin Dec 13, 2024 Maintainer

abohne
Dec 12, 2024

nikpivkin
Dec 13, 2024
Maintainer