Config scan on Terraform script: "panic: not a string"

[PlasticGhoul]

Description

I tried to analyze my terraform project, but trivy failed.
Here is my terraform code that seems to be the problem:

resource "azurerm_key_vault_key" "storage_key" {
  name         = "storage-key"
  key_vault_id = azurerm_key_vault.vault.id
  key_type     = "RSA"
  key_size     = "2048"

  key_opts = ["decrypt", "encrypt", "sign", "unwrapKey", "verify", "wrapKey"]

  expiration_date = var.storage_key_expires

  tags = local.tags

  depends_on = [
    azurerm_key_vault_access_policy.storage
  ]
}

Output of run with -debug:

trivy config ./ -d
2023-01-23T11:02:27.109+0100    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-01-23T11:02:27.114+0100    DEBUG   cache dir:  /root/.cache/trivy
2023-01-23T11:02:27.114+0100    INFO    Misconfiguration scanning is enabled
2023-01-23T11:02:27.118+0100    DEBUG   Walk the file tree rooted at '.' in parallel
panic: not a string

goroutine 1 [running]:
github.com/zclconf/go-cty/cty.Value.AsString({{{0x0?, 0x0?}}, {0x0?, 0x0?}})
        /home/runner/go/pkg/mod/github.com/zclconf/go-cty@v1.10.0/cty/value_ops.go:1256 +0x138
github.com/aquasecurity/defsec/internal/adapters/terraform/azure/keyvault.adaptKey(_)
        /home/runner/go/pkg/mod/github.com/aquasecurity/defsec@v0.82.7-0.20221229120130-2bc18528da1c/internal/adapters/terraform/azure/keyvault/adapt.go:154 +0x22f
github.com/aquasecurity/defsec/internal/adapters/terraform/azure/keyvault.(*adapter).adaptVaults(0xc0031117c8, {0xc002cf2458, 0x1, 0xc0031117d8?})
        /home/runner/go/pkg/mod/github.com/aquasecurity/defsec@v0.82.7-0.20221229120130-2bc18528da1c/internal/adapters/terraform/azure/keyvault/adapt.go:74 +0x1765
github.com/aquasecurity/defsec/internal/adapters/terraform/azure/keyvault.Adapt({0xc002cf2458, 0x1, 0x1})
        /home/runner/go/pkg/mod/github.com/aquasecurity/defsec@v0.82.7-0.20221229120130-2bc18528da1c/internal/adapters/terraform/azure/keyvault/adapt.go:20 +0xd3
github.com/aquasecurity/defsec/internal/adapters/terraform/azure.Adapt({_, _, _})
        /home/runner/go/pkg/mod/github.com/aquasecurity/defsec@v0.82.7-0.20221229120130-2bc18528da1c/internal/adapters/terraform/azure/adapt.go:30 +0x2b7
github.com/aquasecurity/defsec/internal/adapters/terraform.Adapt({0xc002cf2458, 0x1, 0x1})
        /home/runner/go/pkg/mod/github.com/aquasecurity/defsec@v0.82.7-0.20221229120130-2bc18528da1c/internal/adapters/terraform/adapt.go:20 +0x7e
github.com/aquasecurity/defsec/pkg/scanners/terraform/executor.(*Executor).Execute(0xc001327900, {0xc002cf2458?, 0x1, 0x1})
        /home/runner/go/pkg/mod/github.com/aquasecurity/defsec@v0.82.7-0.20221229120130-2bc18528da1c/pkg/scanners/terraform/executor/executor.go:96 +0x11a
github.com/aquasecurity/defsec/pkg/scanners/terraform.(*Scanner).ScanFSWithMetrics(0xc0019a4000, {0x82b9508, 0xc0016a6f00}, {0x8221a40?, 0xc000de6030?}, {0x8217ed6, 0x1})
        /home/runner/go/pkg/mod/github.com/aquasecurity/defsec@v0.82.7-0.20221229120130-2bc18528da1c/pkg/scanners/terraform/scanner.go:221 +0x796
github.com/aquasecurity/defsec/pkg/scanners/terraform.(*Scanner).ScanFS(0x66b39c0?, {0x82b9508?, 0xc0016a6f00?}, {0x8221a40?, 0xc000de6030?}, {0x8217ed6?, 0x1?})
        /home/runner/go/pkg/mod/github.com/aquasecurity/defsec@v0.82.7-0.20221229120130-2bc18528da1c/pkg/scanners/terraform/scanner.go:145 +0x4f
github.com/aquasecurity/trivy/pkg/fanal/handler/misconf.misconfPostHandler.Handle({{0x0?, 0xb18e180?, 0xc001998078?}, 0xc001714f90?}, {0x82b9508, 0xc0016a6f00}, 0x1140?, 0xc000dd8000)
        /home/runner/work/trivy/trivy/pkg/fanal/handler/misconf/misconf.go:287 +0x46e
github.com/aquasecurity/trivy/pkg/fanal/handler.Manager.PostHandle({{0xc00158ffc0?, 0x0?, 0x0?}}, {0x82b9508, 0xc0016a6f00}, 0x3?, 0x4?)
        /home/runner/work/trivy/trivy/pkg/fanal/handler/handler.go:74 +0xaf
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect({{0x7fff254b72bb, 0x1}, {0x7f558efa9978, 0xc001736ba0}, {{{0x0, 0x0, 0x0}, {0xc0019a6040, 0x3, 0x4}, ...}}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/local/fs.go:159 +0x4b4
github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0x0, 0x0, 0x0}, {0xc001736ac0, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/scanner/scan.go:144 +0x103
github.com/aquasecurity/trivy/pkg/commands/artifact.scan({_, _}, {{{0x70ab8b6, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0xc0005c8030, ...}, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:586 +0x30f
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x70ab8b6, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:255 +0xcf
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanFS(_, {_, _}, {{{0x70ab8b6, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:204 +0xe5
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanFilesystem(_, {_, _}, {{{0x70ab8b6, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:184 +0x1e5
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x70ab8b6, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0xc0005c8030, ...}, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:400 +0x50d
github.com/aquasecurity/trivy/pkg/commands.NewConfigCommand.func2(0xc0002f4600, {0xc000917ee0, 0x1, 0x2})
        /home/runner/work/trivy/trivy/pkg/commands/app.go:586 +0x2fe
github.com/spf13/cobra.(*Command).execute(0xc0002f4600, {0xc000917ec0, 0x2, 0x2})
        /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.6.0/command.go:916 +0x862
github.com/spf13/cobra.(*Command).ExecuteC(0xc00047d800)
        /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.6.0/command.go:1040 +0x3bd
github.com/spf13/cobra.(*Command).Execute(...)
        /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.6.0/command.go:968
main.run()
        /home/runner/work/trivy/trivy/cmd/trivy/main.go:37 +0x177
main.main()
        /home/runner/work/trivy/trivy/cmd/trivy/main.go:19 +0x19

Output of trivy -v:

trivy -v
Version: 0.36.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-01-23 06:06:57.308610955 +0000 UTC
  NextUpdate: 2023-01-23 12:06:57.308610655 +0000 UTC
  DownloadedAt: 2023-01-23 09:16:03.5302786 +0000 UTC

[giorod3]

Hi @PlasticGhoul, after looking at this issue I see the panic happens because of this line:
expiration_date = var.storage_key_expires

are you sure that var.storage_key_expires is set somewhere? and if so is it set as a string?

[simar7]

hi @PlasticGhoul please reopen if issue still persists.

[itaysk]

I think that regardless whether this particular failure is reproducible, Trivy should never panic especially not due to a check evaluation issue. We've also discussed this in the past in another issue. I'm reopening this with action item to improve error handling.

[simar7]

Yeah fair enough. I've opened #4508 to track this specifically.

[simar7]

Closing as #4508 has been created to resolve this.