AVD-GIT-0001 false positive

[stevehipwell]

IDs

AVD-GIT-0001

Description

We're getting AVD-GIT-0001 flagged up when the repository visibility is set conditionally to one of private or internal despite both being valid values.

resource "github_repository" "default" {
  name = "test"
  visibility = var.private ? "private" : "internal"
}

Reproduction Steps

See Terraform code above.

Target

Filesystem

Scanner

Misconfiguration

Target OS

No response

Debug Output

trivy config --debug  modules/workspace/modules/repo/main.tf                      
2023-10-04T10:53:32.689+0100    INFO    Loaded trivy.yaml
2023-10-04T10:53:32.691+0100    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-10-04T10:53:32.695+0100    DEBUG   cache dir:  C:\Users\******\AppData\Local\trivy
2023-10-04T10:53:32.695+0100    INFO    Misconfiguration scanning is enabled
2023-10-04T10:53:32.696+0100    DEBUG   Policies successfully loaded from disk
2023-10-04T10:53:32.750+0100    DEBUG   Walk the file tree rooted at 'modules/workspace/modules/repo/main.tf' in parallel
2023-10-04T10:53:32.751+0100    DEBUG   Scanning Terraform files for misconfigurations...
2023-10-04T10:53:33.215+0100    DEBUG   OS is not detected.
2023-10-04T10:53:33.215+0100    INFO    Detected config files: 2
2023-10-04T10:53:33.216+0100    DEBUG   Scanned config file: .
2023-10-04T10:53:33.216+0100    DEBUG   Scanned config file: main.tf
2023-10-04T10:53:33.220+0100    DEBUG   Found an ignore yaml: ./.trivyignore.yaml

main.tf (terraform)
===================
Tests: 3 (SUCCESSES: 1, FAILURES: 2, EXCEPTIONS: 0)
Failures: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 1)

CRITICAL: Repository is public,
════════════════════════════════════════
Github repository should be set to be private.

You can do this by either setting <code>private</code> attribute to 'true' or <code>visibility</code> attribute to 'internal' or 'private'.

See https://avd.aquasec.com/misconfig/avd-git-0001
────────────────────────────────────────
 main.tf:1-40
────────────────────────────────────────
   1 ┌ resource "github_repository" "default" {
   2 │   name = var.name
   3 │
   4 │   # Visibility
   5 │   visibility = var.private ? "private" : "internal"
   6 │
   7 │   # Features
   8 │   has_issues      = true
   9 └   has_projects    = false
  ..
────────────────────────────────────────

Version

trivy --version
Version: 0.45.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-10-04 06:16:25.080769524 +0000 UTC
  NextUpdate: 2023-10-04 12:16:25.080768924 +0000 UTC
  DownloadedAt: 2023-10-04 09:44:54.5827739 +0000 UTC
Policy Bundle:
  Digest: sha256:24b38cdf646f0e5becf55a709ae9a3c4e819a348c28990cec0b6aabe4637d8b1
  DownloadedAt: 2023-10-04 09:44:55.7721262 +0000 UTC

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[nikpivkin]

Hi @stevehipwell !

Is the value set to var.private? as the default value, for example:

variable "private" {
  type = bool
  default = false
}

or via the --tf-vars argument?

[stevehipwell]

The docs say the following so this code should be correct no matter what the var is set to.

You can do this by either setting private attribute to ‘true’ or visibility attribute to ‘internal’ or ‘private’.

In my actual code this is in an inline module which uses a for_each block where some repos should be private and some internal.

[stevehipwell]

This is still not working correctly.

[nikpivkin]

@stevehipwell All operands must be known values in order to evaluate a conditional expression. What you suggest can only be achieved by traversing the syntax tree of the expression, but this is only realisable when true_val and false_val are known expressions. So it may lead to the overhead of parsing the tree and storing the result as some uncomputed value.

So you can simply provide the value of the variable via the --tf-vars flag.

[stevehipwell]

@nikpivkin firstly there is a condition on the input that restricts it to internal or private so it cannot ever be public. Secondly it's in a nested module called multiple times and the values come from a file but are fixed. Thirdly is it policy for Trivy to fail closed when inputs are unknown, if so I've not seen this documented?

[simar7]

As @nikpivkin mentioned, if the variable is defined correctly, there doesn't seem to be an issue.

$ cat main.tf
variable "private" {
  type = bool
  default = false 
}

resource "github_repository" "default" {
  name = "test"
  visibility = var.private ? "private" : "public"
}


$ cat main.tfvars 
private = "true"

$ trivy --debug config --tf-vars=./main.tfvars .
2023-11-15T16:19:58.687-0700    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-11-15T16:19:58.698-0700    DEBUG   cache dir:  /Users/simarpreetsingh/Library/Caches/trivy
2023-11-15T16:19:58.698-0700    INFO    Misconfiguration scanning is enabled
2023-11-15T16:19:58.699-0700    DEBUG   Policies successfully loaded from disk
2023-11-15T16:19:58.723-0700    DEBUG   The nuget packages directory couldn't be found. License search disabled
2023-11-15T16:19:58.724-0700    DEBUG   Walk the file tree rooted at '.' in parallel
2023-11-15T16:19:58.724-0700    DEBUG   Scanning Terraform files for misconfigurations...
2023-11-15T16:19:59.084-0700    DEBUG   OS is not detected.
2023-11-15T16:19:59.084-0700    INFO    Detected config files: 2
2023-11-15T16:19:59.084-0700    DEBUG   Scanned config file: .
2023-11-15T16:19:59.084-0700    DEBUG   Scanned config file: main.tf

main.tf (terraform)

Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

HIGH: Repository does not have vulnerability alerts enabled,
═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
GitHub repository should be set to use vulnerability alerts.

You can do this by setting the <code>vulnerability_alerts</code> attribute to 'true'.

See https://avd.aquasec.com/misconfig/avd-git-0003
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 main.tf:6-9
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   6 ┌ resource "github_repository" "default" {
   7 │   name = "test"
   8 │   visibility = var.private ? "private" : "public"
   9 └ }
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

In my actual code this is in an inline module which uses a for_each block where some repos should be private and some internal.

firstly there is a condition on the input that restricts it to internal or private so it cannot ever be public. Secondly it's in a nested module called multiple times and the values come from a file but are fixed.

Can you share your code with us so we can reproduce the issue?