bridgecrewio
[Terraform] Parsing failure due to provider-defined functions in terraform
Checkov should not have parsing errors with files containing provider-defined functions in terraform.
This was implemented in terraform 1.8 (https://www.hashicorp.com/blog/terraform-1-8-improves-extensibility-with-provider-defined-functions).
Example syntax (this is specific to AWS provider https://registry.terraform.io/providers/hashicorp/aws/latest/docs/functions/arn_build ) looks like:
identifiers = [provider::aws::arn_build("aws", "iam", "", data.aws_caller_identity.current.account_id, "root")]
Steps to replicate/test:
- Create a policy.tf file containing:
data "aws_iam_policy_document" "firehose_key_policy" {
statement {
sid = "Enable IAM User Permissions"
effect = "Allow"
resources = ["*"]
actions = ["kms:*"]
principals {
type = "AWS"
identifiers = [provider::aws::arn_build("aws", "iam", "", data.aws_caller_identity.current.account_id, "root")]
}
}
- Run checkov against the file
As we're more widely adopting provider-defined functions, we're having more and more of a gap with our checkov results that are now silently failing to parse files.
This is currently blocking our usage of Checkov with the latest azurerm 4.x provider. Will provider functions be supported with Checkov scanning?
