Trivy 0.51.1 crash scanning Terraform config

[mikkoc]

Description

We upgraded from 0.50.4 to 0.51.1 and this broke our workflows.

$ trivy config --format table  .
2024-05-15T12:59:35+04:00	INFO	Misconfiguration scanning is enabled
panic: WithoutOptionalAttributesDeep does not support the given type

goroutine 1 [running]:
github.com/zclconf/go-cty/cty.Type.WithoutOptionalAttributesDeep({{0x0?, 0x0?}})
	github.com/zclconf/go-cty@v1.14.4/cty/type.go:152 +0x320
github.com/zclconf/go-cty/cty/convert.conversionObjectToObject.func1({{{0x10c0633d0?, 0x140081d3420?}}, {0x10b39b940?, 0x14008aa5d40?}}, {0x140081d3d80, 0x1, 0x1})
	github.com/zclconf/go-cty@v1.14.4/cty/convert/conversion_object.go:86 +0x2ac
github.com/zclconf/go-cty/cty/convert.getConversion.func1({{{0x10c0633d0?, 0x140081d3420?}}, {0x10b39b940?, 0x14008aa5d40?}}, {0x140081d3d80, 0x1, 0x1})
	github.com/zclconf/go-cty@v1.14.4/cty/convert/conversion.go:57 +0x1fc
github.com/zclconf/go-cty/cty/convert.conversionTupleToList.func2({{{0x10c063360?, 0x14003df1a58?}}, {0x10aef2d00?, 0x14003df1a70?}}, {0x0, 0x0, 0x0})
	github.com/zclconf/go-cty@v1.14.4/cty/convert/conversion_collection.go:341 +0x298
github.com/zclconf/go-cty/cty/convert.getConversion.func1({{{0x10c063360?, 0x14003df1a58?}}, {0x10aef2d00?, 0x14003df1a70?}}, {0x0, 0x0, 0x0})
	github.com/zclconf/go-cty@v1.14.4/cty/convert/conversion.go:57 +0x1fc
github.com/zclconf/go-cty/cty/convert.GetConversionUnsafe.retConversion.func1({{{0x10c063360?, 0x14003df1a58?}}, {0x10aef2d00?, 0x14003df1a70?}})
	github.com/zclconf/go-cty@v1.14.4/cty/convert/conversion.go:199 +0x40
github.com/zclconf/go-cty/cty/convert.Convert({{{0x10c063360?, 0x14003df1a58?}}, {0x10aef2d00?, 0x14003df1a70?}}, {{0x10c0632f0?, 0x140081d38f0?}})
	github.com/zclconf/go-cty@v1.14.4/cty/convert/public.go:51 +0x1e8
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateVariable(0x14000ac7800, 0x140074fb6c0)
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:459 +0x320
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).getValuesByBlockType(0x14000ac7800, {0x10931d3d8, 0x8})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:492 +0x760
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateStep(0x14000ac7800)
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:95 +0x30
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateSteps(0x14000ac7800)
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:227 +0x50
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).EvaluateAll(0x14000ac7800, {0x10c062250, 0x14000cb79d0})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:132 +0x11c
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateSubmodule(0x14005c9a540, {0x10c062250, 0x14000cb79d0}, 0x140052e9800)
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:210 +0x104
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).EvaluateAll(0x14005c9a540, {0x10c062250, 0x14000cb79d0})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:145 +0x598
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateSubmodule(0x14001be5080, {0x10c062250, 0x14000cb79d0}, 0x14002ab7440)
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:210 +0x104
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).EvaluateAll(0x14001be5080, {0x10c062250, 0x14000cb79d0})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:145 +0x598
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*Parser).EvaluateAll(0x14004dab200, {0x10c062250, 0x14000cb79d0})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/parser.go:292 +0x64
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform.(*Scanner).ScanFS(0x1400346dd00, {0x10c062250, 0x14000cb79d0}, {0x10bfb0960, 0x14003b07aa0}, {0x10aacefa0, 0x1})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/scanner.go:198 +0x4a0
github.com/aquasecurity/trivy/pkg/misconf.(*Scanner).Scan(0x140024ad8f0, {0x10c062250, 0x14000cb79d0}, {0x10bfb0960?, 0x14002f3a8d0?})
	github.com/aquasecurity/trivy/pkg/misconf/scanner.go:157 +0x1bc
github.com/aquasecurity/trivy/pkg/fanal/analyzer/config.(*Analyzer).PostAnalyze(0x14000535240, {0x10c062250?, 0x14000cb79d0?}, {{0x10bfb0960?, 0x14002f3a8d0?}, {0x9?, 0x0?}})
	github.com/aquasecurity/trivy/pkg/fanal/analyzer/config/config.go:45 +0x38
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze({0x14003efb2d0, {0x140031ea0c0, 0x3, 0x4}, {0x140037d8500, 0x8, 0x8}, 0x14002484330}, {0x10c062250, 0x14000cb79d0}, ...)
	github.com/aquasecurity/trivy/pkg/fanal/analyzer/analyzer.go:493 +0x228
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect({{0x16cf8f984, 0x1}, {0x117b8c718, 0x14003efaf60}, {0x10bfb08e0, 0x110077e28}, {0x14003efb2d0, {0x140031ea0c0, 0x3, 0x4}, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/fanal/artifact/local/fs.go:120 +0x37c
github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0x0, 0x0, 0x0}, {0x14003efaeb0, ...}, ...})
	github.com/aquasecurity/trivy/pkg/scanner/scan.go:146 +0xa4
github.com/aquasecurity/trivy/pkg/commands/artifact.scan({_, _}, {{{0x10932f06a, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, {0x14000dcbd10, ...}, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:691 +0x32c
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x10932f06a, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:264 +0xa8
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanFS(_, {_, _}, {{{0x10932f06a, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, ...}, ...})
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:212 +0xac
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanFilesystem(_, {_, _}, {{{0x10932f06a, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, ...}, ...})
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:192 +0x1b8
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x10932f06a, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, {0x14000dcbd10, ...}, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:425 +0x408
github.com/aquasecurity/trivy/pkg/commands.NewConfigCommand.func2(0x14002fb0608, {0x1400247c630, 0x1, 0x3})
	github.com/aquasecurity/trivy/pkg/commands/app.go:699 +0x294
github.com/spf13/cobra.(*Command).execute(0x14002fb0608, {0x1400247c5d0, 0x3, 0x3})
	github.com/spf13/cobra@v1.8.0/command.go:983 +0x840
github.com/spf13/cobra.(*Command).ExecuteC(0x14000dcdb08)
	github.com/spf13/cobra@v1.8.0/command.go:1115 +0x344
github.com/spf13/cobra.(*Command).Execute(0x10939c397?)
	github.com/spf13/cobra@v1.8.0/command.go:1039 +0x1c
main.run()
	github.com/aquasecurity/trivy/cmd/trivy/main.go:41 +0x158
main.main()
	github.com/aquasecurity/trivy/cmd/trivy/main.go:19 +0x20

Desired Behavior

Trivy should not crash

Actual Behavior

Trivy crashes

Reproduction Steps

1. Upgrade to Trivy 0.51.1
2. Run ` trivy config --format table  .` on our Terraform folder
3. Crash

Target

Filesystem

Scanner

None

Output Format

Table

Mode

Standalone

Debug Output

$ trivy config --format table . --debug
2024-05-15T13:01:08+04:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-05-15T13:01:08+04:00	DEBUG	Cache dir	dir="/Users/myusername/Library/Caches/trivy"
2024-05-15T13:01:08+04:00	INFO	Misconfiguration scanning is enabled
2024-05-15T13:01:08+04:00	DEBUG	Policies successfully loaded from disk
2024-05-15T13:01:08+04:00	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-05-15T13:01:08+04:00	DEBUG	[nuget] The nuget packages directory couldn't be found. License search disabled
2024-05-15T13:01:08+04:00	DEBUG	Skipping path	path=".terraform/modules/acm_private_ca.cloudfront_crl/.git"
2024-05-15T13:01:08+04:00	DEBUG	Skipping path	path=".terraform/modules/acm_private_ca.kms_truststore/.git"
2024-05-15T13:01:08+04:00	DEBUG	Skipping path	path=".terraform/modules/acm_private_ca.mtls_truststore/.git"
2024-05-15T13:01:08+04:00	DEBUG	Skipping path	path=".terraform/modules/eks.aws_auth/.git"
2024-05-15T13:01:08+04:00	DEBUG	Skipping path	path=".terraform/modules/eks.aws_cni_role/.git"
2024-05-15T13:01:08+04:00	DEBUG	Scanning files for misconfigurations...	scanner="Terraform"
2024-05-15T13:01:08+04:00	DEBUG	[misconf] 01:08.796489000 terraform.scanner                Scanning [&{%!s(*mapfs.file=&{ [] {. 256 2147484096 {13945744057653222240 373175709 0x10defc740} <nil>} {{{0 0} {[] {} 0x14001f2cff0} map[.terraform:0x1400256b388 blah5.tf:0x14001e27c28 blah1.tf:0x14001e27c38 data.tf:0x14001e27c48 flux.tf:0x14001e27c58 global.tf:0x14001e27c68 kms.tf:0x14001e27c78 locals.tf:0x14001e27c88 logs.tf:0x14001e27c98 main.tf:0x14001e27ca8 outputs.tf:0x14001e27cb8 blah.tf:0x14001e27cc8 blah3.tf:0x14001e27cd8 blah2.tf:0x14001e27ce8 terraform.tf:0x14001e27cf8 versions.tf:0x14001e27d08] 0}}}) .}] at '.'...
2024-05-15T13:01:08+04:00	DEBUG	[misconf] 01:08.807670000 terraform.scanner.rego           Overriding filesystem for checks!
2024-05-15T13:01:08+04:00	DEBUG	[misconf] 01:08.808145000 terraform.scanner.rego           Loaded 3 embedded libraries.
2024-05-15T13:01:08+04:00	DEBUG	[misconf] 01:08.833110000 terraform.scanner.rego           Loaded 191 embedded policies.
2024-05-15T13:01:08+04:00	DEBUG	[misconf] 01:08.879878000 terraform.scanner.rego           Loaded 194 policies from disk.
2024-05-15T13:01:08+04:00	DEBUG	[misconf] 01:08.880137000 terraform.scanner.rego           Overriding filesystem for data!
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.045603000 terraform.parser.<root>          Setting project/module root to '.'
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.045622000 terraform.parser.<root>          Parsing FS from '.'

[...]

2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.389428000 terraform.parser.<eks>.evaluator Evaluating submodule aws_auth
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.399001000 terraform.parser.<eks>.evaluator Submodule aws_auth inputs unchanged
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.399019000 terraform.parser.<eks>.evaluator Evaluating submodule aws_cni_role
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.409609000 terraform.parser.<eks>.evaluator Submodule aws_auth inputs unchanged
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.409639000 terraform.parser.<eks>.evaluator Submodule aws_cni_role inputs unchanged
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.409668000 terraform.parser.<eks>.evaluator Evaluating submodule aws_cognito
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.419878000 terraform.parser.<eks>.evaluator Submodule aws_auth inputs unchanged
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.419904000 terraform.parser.<eks>.evaluator Submodule aws_cni_role inputs unchanged
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.419942000 terraform.parser.<eks>.evaluator Submodule aws_cognito inputs unchanged
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.419957000 terraform.parser.<eks>.evaluator Evaluating submodule aws_secret_operator_role
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.433906000 terraform.parser.<eks>.evaluator Submodule aws_auth inputs unchanged
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.433936000 terraform.parser.<eks>.evaluator Submodule aws_cni_role inputs unchanged
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.433984000 terraform.parser.<eks>.evaluator Submodule aws_cognito inputs unchanged
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.434007000 terraform.parser.<eks>.evaluator Submodule aws_secret_operator_role inputs unchanged
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.434168000 terraform.parser.<eks>.evaluator Evaluating submodule eks
2024-05-15T13:01:09+04:00	DEBUG	[misconf] 01:09.531024000 terraform.parser.<eks>.evaluator Evaluating submodule aws_auth
panic: WithoutOptionalAttributesDeep does not support the given type

goroutine 1 [running]:
github.com/zclconf/go-cty/cty.Type.WithoutOptionalAttributesDeep({{0x0?, 0x0?}})
	github.com/zclconf/go-cty@v1.14.4/cty/type.go:152 +0x320
github.com/zclconf/go-cty/cty/convert.conversionObjectToObject.func1({{{0x109f733d0?, 0x1400522c5a0?}}, {0x1092ab940?, 0x140022137a0?}}, {0x1400522cfb0, 0x1, 0x1})
	github.com/zclconf/go-cty@v1.14.4/cty/convert/conversion_object.go:86 +0x2ac
github.com/zclconf/go-cty/cty/convert.getConversion.func1({{{0x109f733d0?, 0x1400522c5a0?}}, {0x1092ab940?, 0x140022137a0?}}, {0x1400522cfb0, 0x1, 0x1})
	github.com/zclconf/go-cty@v1.14.4/cty/convert/conversion.go:57 +0x1fc
github.com/zclconf/go-cty/cty/convert.conversionTupleToList.func2({{{0x109f73360?, 0x14003c67110?}}, {0x108e02d00?, 0x14003c67128?}}, {0x0, 0x0, 0x0})
	github.com/zclconf/go-cty@v1.14.4/cty/convert/conversion_collection.go:341 +0x298
github.com/zclconf/go-cty/cty/convert.getConversion.func1({{{0x109f73360?, 0x14003c67110?}}, {0x108e02d00?, 0x14003c67128?}}, {0x0, 0x0, 0x0})
	github.com/zclconf/go-cty@v1.14.4/cty/convert/conversion.go:57 +0x1fc
github.com/zclconf/go-cty/cty/convert.GetConversionUnsafe.retConversion.func1({{{0x109f73360?, 0x14003c67110?}}, {0x108e02d00?, 0x14003c67128?}})
	github.com/zclconf/go-cty@v1.14.4/cty/convert/conversion.go:199 +0x40
github.com/zclconf/go-cty/cty/convert.Convert({{{0x109f73360?, 0x14003c67110?}}, {0x108e02d00?, 0x14003c67128?}}, {{0x109f732f0?, 0x1400522cb20?}})
	github.com/zclconf/go-cty@v1.14.4/cty/convert/public.go:51 +0x1e8
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateVariable(0x140038c8780, 0x140034a3c00)
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:459 +0x320
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).getValuesByBlockType(0x140038c8780, {0x10722d3d8, 0x8})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:492 +0x760
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateStep(0x140038c8780)
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:95 +0x30
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateSteps(0x140038c8780)
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:227 +0x50
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).EvaluateAll(0x140038c8780, {0x109f72250, 0x140012aaa80})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:132 +0x11c
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateSubmodule(0x140052ac780, {0x109f72250, 0x140012aaa80}, 0x14004812dc0)
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:210 +0x104
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).EvaluateAll(0x140052ac780, {0x109f72250, 0x140012aaa80})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:145 +0x598
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).evaluateSubmodule(0x140038c9440, {0x109f72250, 0x140012aaa80}, 0x1400477ea40)
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:210 +0x104
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*evaluator).EvaluateAll(0x140038c9440, {0x109f72250, 0x140012aaa80})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/evaluator.go:145 +0x598
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser.(*Parser).EvaluateAll(0x14000d5d7a0, {0x109f72250, 0x140012aaa80})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser/parser.go:292 +0x64
github.com/aquasecurity/trivy/pkg/iac/scanners/terraform.(*Scanner).ScanFS(0x14003415b00, {0x109f72250, 0x140012aaa80}, {0x109ec0960, 0x140019fd008}, {0x1089defa0, 0x1})
	github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/scanner.go:198 +0x4a0
github.com/aquasecurity/trivy/pkg/misconf.(*Scanner).Scan(0x140025cefc0, {0x109f72250, 0x140012aaa80}, {0x109ec0960?, 0x14002da4288?})
	github.com/aquasecurity/trivy/pkg/misconf/scanner.go:157 +0x1bc
github.com/aquasecurity/trivy/pkg/fanal/analyzer/config.(*Analyzer).PostAnalyze(0x14003733200, {0x109f72250?, 0x140012aaa80?}, {{0x109ec0960?, 0x14002da4288?}, {0x9?, 0x0?}})
	github.com/aquasecurity/trivy/pkg/fanal/analyzer/config/config.go:45 +0x38
github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.PostAnalyze({0x14003907790, {0x1400342a580, 0x3, 0x4}, {0x14003c46c80, 0x8, 0x8}, 0x140025c5500}, {0x109f72250, 0x140012aaa80}, ...)
	github.com/aquasecurity/trivy/pkg/fanal/analyzer/analyzer.go:493 +0x228
github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect({{0x16f07f97c, 0x1}, {0x115b34308, 0x14003907300}, {0x109ec08e0, 0x10df87e28}, {0x14003907790, {0x1400342a580, 0x3, 0x4}, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/fanal/artifact/local/fs.go:120 +0x37c
github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0x0, 0x0, 0x0}, {0x140039071d0, ...}, ...})
	github.com/aquasecurity/trivy/pkg/scanner/scan.go:146 +0xa4
github.com/aquasecurity/trivy/pkg/commands/artifact.scan({_, _}, {{{0x10723f06a, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x140000be990, ...}, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:691 +0x32c
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x10723f06a, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:264 +0xa8
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanFS(_, {_, _}, {{{0x10723f06a, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:212 +0xac
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanFilesystem(_, {_, _}, {{{0x10723f06a, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:192 +0x1b8
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x10723f06a, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x140000be990, ...}, ...}, ...}, ...)
	github.com/aquasecurity/trivy/pkg/commands/artifact/run.go:425 +0x408
github.com/aquasecurity/trivy/pkg/commands.NewConfigCommand.func2(0x1400328e608, {0x1400342a1c0, 0x1, 0x4})
	github.com/aquasecurity/trivy/pkg/commands/app.go:699 +0x294
github.com/spf13/cobra.(*Command).execute(0x1400328e608, {0x1400342a180, 0x4, 0x4})
	github.com/spf13/cobra@v1.8.0/command.go:983 +0x840
github.com/spf13/cobra.(*Command).ExecuteC(0x14000ad7b08)
	github.com/spf13/cobra@v1.8.0/command.go:1115 +0x344
github.com/spf13/cobra.(*Command).Execute(0x1072ac397?)
	github.com/spf13/cobra@v1.8.0/command.go:1039 +0x1c
main.run()
	github.com/aquasecurity/trivy/cmd/trivy/main.go:41 +0x158
main.main()
	github.com/aquasecurity/trivy/cmd/trivy/main.go:19 +0x20

Operating System

Both OSX and Ubuntu Linux 22.04

Version

$ trivy --version
Version: 0.51.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-05-08 12:11:15.848761516 +0000 UTC
  NextUpdate: 2024-05-08 18:11:15.848761066 +0000 UTC
  DownloadedAt: 2024-05-08 12:32:40.385957 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-05-08 01:00:15.278286277 +0000 UTC
  NextUpdate: 2024-05-11 01:00:15.278286107 +0000 UTC
  DownloadedAt: 2024-05-08 10:10:23.205785 +0000 UTC
Check Bundle:
  Digest: sha256:6d0771effa53c6cf8130861fc3ac28f5515c35a028edb4bb1e67261b9218c80e
  DownloadedAt: 2024-05-15 08:39:57.457901 +0000 UTC

Checklist

• Run trivy image --reset
• Read the troubleshooting

[nikpivkin]

Hi @mikkoc !

Could you please share an example of the configuration that is causing the problem?

This is interesting, since according to the go-cty source code this should never happen.

[mikkoc]

My colleague found the bug. Trivy does not like the double / anymore.
Unfortunately removing the // breaks Terraform init.

module "aws_auth" {
  source  = "terraform-aws-modules/eks/aws//modules/aws-auth"
  version = "~> 20.0"

  # aws-auth configmap
  manage_aws_auth_configmap = true
[...]
}

[nikpivkin]

This example doesn't cause panic. I think the problem is related to the arguments that are passed to the module.

[squer-rcapraro]

Thanks for the pointer @nikpivkin , indeed the problem is in the parameters; the combination of the three parameters in aws_auth_roles causes the issue.

module "aws_auth" {
  source  = "terraform-aws-modules/eks/aws//modules/aws-auth"
  version = "~> 20.0"

  # aws-auth configmap
  manage_aws_auth_configmap = true

  aws_auth_roles = [
    {
      rolearn  = module.eks.eks_managed_node_groups.core.iam_role_arn
      username = "..."
      groups   = ["..."]
    },
    {
      rolearn  = local.admin_role.0
      username = "..."
      groups   = ["..."]
    },
    {
      rolearn  = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/..."
      username = "..."
      groups   = ["..."]
    },
  ]
}

Casting the parameters to string prevented the panic to occur. Please let me know if you need more info, I think the problem is that those parameters are resolved to different types, hence the function is not able to infer the type of the list (namely, a common type for the objects)

module "aws_auth" {
  ...

  aws_auth_roles = [
    {
      rolearn  = tostring(module.eks.eks_managed_node_groups.core.iam_role_arn)
      username = "..."
      groups   = ["..."]
    },
    {
      rolearn  = tostring(local.admin_role.0)
      username = "..."
      groups   = ["..."]
    },
    {
      rolearn  = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/..."
      username = "..."
      groups   = ["..."]
    },
  ]
}

[simar7]

Thanks for the report @mikkoc - I'll create this into an issue to track. We shouldn't panic in such a case.

[simar7]

Track #6697

[nikpivkin]

@squer-rcapraro What value or data types do rolearn fields have?

[simar7]

@squer-rcapraro we aren't able to reproduce this issue locally. If you can help us repro it by providing the right input feel free to comment here to let us know.