Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Terraform] Parsing failure due to provider-defined functions in terraform #6947

Open
gdowmont opened this issue Jan 13, 2025 · 0 comments
Open

Comments

@gdowmont
Copy link

Checkov should not have parsing errors with files containing provider-defined functions in terraform.

This was implemented in terraform 1.8 (https://www.hashicorp.com/blog/terraform-1-8-improves-extensibility-with-provider-defined-functions).

Example syntax (this is specific to AWS provider https://registry.terraform.io/providers/hashicorp/aws/latest/docs/functions/arn_build ) looks like:
identifiers = [provider::aws::arn_build("aws", "iam", "", data.aws_caller_identity.current.account_id, "root")]

Steps to replicate/test:

  1. Create a policy.tf file containing:
data "aws_iam_policy_document" "firehose_key_policy" {
  statement {
    sid       = "Enable IAM User Permissions"
    effect    = "Allow"
    resources = ["*"]
    actions   = ["kms:*"]

    principals {
      type        = "AWS"
      identifiers = [provider::aws::arn_build("aws", "iam", "", data.aws_caller_identity.current.account_id, "root")]
    }
  }
  1. Run checkov against the file
@gdowmont gdowmont changed the title Parsing failure due to provider-defined functions in terraform [Terraform] Parsing failure due to provider-defined functions in terraform Jan 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant