Skip to content

feat(terraform): add partial evaluation for policy templates #8967

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Jun 28, 2025
Merged

feat(terraform): add partial evaluation for policy templates #8967

merged 2 commits into from
Jun 28, 2025

Conversation

nikpivkin
Copy link
Contributor

@nikpivkin nikpivkin commented Jun 2, 2025 •
edited
Loading

Description

This PR adds partial evaluation of template expressions used when writing AWS policies in Terraform. Those parts of the template that could not be evaluated due to errors or unknown values are replaced with __UNRESOLVED__ literal.

Related issues

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

@nikpivkin nikpivkin marked this pull request as ready for review June 2, 2025 17:09
@nikpivkin nikpivkin requested a review from simar7 as a code owner June 2, 2025 17:09
simar7
simar7 reviewed Jun 14, 2025
View reviewed changes
pkg/iac/adapters/terraform/aws/iam/convert.go
Comment on lines +20 to +25
attr.RewriteExpr(func(e hclsyntax.Expression) hclsyntax.Expression {
if te, ok := e.(*hclsyntax.TemplateExpr); ok {
return &terraform.PartialTemplateExpr{TemplateExpr: te}
}
return e
})
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would we be re-writing each expression on every call? Is there any way to somehow selectively do this only for the cases where we could potentially encounter an unknown value? My only concern asking this is about performance.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rewriting will only occur for expressions in policy blocks. Is structure wrapping an expensive operation?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A small benchmark that includes template expression parsing:

BenchmarkEvalExpr/baseline-8         	   18002	     66560 ns/op	   24299 B/op	     267 allocs/op
BenchmarkEvalExpr/rewrite-8          	   17904	     66774 ns/op	   25963 B/op	     273 allocs/op

@simar7 simar7 added this pull request to the merge queue Jun 28, 2025
Merged via the queue into aquasecurity:main with commit a9f7dcd Jun 28, 2025
12 checks passed
@aqua-bot aqua-bot mentioned this pull request Jun 28, 2025
Merged
alexlebens pushed a commit to alexlebens/infrastructure that referenced this pull request Jul 5, 2025
@alexlebens
Update mirror.gcr.io/aquasec/trivy Docker tag to v0.64.1 (#812)
12831ad 
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [mirror.gcr.io/aquasec/trivy](https://www.aquasec.com/products/trivy/) ([source](https://github.com/aquasecurity/trivy)) | minor | `0.63.0` -> `0.64.1` |

---

### Release Notes

<details>
<summary>aquasecurity/trivy (mirror.gcr.io/aquasec/trivy)</summary>

### [`v0.64.1`](https://github.com/aquasecurity/trivy/releases/tag/v0.64.1)

[Compare Source](aquasecurity/trivy@v0.64.0...v0.64.1)

#### Changelog

- [`86ee3c1`](aquasecurity/trivy@86ee3c1) release: v0.64.1 \[release/v0.64] ([#&#8203;9122](aquasecurity/trivy#9122))
- [`4e12722`](aquasecurity/trivy@4e12722) fix(misconf): skip rewriting expr if attr is nil \[backport: release/v0.64] ([#&#8203;9127](aquasecurity/trivy#9127))
- [`9a7d384`](aquasecurity/trivy@9a7d384) fix(cli): Add more non-sensitive flags to telemetry \[backport: release/v0.64] ([#&#8203;9124](aquasecurity/trivy#9124))
- [`53adfba`](aquasecurity/trivy@53adfba) fix(rootio): check full version to detect `root.io` packages \[backport: release/v0.64] ([#&#8203;9120](aquasecurity/trivy#9120))
- [`8cf1bf9`](aquasecurity/trivy@8cf1bf9) fix(alma): parse epochs from rpmqa file \[backport: release/v0.64] ([#&#8203;9119](aquasecurity/trivy#9119))

### [`v0.64.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0640-2025-06-30)

[Compare Source](aquasecurity/trivy@v0.63.0...v0.64.0)

##### Features

- **cli:** add version constraints to annoucements ([#&#8203;9023](aquasecurity/trivy#9023)) ([19efa9f](aquasecurity/trivy@19efa9f))
- **java:** dereference all maven settings.xml env placeholders ([#&#8203;9024](aquasecurity/trivy#9024)) ([5aade69](aquasecurity/trivy@5aade69))
- **misconf:** add OpenTofu file extension support ([#&#8203;8747](aquasecurity/trivy#8747)) ([57801d0](aquasecurity/trivy@57801d0))
- **misconf:** normalize CreatedBy for buildah and legacy docker builder ([#&#8203;8953](aquasecurity/trivy#8953)) ([65e155f](aquasecurity/trivy@65e155f))
- **redhat:** Add EOL date for RHEL 10. ([#&#8203;8910](aquasecurity/trivy#8910)) ([48258a7](aquasecurity/trivy@48258a7))
- reject unsupported artifact types in remote image retrieval ([#&#8203;9052](aquasecurity/trivy#9052)) ([1e1e1b5](aquasecurity/trivy@1e1e1b5))
- **sbom:** add manufacturer field to CycloneDX tools metadata ([#&#8203;9019](aquasecurity/trivy#9019)) ([41d0f94](aquasecurity/trivy@41d0f94))
- **terraform:** add partial evaluation for policy templates ([#&#8203;8967](aquasecurity/trivy#8967)) ([a9f7dcd](aquasecurity/trivy@a9f7dcd))
- **ubuntu:** add end of life date for Ubuntu 25.04 ([#&#8203;9077](aquasecurity/trivy#9077)) ([367564a](aquasecurity/trivy@367564a))
- **ubuntu:** add eol date for 20.04-ESM ([#&#8203;8981](aquasecurity/trivy#8981)) ([87118a0](aquasecurity/trivy@87118a0))
- **vuln:** add Root.io support for container image scanning ([#&#8203;9073](aquasecurity/trivy#9073)) ([3a0ec0f](aquasecurity/trivy@3a0ec0f))

##### Bug Fixes

- Add missing version check flags ([#&#8203;8951](aquasecurity/trivy#8951)) ([ef5f8de](aquasecurity/trivy@ef5f8de))
- **cli:** add some values to the telemetry call ([#&#8203;9056](aquasecurity/trivy#9056)) ([fd2bc91](aquasecurity/trivy@fd2bc91))
- Correctly check for semver versions for trivy version check ([#&#8203;8948](aquasecurity/trivy#8948)) ([b813527](aquasecurity/trivy@b813527))
- don't show corrupted trivy-db warning for first run ([#&#8203;8991](aquasecurity/trivy#8991)) ([4ed78e3](aquasecurity/trivy@4ed78e3))
- **misconf:** .Config.User always takes precedence over USER in .History ([#&#8203;9050](aquasecurity/trivy#9050)) ([371b8cc](aquasecurity/trivy@371b8cc))
- **misconf:** correct Azure value-to-time conversion in AsTimeValue ([#&#8203;9015](aquasecurity/trivy#9015)) ([40d017b](aquasecurity/trivy@40d017b))
- **misconf:** move disabled checks filtering after analyzer scan ([#&#8203;9002](aquasecurity/trivy#9002)) ([a58c36d](aquasecurity/trivy@a58c36d))
- **misconf:** reduce log noise on incompatible check ([#&#8203;9029](aquasecurity/trivy#9029)) ([99c5151](aquasecurity/trivy@99c5151))
- **nodejs:** correctly parse `packages` array of `bun.lock` file ([#&#8203;8998](aquasecurity/trivy#8998)) ([875ec3a](aquasecurity/trivy@875ec3a))
- **report:** don't panic when report contains vulns, but doesn't contain packages for `table` format ([#&#8203;8549](aquasecurity/trivy#8549)) ([87fda76](aquasecurity/trivy@87fda76))
- **sbom:** remove unnecessary OS detection check in SBOM decoding ([#&#8203;9034](aquasecurity/trivy#9034)) ([198789a](aquasecurity/trivy@198789a))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xLjMiLCJ1cGRhdGVkSW5WZXIiOiI0MS4xLjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImltYWdlIl19-->

Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/812
Co-authored-by: Renovate Bot <[email protected]>
Co-committed-by: Renovate Bot <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@simar7 simar7 simar7 approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

bug(misconf): Handle resources where pattern evaluation can return an unknown value
2 participants
@nikpivkin @simar7