Run trivy config in terraform dry modules #8220
Replies: 1 comment 4 replies
-
|
hi @JulesClaussen - the issue isn't that Trivy isn't able to fetch remote modules (which is what you're trying to do here with dry terraform configs) but instead that Trivy doesn't have necessary permissions to go fetch them in the CI as you are able to locally. When you run locally, Trivy can fetch remote modules as seen here: 2025-01-08T16:41:08Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="failed to locate cache directory: cache directory is not writable"
2025-01-08T16:41:08Z DEBUG [terraform evaluator] Locating non-initialized module source="github.com/myorg/myrepo//some-module?ref=some-module-v4.1.1"
2025-01-08T16:41:08Z DEBUG [module resolver] Resolving module name="module.aurora_postgresql_router" source="github.com/myorg/myrepo//some-module?ref=some-module-v4.1.1" |
Beta Was this translation helpful? Give feedback.
-
|
Hi @JulesClaussen ! Are your modules in a private repository? If so, Simar is right. You need to access the repo before scanning. See aquasecurity/trivy-action#383 |
Beta Was this translation helpful? Give feedback.
-
|
Hello @nikpivkin and @simar7, I have both private and public repos, and both returns the same "Locating non-initialized module" error. Logs for public modules: (looks like it achieves to pull it?) Logs for private modules: |
Beta Was this translation helpful? Give feedback.
-
|
I just now noticed that the cache directory does not allow writing |
Beta Was this translation helpful? Give feedback.
-
|
These are my github action steps. Quite blunt, then you can see all my attempts, but overall both trivy-action, and manual are failing: Thanks @nikpivkin |
Beta Was this translation helpful? Give feedback.
-
Description
Hello !
I am using terraform along with terragrunt. So all my terraform modules are dry, and I do not run terraform init commands (but terragrunt one, in another folder).
I am trying to setup trivy config scan in my github action. I tried both manually with below command, and with the actions itself. It works fine locally, but fails in my CI.
Manually:
trivy config --ignore-policy trivy-config.rego infrastructure/terraform/modulesThrough trivy-action:
It both fails with error:
2025-01-08T16:24:25Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="failed to locate cache directory: cache directory is not writable"I have tried to disable the cache in the trivy-action, or to set the cache to a custom manually created directory (with chmod 777), but always the same error.
Important note, the errors occur for folders that have resources pointing to submodules. See in reproduction step for more details.
What am I missing? Why does it work locally and find some vulns, but not in my github action?
Thanks!
Desired Behavior
I would like to be able to run the trivy config within my github action.
This could be either through disabling cache, or allowing no init files for example.
Actual Behavior
Currently, I have the following error:
2025-01-08T16:24:25Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="failed to locate cache directory: cache directory is not writable"Reproduction Steps
Checklist
trivy clean --allBeta Was this translation helpful? Give feedback.
All reactions