bug: Check with module defaults

[dsfrederic]

Is your feature request related to a problem? Please describe.

I'd want to run TfSec before publishing my TF module. It seems like tfsec is not validating the code with default values filled in.

Describe the solution you'd like

Run TFSec with module defaults

Describe alternatives you've considered

Add TFVars file with the same default values?

Additional context

[owenrumney]

hey @dsfrederic - tfsec uses the default values specified for variables when doing scanning unless the tfvars-file flag is used. I wonder if your module isn't being scanned fully - could you try --force-all-dirs flag to ensure that the full path is scanned?

[dsfrederic]

Hey @owenrumney, this doesn't seem to work either...
I've added the argument and made a change that should trigger tfsec.

This is the result

So as you can see tfsec didn't pickup the default value.

repository: https://github.com/cgk-ds-be/terraform-azurerm-datalake
reference: https://github.com/cgk-ds-be/terraform-azurerm-datalake/runs/5552484729?check_suite_focus=true

[owenrumney]

I understand now - my bad.

So it looks like you've found a short fall in the tfsec-pr-commenter. I suspect what is happening is that resulting failure doesn't match up to the line that changed in the hunk of the PR.

Its a legit bug and one I'm surprised hasn't hit more people. Leave it with me

Also, I'm going to move this to github.com/aquasecurity/tfsec-pr-commenter-action for tracking

[dsfrederic]

@owenrumney Actually this might not be a bug. It seems like TFSec doesn't check this parameter.

I was thinking it was the same security check as this one: https://aquasecurity.github.io/tfsec/v1.8.0/checks/azure/storage/no-public-access/

My apologies!

[owenrumney]

I think it's a side bug too. Pretty much as soon as I saw it I figured it wouldn't work

[owenrumney]

I just saw you're using the VSCode Plugin - this makes me very happy @dsfrederic 🎉

[dsfrederic]

Of course! It's awesome! 🚀