fix(terraform): `for_each` on a map returns a resource for every key #9156

sontek · 2025-07-07T19:06:46Z

Description

for_each was being evaluated before the locals were evaluated which
was making it iterate over a cty.DynamicPseudoType which meant it
was iterating over the keys of a single instance resource instead of
the values of the for_each.

See the tests added for proof of the problem. I've left the debug log
lines in because they were useful fixing the issue but I can remove them
if we don't want them.

You can see this when running --debug:

❯ go run cmd/trivy/main.go conf ../tfparse/tests/terraform/for_each --debug
2025-07-07T15:00:57-04:00	DEBUG	[terraform evaluator] Expanded block into clones via 'for_each' attribute.	module="root" block="aws_iam_role_policy_attachment.administrative_policy_attachment" clones=4

We expect 2 clones, not 4 with my example. With this PR:

2025-07-07T15:05:46-04:00	DEBUG	[terraform evaluator] Expanded block into clones via 'for_each' attribute.	module="root" block="aws_iam_role_policy_attachment.administrative_policy_attachment" clones=2

Related issues

Close bug(terraform): for_each iterated over DynamicPseudoType due to locals not evaluated first #9187

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

for_each was being evaluated before the locals were evaluated which was making it iterate over a `cty.DynamicPseudoType` which meant it was iterating over the keys of a single instance resource instead of the values of the for_each

CLAassistant · 2025-07-07T19:06:52Z

All committers have signed the CLA.

pkg/iac/adapters/terraform/aws/iam/roles_test.go

simar7 · 2025-07-10T05:38:36Z

@nikpivkin could you also take a look?

simar7

It lgtm to me overall, I'd also wait for @nikpivkin to take a look.

nikpivkin

Looks great!

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mirror.gcr.io/aquasec/trivy](https://www.aquasec.com/products/trivy/) ([source](https://github.com/aquasecurity/trivy)) | minor | `0.64.1` -> `0.65.0` | --- ### Release Notes <details> <summary>aquasecurity/trivy (mirror.gcr.io/aquasec/trivy)</summary> ### [`v0.65.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0650-2025-07-30) [Compare Source](aquasecurity/trivy@v0.64.1...v0.65.0) ##### Features - add graceful shutdown with signal handling ([#9242](aquasecurity/trivy#9242)) ([2c05882](aquasecurity/trivy@2c05882)) - add HTTP request/response tracing support ([#9125](aquasecurity/trivy#9125)) ([aa5b32a](aquasecurity/trivy@aa5b32a)) - **alma:** add AlmaLinux 10 support ([#9207](aquasecurity/trivy#9207)) ([861d51e](aquasecurity/trivy@861d51e)) - **flag:** add schema validation for `--server` flag ([#9270](aquasecurity/trivy#9270)) ([ed4640e](aquasecurity/trivy@ed4640e)) - **image:** add Docker context resolution ([#9166](aquasecurity/trivy#9166)) ([99cd4e7](aquasecurity/trivy@99cd4e7)) - **license:** observe pkg types option in license scanner ([#9091](aquasecurity/trivy#9091)) ([d44af8c](aquasecurity/trivy@d44af8c)) - **misconf:** add private ip google access attribute to subnetwork ([#9199](aquasecurity/trivy#9199)) ([263845c](aquasecurity/trivy@263845c)) - **misconf:** added logging and versioning to the gcp storage bucket ([#9226](aquasecurity/trivy#9226)) ([110f80e](aquasecurity/trivy@110f80e)) - **repo:** add git repository metadata to reports ([#9252](aquasecurity/trivy#9252)) ([f4b2cf1](aquasecurity/trivy@f4b2cf1)) - **report:** add CVSS vectors in sarif report ([#9157](aquasecurity/trivy#9157)) ([60723e6](aquasecurity/trivy@60723e6)) - **sbom:** add SHA-512 hash support for CycloneDX SBOM ([#9126](aquasecurity/trivy#9126)) ([12d6706](aquasecurity/trivy@12d6706)) ##### Bug Fixes - **alma:** parse epochs from rpmqa file ([#9101](aquasecurity/trivy#9101)) ([82db2fc](aquasecurity/trivy@82db2fc)) - also check `filepath` when removing duplicate packages ([#9142](aquasecurity/trivy#9142)) ([4d10a81](aquasecurity/trivy@4d10a81)) - **aws:** update amazon linux 2 EOL date ([#9176](aquasecurity/trivy#9176)) ([0ecfed6](aquasecurity/trivy@0ecfed6)) - **cli:** Add more non-sensitive flags to telemetry ([#9110](aquasecurity/trivy#9110)) ([7041a39](aquasecurity/trivy@7041a39)) - **cli:** ensure correct command is picked by telemetry ([#9260](aquasecurity/trivy#9260)) ([b4ad00f](aquasecurity/trivy@b4ad00f)) - **cli:** panic: attempt to get os.Args\[1] when len(os.Args) < 2 ([#9206](aquasecurity/trivy#9206)) ([adfa879](aquasecurity/trivy@adfa879)) - **license:** add missed `GFDL-NIV-1.1` and `GFDL-NIV-1.2` into Trivy mapping ([#9116](aquasecurity/trivy#9116)) ([a692f29](aquasecurity/trivy@a692f29)) - **license:** handle WITH operator for `LaxSplitLicenses` ([#9232](aquasecurity/trivy#9232)) ([b4193d0](aquasecurity/trivy@b4193d0)) - migrate from `*.list` to `*.md5sums` files for `dpkg` ([#9131](aquasecurity/trivy#9131)) ([f224de3](aquasecurity/trivy@f224de3)) - **misconf:** correctly adapt azure storage account ([#9138](aquasecurity/trivy#9138)) ([51aa022](aquasecurity/trivy@51aa022)) - **misconf:** correctly parse empty port ranges in google\_compute\_firewall ([#9237](aquasecurity/trivy#9237)) ([77bab7b](aquasecurity/trivy@77bab7b)) - **misconf:** fix log bucket in schema ([#9235](aquasecurity/trivy#9235)) ([7ebc129](aquasecurity/trivy@7ebc129)) - **misconf:** skip rewriting expr if attr is nil ([#9113](aquasecurity/trivy#9113)) ([42ccd3d](aquasecurity/trivy@42ccd3d)) - **nodejs:** don't use prerelease logic for compare npm constraints ([#9208](aquasecurity/trivy#9208)) ([fe96436](aquasecurity/trivy@fe96436)) - prevent graceful shutdown message on normal exit ([#9244](aquasecurity/trivy#9244)) ([6095984](aquasecurity/trivy@6095984)) - **rootio:** check full version to detect `root.io` packages ([#9117](aquasecurity/trivy#9117)) ([c2ddd44](aquasecurity/trivy@c2ddd44)) - **rootio:** fix severity selection ([#9181](aquasecurity/trivy#9181)) ([6fafbeb](aquasecurity/trivy@6fafbeb)) - **sbom:** merge in-graph and out-of-graph OS packages in scan results ([#9194](aquasecurity/trivy#9194)) ([aa944cc](aquasecurity/trivy@aa944cc)) - **sbom:** use correct field for licenses in CycloneDX reports ([#9057](aquasecurity/trivy#9057)) ([143da88](aquasecurity/trivy@143da88)) - **secret:** add UTF-8 validation in secret scanner to prevent protobuf marshalling errors ([#9253](aquasecurity/trivy#9253)) ([54832a7](aquasecurity/trivy@54832a7)) - **secret:** fix line numbers for multiple-line secrets ([#9104](aquasecurity/trivy#9104)) ([e579746](aquasecurity/trivy@e579746)) - **server:** add HTTP transport setup to server mode ([#9217](aquasecurity/trivy#9217)) ([1163b04](aquasecurity/trivy@1163b04)) - supporting .egg-info/METADATA in python.Packaging analyzer ([#9151](aquasecurity/trivy#9151)) ([e306e2d](aquasecurity/trivy@e306e2d)) - **terraform:** `for_each` on a map returns a resource for every key ([#9156](aquasecurity/trivy#9156)) ([153318f](aquasecurity/trivy@153318f)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1073 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

…quasecurity#9156)

sontek added 2 commits July 7, 2025 14:44

got a working failing test

38b54f8

fixed the for_each bug with cty.DynamicPseudoType

dda6e21

for_each was being evaluated before the locals were evaluated which was making it iterate over a `cty.DynamicPseudoType` which meant it was iterating over the keys of a single instance resource instead of the values of the for_each

sontek requested review from simar7 and nikpivkin as code owners July 7, 2025 19:06

sontek changed the title ~~for_each over a map returns a resource for every key on object~~ fix(terraform): for_each on a map returns a resource for every key Jul 7, 2025

sontek mentioned this pull request Jul 7, 2025

fix: for_each was being iterating over a cty.DynamicPseudoType keys cloud-custodian/trivy#12

Closed

simar7 reviewed Jul 7, 2025

View reviewed changes

pkg/iac/adapters/terraform/aws/iam/roles_test.go Outdated Show resolved Hide resolved

sontek added 3 commits July 7, 2025 17:19

fix linting

2bbf686

use subtests

0d421da

remove drive by change

1353757

sontek requested a review from simar7 July 8, 2025 13:22

simar7 approved these changes Jul 10, 2025

View reviewed changes

nikpivkin approved these changes Jul 11, 2025

View reviewed changes

nikpivkin added this pull request to the merge queue Jul 11, 2025

Merged via the queue into aquasecurity:main with commit 153318f Jul 11, 2025
12 checks passed

aqua-bot mentioned this pull request Jul 11, 2025

release: v0.65.0 [main] #9108

Merged

yutatokoi pushed a commit to yutatokoi/trivy that referenced this pull request Aug 12, 2025

fix(terraform): for_each on a map returns a resource for every key (a…

8866758

…quasecurity#9156)

ajkerrigan mentioned this pull request Aug 12, 2025

chore: merge upstream 0.65.0 cloud-custodian/trivy#13

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(terraform): `for_each` on a map returns a resource for every key #9156

fix(terraform): `for_each` on a map returns a resource for every key #9156

Uh oh!

sontek commented Jul 7, 2025 •

edited by nikpivkin

Loading

Uh oh!

CLAassistant commented Jul 7, 2025 •

edited

Loading

Uh oh!

Uh oh!

simar7 commented Jul 10, 2025

Uh oh!

simar7 left a comment

Uh oh!

nikpivkin left a comment

Uh oh!

Uh oh!

Uh oh!

fix(terraform): for_each on a map returns a resource for every key #9156

fix(terraform): for_each on a map returns a resource for every key #9156

Uh oh!

Conversation

sontek commented Jul 7, 2025 • edited by nikpivkin Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related issues

Checklist

Uh oh!

CLAassistant commented Jul 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

simar7 commented Jul 10, 2025

Uh oh!

simar7 left a comment

Choose a reason for hiding this comment

Uh oh!

nikpivkin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

fix(terraform): `for_each` on a map returns a resource for every key #9156

fix(terraform): `for_each` on a map returns a resource for every key #9156

sontek commented Jul 7, 2025 •

edited by nikpivkin

Loading

CLAassistant commented Jul 7, 2025 •

edited

Loading