Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(misconf): properly expand dynamic blocks #7612

Merged
merged 5 commits into from
Oct 19, 2024
Merged

fix(misconf): properly expand dynamic blocks #7612

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f77ab40
fix(misconf): properly expand dynamic blocks
nikpivkin Sep 28, 2024
8e1a2bd
test: update dynamic block tests
nikpivkin Oct 4, 2024
1a3282c
update test cases
nikpivkin Oct 17, 2024
2becf4c
add a sad path test case
simar7 Oct 17, 2024
4d3de2a
remove an unreachable check
nikpivkin Oct 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion pkg/iac/scanners/terraform/module_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -567,7 +567,7 @@ resource "something" "else" {
for_each = toset(["true"])

content {
ok = each.value
ok = blah.value
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For reviewers: this test should not have run successfully because dynamic blocks do not create an each object.

}
}
}
Expand Down
49 changes: 7 additions & 42 deletions pkg/iac/scanners/terraform/parser/evaluator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -260,48 +260,28 @@ func (e *evaluator) evaluateSteps() {
}

func (e *evaluator) expandBlocks(blocks terraform.Blocks) terraform.Blocks {
return e.expandDynamicBlocks(e.expandBlockForEaches(e.expandBlockCounts(blocks), false)...)
return e.expandDynamicBlocks(e.expandBlockForEaches(e.expandBlockCounts(blocks))...)
}

func (e *evaluator) expandDynamicBlocks(blocks ...*terraform.Block) terraform.Blocks {
for _, b := range blocks {
e.expandDynamicBlock(b)
}
return blocks
}

func (e *evaluator) expandDynamicBlock(b *terraform.Block) {
for _, sub := range b.AllBlocks() {
e.expandDynamicBlock(sub)
}
for _, sub := range b.AllBlocks().OfType("dynamic") {
if sub.IsExpanded() {
continue
}
blockName := sub.TypeLabel()
expanded := e.expandBlockForEaches(terraform.Blocks{sub}, true)
for _, ex := range expanded {
if content := ex.GetBlock("content"); content.IsNotNil() {
_ = e.expandDynamicBlocks(content)
b.InjectBlock(content, blockName)
}
}
if len(expanded) > 0 {
sub.MarkExpanded()
if err := b.ExpandBlock(); err != nil {
e.logger.Error(`Failed to expand dynamic block.`,
log.String("block", b.FullName()), log.Err(err))
}
}
return blocks
}

func isBlockSupportsForEachMetaArgument(block *terraform.Block) bool {
return slices.Contains([]string{
"module",
"resource",
"data",
"dynamic",
}, block.Type())
}

func (e *evaluator) expandBlockForEaches(blocks terraform.Blocks, isDynamic bool) terraform.Blocks {
func (e *evaluator) expandBlockForEaches(blocks terraform.Blocks) terraform.Blocks {

var forEachFiltered terraform.Blocks

Expand Down Expand Up @@ -348,7 +328,7 @@ func (e *evaluator) expandBlockForEaches(blocks terraform.Blocks, isDynamic bool
// is the value of the collection. The exception is the use of for-each inside a dynamic block,
// because in this case the collection element may not be a primitive value.
if (forEachVal.Type().IsCollectionType() || forEachVal.Type().IsTupleType()) &&
!forEachVal.Type().IsMapType() && !isDynamic {
!forEachVal.Type().IsMapType() {
stringVal, err := convert.Convert(val, cty.String)
if err != nil {
e.logger.Error(
Expand All @@ -374,22 +354,7 @@ func (e *evaluator) expandBlockForEaches(blocks terraform.Blocks, isDynamic bool

ctx.Set(eachObj, "each")
ctx.Set(eachObj, block.TypeLabel())

if isDynamic {
if iterAttr := block.GetAttribute("iterator"); iterAttr.IsNotNil() {
refs := iterAttr.AllReferences()
if len(refs) == 1 {
ctx.Set(idx, refs[0].TypeLabel(), "key")
ctx.Set(val, refs[0].TypeLabel(), "value")
} else {
e.logger.Debug("Ignoring iterator attribute in dynamic block, expected one reference",
log.Int("refs", len(refs)))
}
}
}

forEachFiltered = append(forEachFiltered, clone)

clones[idx.AsString()] = clone.Values()
})

Expand Down
Loading