You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the issue
CKV_TF_3 has introduced a new check for the presence of a lock in terraform s3 backend state. As per this PR: #6904. The check should validate that either use_lockfile is enabled for s3 or that a dynamodb_table value is set. However it incorrectly reports a check fail if dynamodb_table is set. These settings are mutually exclusive of each other as per the documentation: https://developer.hashicorp.com/terraform/language/backend/s3#state-locking
Examples
Here is a valid backend config that fails the check when it shouldnt:
"backend": {
"s3": {
"bucket": "XXX-state-bucket",
"dynamodb_table": "terraform-lock-state",
"encrypt": true,
"key": "terraform/XXX",
"profile": "my-profile",
"region": "eu-west-2"
}
},
Version (please complete the following information):
Checkov Version "checkov_version": "3.2.342"
Additional context
Add any other context about the problem here.
The text was updated successfully, but these errors were encountered:
On top of that, the configuration for the backend can be provided through backend.config file, which is probably the common case when the same configuration is being deployed in multiple AWS accounts. In such a case, the s3 {} block can be left empty.
Describe the issue
CKV_TF_3 has introduced a new check for the presence of a lock in terraform s3 backend state. As per this PR: #6904. The check should validate that either use_lockfile is enabled for s3 or that a dynamodb_table value is set. However it incorrectly reports a check fail if dynamodb_table is set. These settings are mutually exclusive of each other as per the documentation: https://developer.hashicorp.com/terraform/language/backend/s3#state-locking
Examples
Here is a valid backend config that fails the check when it shouldnt:
"backend": {
"s3": {
"bucket": "XXX-state-bucket",
"dynamodb_table": "terraform-lock-state",
"encrypt": true,
"key": "terraform/XXX",
"profile": "my-profile",
"region": "eu-west-2"
}
},
Version (please complete the following information):
Additional context
Add any other context about the problem here.
The text was updated successfully, but these errors were encountered: