Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Latest CKV_TF_3 Is Incorrectly Reporting the Use of Dyanmodb Table as a Check Fail #6915

Closed
surecloud-meason opened this issue Dec 19, 2024 · 1 comment · Fixed by #6918
Closed
Labels
checks Check additions or changes

Comments

@surecloud-meason
Copy link

Describe the issue
CKV_TF_3 has introduced a new check for the presence of a lock in terraform s3 backend state. As per this PR: #6904. The check should validate that either use_lockfile is enabled for s3 or that a dynamodb_table value is set. However it incorrectly reports a check fail if dynamodb_table is set. These settings are mutually exclusive of each other as per the documentation: https://developer.hashicorp.com/terraform/language/backend/s3#state-locking

Examples
Here is a valid backend config that fails the check when it shouldnt:
"backend": {
"s3": {
"bucket": "XXX-state-bucket",
"dynamodb_table": "terraform-lock-state",
"encrypt": true,
"key": "terraform/XXX",
"profile": "my-profile",
"region": "eu-west-2"
}
},

Version (please complete the following information):

  • Checkov Version "checkov_version": "3.2.342"

Additional context
Add any other context about the problem here.

@surecloud-meason surecloud-meason added the checks Check additions or changes label Dec 19, 2024
@mk-system402
Copy link

On top of that, the configuration for the backend can be provided through backend.config file, which is probably the common case when the same configuration is being deployed in multiple AWS accounts. In such a case, the s3 {} block can be left empty.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
checks Check additions or changes
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants