Scanning terraform resources with variables

[mvillanueva (María José Villanueva)]

Hello all,
I would appreciate if someone could provide some light about the following issue

As far as I know, the SonarQube scanner for the terraform language is able to analyze code with AWS, GCP and Azure resources. In order to do that, the scanner checks whether the VALUES used are secure or not.
My question is, how can we spot those issues when variables are used for instantiate those resources? The use of variables is a mainstream practice of terraform, for instance when using modules or workspaces.
Here an example:
For the rule RSPEC-6333:
If we had the following resource configuration the sonar scanner will rise a non-compliant issue

resource "aws_api_gateway_method" "noncompliantapi" {
  authorization = "NONE" # Sensitive
  http_method   = "GET"
}

But how this can be detected when we use variables?

resource "aws_api_gateway_method" "noncompliantapi" {
  authorization = var.authorization
  http_method   = var.http_method
}

Related questions:

Using selected tfvar files in Terraform Scanning

We are using SonarQube 9.2.4 and the latest version of sonar-scanner-cli to scan terraform projects (aws provider). We want to scan based on selected .tfvar files because security issues may be generated depending on different configurations. How do we configure the scan to use different (selected) tfvar files given that each of our projects has different environments with different configuration? I can’t find this in documentation…

Scanning terraform modules in sonarqube

We are using SonarQube 9.2.4 and the latest version of sonar-scanner-cli to scan terraform projects (aws provider). We want to scan modules which are referenced in the project as well as the parent project which references them, however we have noticed that only the parent project is scanned and not the modules because the parent is referencing a git source for these modules. How do we ensure that the project and referenced modules are thoroughly downloaded and scanned by the cli? Is it possib…

Thank you.

[Marcin_Stachniuk]

Hello @mvillanueva

Welcome to Sonar Community and thank you for the report.

Your request is valid, we have a ticket for that SONARIAC-568. Please follow it to be notified when it will be implemented.

Best!

[mvillanueva (María José Villanueva)]

Dear Marcin,
I got an idea regarding this issue… in the same way that SonarQube requires building java code in order to use java binaries for the analysis, could be a solution of this problem with variables, to analyze the file tfplan that generates terraform after executing terraform plan?

Thank you for your response.

[Nils_Werner]

Hi @mvillanueva,

That’s a good idea. Indeed, we could try to include the tfplan into the analysis to get a clue about the resolved variable value. However, we avoid depending on generated files as we can not expect users to build an application or generate the configuration before scanning the source files. We will try to simulate the generation of the tfplan instead. Please stay tuned; it’s on the agenda.

Best,
Nils