Terraform Child Modules Mandatory Variable triggers rule aws-vpc-add-description-to-security-group

[Tiago-SD]

Problem

Trivy raising the error https://avd.aquasec.com/misconfig/aws-vpc-add-description-to-security-group even with the security group description present.

Description

I have a terraform child module where I have a mandatory variable that will be used in the description of a security group like the follwing:

# variables.tf
variable "vpc_name" {

	type = string
	
	description = "The Name of your VPC. This is used as a prefix for naming various resources created and used by the bastion."

}

# main.tf
resource "aws_security_group" "bastion" {

	name = "${var.name_prefix}-bastion"
	
	description = "${var.vpc_name} Bastion"
	
	vpc_id = data.aws_subnet.bastion_subnet.vpc_id
	
	tags = merge(
		{
			Name = "${var.vpc_name} Bastion "
			Description = "Managed by Terraform"
		},
		var.bastion_tags
	)

}

Is this the intended behaviour?

Thanks,
Tiago

Target

None

Scanner

None

Output Format

None

Mode

None

Operating System

No response

Version

trivy --version
Version: 0.57.1

[simar7]

hi @Tiago-SD - I noticed you're running version v0.57.1, could you update to the latest release and give it a try?

[Tiago-SD]

I've tested also with 0.61.0 and it returned the same error:

AVD-AWS-0099 (LOW): Security group does not have a description.
═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Security groups should include a description for auditing purposes.

Simplifies auditing, debugging, and managing security groups.


See https://avd.aquasec.com/misconfig/aws-vpc-add-description-to-security-group
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 main.tf:69
   via main.tf:67-80 (aws_security_group.bastion)
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  67   resource "aws_security_group" "bastion" {
  ..
  69 [   description = "${var.vpc_name} Bastion"
  ..
  80   }

[nikpivkin]

Track #8685