Skip to content

Variable with default = null are not handled properly #7359

@flesko-profinit

Description

@flesko-profinit

Issue Description

The VariableRenderer in Checkov does not correctly handle variables with a null default. When a variable is defined with default = null and no value is passed from outside the module, the renderer should remove the attribute from the parsed configuration, rather than leaving it unresolved as var.<name>.

This likely requires a change in renderer.py originates from the default and should be treated as an absence of the attribute.

Examples

variable "key" {
  type = string
  default = 'key'
}

resource "aws_cloudwatch_log_group" "pass" {
  retention_in_days = 1
  kms_key_id        = var.key
}

Gives conf:

{'__end_line__': 18, '__start_line__': 15, 'kms_key_id': ['key'], 'retention_in_days': [1], '__address__': 'aws_cloudwatch_log_group.pass'}

While

variable "key" {
  type = string
  default = null
}

resource "aws_cloudwatch_log_group" "pass" {
  retention_in_days = 1
  kms_key_id        = var.key
}

Gives conf:

{'__end_line__': 18, '__start_line__': 15, 'kms_key_id': ['var.key'], 'retention_in_days': [1], '__address__': 'aws_cloudwatch_log_group.pass'}

Expected behaviour is to remove kms_key_id field:

{'__end_line__': 18, '__start_line__': 15, 'retention_in_days': [1], '__address__': 'aws_cloudwatch_log_group.pass'}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions