-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Open
Description
Issue Description
The VariableRenderer in Checkov does not correctly handle variables with a null default. When a variable is defined with default = null and no value is passed from outside the module, the renderer should remove the attribute from the parsed configuration, rather than leaving it unresolved as var.<name>.
This likely requires a change in renderer.py originates from the default and should be treated as an absence of the attribute.
Examples
variable "key" {
type = string
default = 'key'
}
resource "aws_cloudwatch_log_group" "pass" {
retention_in_days = 1
kms_key_id = var.key
}
Gives conf:
{'__end_line__': 18, '__start_line__': 15, 'kms_key_id': ['key'], 'retention_in_days': [1], '__address__': 'aws_cloudwatch_log_group.pass'}
While
variable "key" {
type = string
default = null
}
resource "aws_cloudwatch_log_group" "pass" {
retention_in_days = 1
kms_key_id = var.key
}
Gives conf:
{'__end_line__': 18, '__start_line__': 15, 'kms_key_id': ['var.key'], 'retention_in_days': [1], '__address__': 'aws_cloudwatch_log_group.pass'}
Expected behaviour is to remove kms_key_id field:
{'__end_line__': 18, '__start_line__': 15, 'retention_in_days': [1], '__address__': 'aws_cloudwatch_log_group.pass'}
Metadata
Metadata
Assignees
Labels
No labels