Trivy Terraform with private registry incorrect version URL

[IzakJoubert]

Question

Hi all,

I'm trying to scan my terraform files but we use a private JFrog registry for our modules. The debug logs show the following:
Requesting module versions from registry using url="https://***/v1/modules/***"
which is the incorrect URL for JFrog.

Can I disable version checking?
Can I fix the URL?

Target

Filesystem

Scanner

Misconfiguration

Output Format

Table

Mode

Standalone

Operating System

WSL

Version

Version: 0.56.2
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-10-22 06:16:41.734977641 +0000 UTC
  NextUpdate: 2024-10-23 06:16:41.73497734 +0000 UTC
  DownloadedAt: 2024-10-22 07:50:57.790310575 +0000 UTC
Check Bundle:
  Digest: sha256:ae151c4eecf35c507d8f866121ddfbf46540b041bc7bca7cdd8d9f70ceb6f12c
  DownloadedAt: 2024-10-22 06:48:47.375343436 +0000 UTC

[nikpivkin]

Hi @IzakJoubert !

What error are you getting?

[IzakJoubert]

Is v1/modules standard?

trivy/pkg/iac/scanners/terraform/parser/resolvers/registry.go

Line 74 in 9514148

versionUrl := fmt.Sprintf("https://%s/v1/modules/%s/versions", hostname, moduleName)

[nikpivkin]

This endpoint is described in the Terraform documentation: https://developer.hashicorp.com/terraform/registry/api-docs#list-available-versions-for-a-specific-module . It is respected by OpenTofu and other self-hosted registries.

[IzakJoubert]

Not JFrog apparently 😢 I'll try some more things but I think ultimately, I'll just scan the plan file

[simar7]

@IzakJoubert can you please attach the full logs here? The logs don't contain anything besides the working of the tool itself but you can scrub any info you don't want to share.

Having full logs would help us determine the code path Trivy is taking while doing the scan.

[IzakJoubert]

@simar7 that is a LOT of obfuscation. Unfortunately, I don't feel comfortable posting it here.

[IzakJoubert]

I decided to use the Terraform Plan scanner which is working okay

- name: Scan Terraform
  uses: aquasecurity/trivy-action
  with:
    scan-type: 'config'
    output: trivy.txt
  env:
    TRIVY_MISCONFIG_SCANNERS: 'terraformplan-json'