test(terraform): test to demonstrate 'count' meta argument incorrectl…

[Emyrk]

Description

count meta argument is incorrectly handled when referencing a module's output. It does work when referencing within the same scope.

This is being caused because expandBlockCounts defaults to a count = 1 for unknown values. Secondly, unknown values are returned as cty.Nil, so that information is not easily available at this step.

ExpandingBlocks happens before submodule evaluation:
https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/terraform/parser/evaluator.go#L139-L142

So expanded blocks cannot reference submodule exports. This is inconsistent with terraform plan/apply which renders 0 data blocks in this unit test.

I feel a bit iffy trying to solve this without consulting @simar7 and @nikpivkin. My quick solution is presented, however I admit it was done rather quickly and is not correct.

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[Emyrk]

@nikpivkin and @simar7, what are your thoughts on this bug? The unit test is a good example and self description. It fails on the latest main.

The test only passes because I added in e.blocks = e.expandBlocks(e.blocks), but that solution is incomplete. It was added just to demonstrate the problem.

I don't have a good solution for a more robust fix.

[nikpivkin]

Hi @Emyrk !

Thanks. I'll look into it.