OpenTofu same-basename precedence causes findings from shadowed .tf/.tf.json files

[lokesh0186]

IDs

AWS-0107, AWS-0099, AWS-0124

Description

Trivy 0.74.0 reports misconfigurations from Terraform files that OpenTofu does not load when same-basename OpenTofu files are present.

OpenTofu gives main.tofu precedence over main.tf, and main.tofu.json precedence over main.tf.json. Trivy recognizes all four formats but currently scans both files in each pair.

In the HCL example below, Trivy emits three findings from the shadowed main.tf, including HIGH AWS-0107. In the JSON example, it emits AWS-0099 from the shadowed main.tf.json. The winning OpenTofu files contain only terraform_data resources and do not contain equivalent AWS configuration.

I confirmed the behavior with Trivy's default misconfiguration scan. I did not use --file-patterns, --skip-files, a custom Trivy configuration, or TRIVY_* environment overrides. The JSON output confirms that the advisories are correct for the AWS resource text; the false detection comes from including source that is inactive under OpenTofu's file-selection rules.

Reproduction steps

HCL case:

1. Save this as main.tofu:

terraform {
  required_version = ">= 1.8.0"
}

resource "terraform_data" "target" {
  input = "effective-opentofu-source"
}

resource "terraform_data" "consumer" {
  input = terraform_data.target.output
}

2. In the same directory, save this as main.tf:

resource "aws_security_group" "shadowed" {
  name = "shadowed-open-ssh"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

3. Run:

$ tofu validate -json
"valid": true
"error_count": 0
"warning_count": 0

$ trivy config --format json .
main.tf  AWS-0099  LOW   aws_security_group.shadowed
main.tf  AWS-0107  HIGH  aws_security_group.shadowed
main.tf  AWS-0124  LOW   aws_security_group.shadowed

4. Remove only main.tf and rerun the same Trivy command. Trivy reports no findings.

JSON case:

1. Save this as main.tofu.json:

{
  "terraform": {
    "required_version": ">= 1.8.0"
  },
  "resource": {
    "terraform_data": {
      "target": {
        "input": "effective-opentofu-json-source"
      },
      "consumer": {
        "input": "${terraform_data.target.output}"
      }
    }
  }
}

2. In the same directory, save this as main.tf.json:

{
  "resource": {
    "aws_security_group": {
      "shadowed_json": {
        "name": "shadowed-json-open-ssh",
        "ingress": [
          {
            "from_port": 22,
            "to_port": 22,
            "protocol": "tcp",
            "cidr_blocks": ["0.0.0.0/0"]
          }
        ]
      }
    }
  }
}

3. Run tofu validate -json and trivy config --format json .. OpenTofu reports the configuration as valid, while Trivy reports AWS-0099 against aws_security_group.shadowed_json in main.tf.json.

4. Remove only main.tf.json and rerun the same Trivy command. Trivy reports no findings.

A minimal Trivy-native regression also reproduces both cases on current main at dcfb99218f072d1f54576af3c0b4f6fc8fe843f3.

I also checked the source-set interpretation independently with public IaC-Guard-V 0.1.0b1; its OpenTofu source-mode evidence marks the same-basename Terraform files as SHADOWED_BY_TOFU.

Would Trivy want to model OpenTofu's effective-file precedence when scanning an OpenTofu project, and if so, how should Trivy distinguish Terraform mode from OpenTofu mode when both source forms are present?

Target

Filesystem

Scanner

Misconfiguration

Debug output

DEBUG Default config file "file_path=trivy.yaml" not found, using built in values
INFO  [misconfig] Misconfiguration scanning is enabled
DEBUG [checks-client] Built-in checks digest="sha256:1583562f8b90ed2a071b99f0e5ffff6b57e4ceb6ca3e4796577b4e6a339eb74c" major_version=2
DEBUG [terraform parser] Parsing file_path="main.tf"
DEBUG [terraform parser] Added file file_path="main.tf"
DEBUG [terraform parser] Parsing file_path="main.tofu"
DEBUG [terraform parser] Added file file_path="main.tofu"
INFO  Detected config files num=2
DEBUG Scanned config file file_path="main.tf"

The JSON run has the equivalent parser entries for main.tf.json and main.tofu.json, reports two detected configuration files, and attributes the finding to main.tf.json. Local absolute paths have been omitted from this excerpt.

Version

Version: 0.74.0

Checklist

• I read the documentation regarding wrong detection.
• I ran Trivy with --format json, checked the reported data source, and confirmed that the AWS advisory is correct for the resource text.

[nikpivkin]

Hi @lokesh0186 ! Thanks for the report.

Track #11192