Trivy Misconfiguration on gcp firewall rule doesn't handle ports as int

[matdtr]

IDs

AVD-GCP-0072

Description

When setting firewall rules for in a google_compute_firewall-resource, a following error is produced:

Google Compute Network Using Firewall Rule that Allows All Ports

Reproduction Steps

1. Create a `google_compute_firewall`-resource
2. Set port as int instead of string
3. Run Trivy

resource "google_compute_firewall" "egress" {
  project     = lprd
  name        = net
  network     = netw
  direction   = "EGRESS"
  priority    = 1000
  allow {
    protocol = "tcp"
    ports    = [111, 343]
  }
  allow {
    protocol = "udp"
    ports    = [111,222]
  }
  source_ranges      = [xxx]
  destination_ranges = xxx

  log_config {
    metadata = "INCLUDE_ALL_METADATA"
  }

}

Target

Filesystem

Scanner

Misconfiguration

Target OS

No response

Debug Output

2026-09-04T14:10:04Z    DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2026-09-04T14:10:04Z    INFO    [misconfig] Misconfiguration scanning is enabled
2026-09-04T14:10:04Z    DEBUG   [notification] Running version check
2026-09-04T14:10:04Z    INFO    [checks-client] No downloadable checks were loaded as --skip-check-update is enabled, loading from existing cache...
2026-09-04T14:10:04Z    ERROR   [misconfig] Falling back to embedded checks     err="failed to check cache: cache does not exist at \"/home/.cache/trivy/policy/content\""
2026-09-04T14:10:05Z    DEBUG   [notification] Version check completed  latest_version="0.74.0"
2026-09-04T14:10:05Z    DEBUG   [rego] Embedded libraries are loaded    count=17
2026-09-04T14:10:05Z    DEBUG   [rego] Embedded checks are loaded       count=563
2026-09-04T14:10:05Z    DEBUG   [rego] Overriding filesystem for data
2026-09-04T14:10:05Z    DEBUG   Enabling misconfiguration scanners      scanners=[terraform]
2026-09-04T14:10:05Z    DEBUG   Initializing scan cache...      type="memory"
2026-09-04T14:10:05Z    DEBUG   [fs] Analyzing...       root="."
2026-09-04T14:10:05Z    DEBUG   Created process-specific temp directory path="/tmp/trivy-2401829405"
2026-09-04T14:10:05Z    DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Terraform"
2026-09-04T14:10:05Z    DEBUG   [terraform scanner] Scanning directory  file_path="."
2026-09-04T14:10:05Z    DEBUG   [terraform parser] Setting project/module root  module="root" file_path="."
2026-09-04T14:10:05Z    DEBUG   [terraform parser] Parsing FS   module="root" file_path="."
2026-09-04T14:10:05Z    DEBUG   [terraform parser] Parsing      module="root" file_path="test.tf"
2026-09-04T14:10:05Z    DEBUG   [terraform parser] Added file   module="root" file_path="test.tf"
2026-09-04T14:10:05Z    INFO    [terraform scanner] Scanning root module        file_path="."
2026-09-04T14:10:05Z    DEBUG   [terraform parser] Setting project/module root  module="root" file_path="."
2026-09-04T14:10:05Z    DEBUG   [terraform parser] Parsing FS   module="root" file_path="."
2026-09-04T14:10:05Z    DEBUG   [terraform parser] Parsing      module="root" file_path="test.tf"
2026-09-04T14:10:05Z    DEBUG   [terraform parser] Added file   module="root" file_path="test.tf"
2026-09-04T14:10:05Z    DEBUG   [terraform parser] Loading module       module="root" module="root"
2026-09-04T14:10:05Z    DEBUG   [terraform parser] Read block(s) and ignore(s)  module="root" blocks=1 ignores=0
2026-09-04T14:10:05Z    DEBUG   [terraform parser] Added input variables from tfvars    module="root" count=0
2026-09-04T14:10:05Z    DEBUG   [terraform parser] Working directory for module evaluation      module="root" file_path="/home/jenkins/asd"
2026-09-04T14:10:05Z    DEBUG   [terraform evaluator] Starting module evaluation...     module="root" path="."
2026-09-04T14:10:05Z    DEBUG   [terraform evaluator] Starting iteration        module="root" iteration=0
2026-09-04T14:10:05Z    DEBUG   [terraform evaluator] Starting iteration        module="root" iteration=1
2026-09-04T14:10:05Z    DEBUG   [terraform evaluator] Context unchanged module="root" iteration=1
2026-09-04T14:10:05Z    DEBUG   [terraform evaluator] Starting post-submodules evaluation...    module="root"
2026-09-04T14:10:05Z    DEBUG   [terraform evaluator] Starting iteration        module="root" iteration=0
2026-09-04T14:10:05Z    DEBUG   [terraform evaluator] Starting iteration        module="root" iteration=1
2026-09-04T14:10:05Z    DEBUG   [terraform evaluator] Context unchanged module="root" iteration=1
2026-09-04T14:10:05Z    DEBUG   [terraform evaluator] Module evaluation complete.       module="root"
2026-09-04T14:10:05Z    DEBUG   [terraform parser] Finished parsing module      module="root"
2026-09-04T14:10:05Z    DEBUG   [terraform executor] Adapting modules...
2026-09-04T14:10:05Z    DEBUG   [terraform executor] Adapted module(s) into state data. count=1
2026-09-04T14:10:05Z    DEBUG   [terraform executor] Scan state data
2026-09-04T14:10:05Z    DEBUG   [rego] Scanning inputs  count=1
2026-09-04T14:10:05Z    DEBUG   [terraform executor] Finished applying checks
2026-09-04T14:10:05Z    DEBUG   [terraform executor] Applying ignores...
2026-09-04T14:10:05Z    DEBUG   [terraform executor] Applying results filters...
2026-09-04T14:10:05Z    DEBUG   [terraform executor] Applied results filters.   count=0
2026-09-04T14:10:05Z    DEBUG   [terraform executor] No matching Terraform block found  cause_range="test.tf:1-22"
2026-09-04T14:10:05Z    DEBUG   OS is not detected.
2026-09-04T14:10:05Z    INFO    Detected config files   num=2
2026-09-04T14:10:05Z    DEBUG   Scanned config file     file_path="."
2026-09-04T14:10:05Z    DEBUG   Scanned config file     file_path="test.tf"
2026-09-04T14:10:05Z    DEBUG   Specified ignore file does not exist    file=".trivyignore"
2026-09-04T14:10:05Z    DEBUG   [vex] VEX filtering is disabled
{
  "SchemaVersion": 2,
  "Trivy": {
    "Version": "0.72.0"
  },
  "ReportID": "01a06cc1-5796-7f3c-ab9c-eb670cd98807",
  "CreatedAt": "2026-09-04T14:10:05.335017716Z",
  "ArtifactName": ".",
  "ArtifactType": "filesystem",
  "Results": [
    {
      "Target": ".",
      "Class": "config",
      "Type": "terraform",
      "MisconfSummary": {
        "Successes": 50,
        "Failures": 0
      }
    },
    {
      "Target": "test.tf",
      "Class": "config",
      "Type": "terraform",
      "MisconfSummary": {
        "Successes": 0,
        "Failures": 1
      },
      "Misconfigurations": [
        {
          "Type": "Terraform Security Check",
          "ID": "GCP-0072",
          "Title": "Google Compute Network Using Firewall Rule that Allows All Ports",
          "Description": "Firewall rules should not be wide open to all ports. Lock down rules to only required ports.\n",
          "Message": "Firewall rule allows access to all ports.",
          "Namespace": "builtin.google.compute.google0072",
          "Query": "data.builtin.google.compute.google0072.deny",
          "Resolution": "Modify firewall rules that allow all ports to restrict to only required ports. Use separate rules for specific port ranges as needed, instead of a single overly broad rule.\n",
          "Severity": "MEDIUM",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/gcp-0072",
          "References": [
            "https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_firewall#allow",
            "https://avd.aquasec.com/misconfig/gcp-0072"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Resource": "google_compute_firewall.egress",
            "Provider": "Google",
            "Service": "compute",
            "StartLine": 1,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 1,
                  "Content": "resource \"google_compute_firewall\" \"egress\" {",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "\u001b[38;5;33mresource\u001b[0m \u001b[38;5;37m\"google_compute_firewall\"\u001b[0m \u001b[38;5;37m\"egress\"\u001b[0m {",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 2,
                  "Content": "  project     = lprd",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "  \u001b[38;5;245mproject\u001b[0m     = lprd",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 3,
                  "Content": "  name        = net",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "  \u001b[38;5;245mname\u001b[0m        = net",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 4,
                  "Content": "  network     = netw",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "  \u001b[38;5;245mnetwork\u001b[0m     = netw",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 5,
                  "Content": "  direction   = \"EGRESS\"",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "  \u001b[38;5;245mdirection\u001b[0m   = \u001b[38;5;37m\"EGRESS\"",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 6,
                  "Content": "  priority    = 1000",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "\u001b[0m  \u001b[38;5;245mpriority\u001b[0m    = \u001b[38;5;37m1000",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 7,
                  "Content": "  allow {",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "\u001b[0m  allow {",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 8,
                  "Content": "    protocol = \"tcp\"",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "    \u001b[38;5;245mprotocol\u001b[0m = \u001b[38;5;37m\"tcp\"",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 9,
                  "Content": "    ports    = [111, 343]",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "\u001b[0m    \u001b[38;5;245mports\u001b[0m    = [\u001b[38;5;37m111\u001b[0m, \u001b[38;5;37m343\u001b[0m]",
                  "FirstCause": false,
                  "LastCause": true
                },
                {
                  "Number": 10,
                  "Content": "",
                  "IsCause": false,
                  "Annotation": "",
                  "Truncated": true,
                  "FirstCause": false,
                  "LastCause": false
                }
              ]
            }
          }
        }
      ]
    }
  ]
}

Version

Version: 0.74.0

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[matdtr]

@nikpivkin any help on this?

[nikpivkin]

Hi @matdtr , thanks for the report!

Track #11222