Unexpected exit code of 4 when running a scan on an empty directory #1036

JonZeolla · 2021-09-30T00:04:24Z

terrascan version: v1.10.0
Operating System: Ubuntu Ubuntu 20.04.3 (Docker)

Description

I am running a terrascan scan on an empty directory and it is failing with an exit code of 4. When I provide secure terraform, it provides the exact same output, but exits 0.

What I Did

Empty directory:

easy_infra@983eec90355e:/iac$ ls
easy_infra@983eec90355e:/iac$ terrascan scan -i terraform -t all -d .
2021-09-29T23:54:46.577Z        info    downloader/module-download.go:80        Error building terraform credentials /home/easy_infra/.terraformrc: error converting credential map to host map


Scan Summary -

        File/Folder         :   /iac
        IaC Type            :   terraform
        Scanned At          :   2021-09-29 23:54:47.8368166 +0000 UTC
        Policies Validated  :   783
        Violated Policies   :   0
        Low                 :   0
        Medium              :   0
        High                :   0
easy_infra@983eec90355e:/iac$ echo $?
4

Valid, secure .tf file

easy_infra@3b11d8ef3552:/iac$ ls
secure.tf
easy_infra@3b11d8ef3552:/iac$ terrascan scan -i terraform -t all -d .
2021-09-29T23:54:04.064Z        info    downloader/module-download.go:80        Error building terraform credentials /home/easy_infra/.terraformrc: error converting credential map to host map


Scan Summary -

        File/Folder         :   /iac
        IaC Type            :   terraform
        Scanned At          :   2021-09-29 23:54:05.4489646 +0000 UTC
        Policies Validated  :   0
        Violated Policies   :   0
        Low                 :   0
        Medium              :   0
        High                :   0
easy_infra@3b11d8ef3552:/iac$ echo $?
0

Valid, insecure .tf file:

easy_infra@e10573fd76b1:/iac$ ls
insecure.tf
easy_infra@e10573fd76b1:/iac$ terrascan scan -i terraform -t all -d .
2021-09-29T23:57:20.663Z        info    downloader/module-download.go:80        Error building terraform credentials /home/easy_infra/.terraformrc: err
or converting credential map to host map


Violation Details -

        Description    :        Ensure that detailed monitoring is enabled for EC2 instances.
        File           :        insecure.tf
        Module Name    :        root
        Plan Root      :        ./
        Line           :        17
        Severity       :        HIGH
        -----------------------------------------------------------------------

        Description    :        Ensure that your AWS application is not deployed within the default Virtual Private Cloud in order to follow security best practices
        File           :        insecure.tf
        Module Name    :        root
        Plan Root      :        ./
        Line           :        17
        Severity       :        MEDIUM
        -----------------------------------------------------------------------

        Description    :        EC2 instances should disable IMDS or require IMDSv2 as this can be related to the weaponization phase of kill chain
        File           :        insecure.tf
        Module Name    :        root
        Plan Root      :        ./
        Line           :        17
        Severity       :        MEDIUM
        -----------------------------------------------------------------------


Scan Summary -

        File/Folder         :   /iac
        IaC Type            :   terraform
        Scanned At          :   2021-09-29 23:57:21.8560275 +0000 UTC
        Policies Validated  :   5
        Violated Policies   :   3
        Low                 :   0
        Medium              :   2
        High                :   1
easy_infra@e10573fd76b1:/iac$ echo $?
3

My ~/.terraformrc file is:

plugin_cache_dir   = "$HOME/.terraform.d/plugin-cache"

The text was updated successfully, but these errors were encountered:

AErmie · 2021-10-03T17:57:27Z

I get this same exit code 4 when there are no violated policies (due to skip-rules configuration).

Note: I am using the Docker container method:

docker run --rm --volume $(System.DefaultWorkingDirectory):/code \
  accurics/terrascan scan --iac-dir /code/ --verbose --config-path code/terrascan.toml \

Scan Summary -

	File/Folder         :	/code
	IaC Type            :	all
	Scanned At          :	2021-10-03 17:46:25.094059433 +0000 UTC
	Policies Validated  :	60
	Violated Policies   :	0
	Low                 :	0
	Medium              :	0
	High                :	0

##[debug]Exit code 4 received from tool '/usr/bin/bash'
##[debug]STDIO streams have closed for tool '/usr/bin/bash'
##[error]Bash exited with code '4'.

TerraScan TOML file:

[severity]
level = "high"
[rules]
    skip-rules = [
        "AC_AWS_0207",
        "AC_AWS_0214",
        "AC_AWS_0215",
        "AC_AWS_0366",
        "AC_DOCKER_0029"
    ]

HorizonNet · 2021-10-25T20:13:03Z

Running into the same problem (with the skip-rules configuration), which actually let's the terrascan-action for GitHub fail. It could probably be related to the changes in #994 where the exit code behavior was changed.

HorizonNet · 2021-11-01T13:47:53Z

I looked deeper into my problem. Essentially I got the exit code 4, because I had directories in my project, which did not contain any Terraform files. It was not due to the skip-rules configuration. After fixing my initial problem also the skip-rules return an exit code 0. I think the problem is that even in verbose mode there are not a lot of pointers on what is going wrong. I had to add some additional logging to run.go to see what's going on and then run it again with the customized binary. The fix was to add empty Terraform configuration files into these directories, which is probably not perfect.

As it was mentioned somewhere that we're simulating terraform plan with the exit codes: terraform plan returns an exit code 0 if a sub-directory does not have a Terraform configuration file in it.

yane3628 · 2021-11-01T17:35:59Z

When running for all IaC types, I'm always getting an error exit code when there are no Docker files present in the directories.

... has no files named Dockerfile. Use -f flag if Dockerfiles follow a different naming convention.

The tool shouldn't exit with an error exit code if no Docker files are present.

nvuillam · 2022-01-23T11:17:44Z

Same here: terrascan scan d . -i terraform -t all -v returns code 4, whereas there are valid terraform files in the directory

nvuillam · 2022-01-23T11:21:48Z

Output log in MegaLinter:

[terrascan] command: ['terrascan', 'scan', 'd', '.', '-i', 'terraform', '-t', 'all', '-v']
[terrascan] CWD: /tmp/lint/.automation/test/terraform_terrascan/good
[terrascan] result: 4 

Scan Summary -

	File/Folder         :	/tmp/lint/.automation/test/terraform_terrascan/good
	IaC Type            :	terraform
	Scanned At          :	2022-01-23 10:36:52.053745916 +0000 UTC
	Policies Validated  :	785
	Violated Policies   :	0
	Low                 :	0
	Medium              :	0
	High                :	0

Rchanger · 2022-02-21T07:28:06Z

When running for all IaC types, I'm always getting an error exit code when there are no Docker files present in the directories.

... has no files named Dockerfile. Use -f flag if Dockerfiles follow a different naming convention.

The tool shouldn't exit with an error exit code if no Docker files are present.

Hi @yane3628 this is just a warning it is not being used in error code computation.

Rchanger · 2022-02-21T07:32:56Z

Same here: terrascan scan d . -i terraform -t all -v returns code 4, whereas there are valid terraform files in the directory

@nvuillam can you please try running the same command with output type as json -o json. With this, you can see what all errors are there during scanning. You can post the same if they are not relevant and we can try filtering them. Thank you.

jb185555 · 2022-02-23T16:52:02Z

the -o json helped me debug. I forgot to have -i terraform

I know this doesn't solve most peoples problem in this issue, but I'll leave this note for anyone.

wesleykirklandsg · 2022-03-25T13:57:21Z

the -o json helped me debug. I forgot to have -i terraform

I know this doesn't solve most peoples problem in this issue, but I'll leave this note for anyone.

@jb185555 Thanks for this tip, setting the IaC to terraform made it produce exit code 0 for me. The only problem I have is the docs are broken for the config file references and I can't get the config file to auto set my iac type

michaelglass · 2022-11-01T11:39:48Z

dumbest of dumb suggestions but: I dropped an empty.tf in all the empty directories to quiet terrascan.

NTitmus · 2023-12-22T17:21:29Z

I have tried and I am still getting this. When I run the command: terrascan scan d . -i terraform -t all -v -o json

I get:

{
"results": {
"scan_errors": [
{
"iac_type": "terraform",
"directory": "/Users/username/Desktop/Folder1/Folder2/Folder3/simple_module_ml/modules",
"errMsg": "directory '/Users/username/Desktop/Folder1/Folder2/Folder3/simple_module_ml/modules' has no terraform config files"
}
],
"violations": null,
"skipped_violations": null,
"scan_summary": {
"file/folder": "/Users/username/Desktop/Folder1/Folder2/Folder3/simple_module_ml",
"iac_type": "terraform",
"scanned_at": "2023-12-22 17:13:48.881986 +0000 UTC",
"policies_validated": 148,
"violated_policies": 0,
"low": 0,
"medium": 0,
"high": 0
}
}
}

Why does it error when there is a directory with no .tf files? Is there a way of configuring Terrascan to ignore some directories?

nvuillam · 2024-03-09T13:06:21Z

Any change to have a fix someday about this issue ? :)

MatthiasHuygelen · 2024-09-06T07:37:06Z

any updates on this issue ?

yermulnik mentioned this issue Nov 3, 2021

[3rd party: terrascan] terrascan: Failed with 0 violated policies antonbabenko/pre-commit-terraform#275

Closed

santipyx mentioned this issue Feb 10, 2022

Error: Process completed with exit code 4. #1121

Open

pflueg mentioned this issue Mar 3, 2022

cli/run.go:110 scan run failed{error 26 0 failed to initialize OPA policy engine} #1178

Closed

NTitmus mentioned this issue Dec 22, 2023

TERRAFORM_TERRASCAN errors when there is a directory without a .tf file oxsecurity/megalinter#3244

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Unexpected exit code of 4 when running a scan on an empty directory #1036

Unexpected exit code of 4 when running a scan on an empty directory #1036

JonZeolla commented Sep 30, 2021

AErmie commented Oct 3, 2021

HorizonNet commented Oct 25, 2021

HorizonNet commented Nov 1, 2021

yane3628 commented Nov 1, 2021

nvuillam commented Jan 23, 2022

nvuillam commented Jan 23, 2022

Rchanger commented Feb 21, 2022

Rchanger commented Feb 21, 2022

jb185555 commented Feb 23, 2022 •

edited

Loading

wesleykirklandsg commented Mar 25, 2022

michaelglass commented Nov 1, 2022

NTitmus commented Dec 22, 2023

nvuillam commented Mar 9, 2024

MatthiasHuygelen commented Sep 6, 2024

Unexpected exit code of 4 when running a scan on an empty directory #1036

Unexpected exit code of 4 when running a scan on an empty directory #1036

Comments

JonZeolla commented Sep 30, 2021

Description

What I Did

AErmie commented Oct 3, 2021

HorizonNet commented Oct 25, 2021

HorizonNet commented Nov 1, 2021

yane3628 commented Nov 1, 2021

nvuillam commented Jan 23, 2022

nvuillam commented Jan 23, 2022

Rchanger commented Feb 21, 2022

Rchanger commented Feb 21, 2022

jb185555 commented Feb 23, 2022 • edited Loading

wesleykirklandsg commented Mar 25, 2022

michaelglass commented Nov 1, 2022

NTitmus commented Dec 22, 2023

nvuillam commented Mar 9, 2024

MatthiasHuygelen commented Sep 6, 2024

jb185555 commented Feb 23, 2022 •

edited

Loading