Dependency discovery for Terraform using the terraform lock file (.terraform.lock.hcl)

[candrews]

Description

Terraform supports dependency discovery for many languages / build systems already as documented at https://aquasecurity.github.io/trivy/v0.40/docs/vulnerability/detection/language/

I'd like Trivy to be able to do the same for Terraform via Terraform's lock file, .terraform.lock.hcl, documented at https://developer.hashicorp.com/terraform/language/files/dependency-lock

My goal is to run Trivy to generate an SBOM which includes dependencies expressed in .terraform.lock.hcl.

For example, from a directory containing .terraform.lock.hcl, I'd like to run:
docker run -it -v "$(pwd)":/app:Z aquasec/trivy:latest filesystem --format cyclonedx --output sbom.cdx.json /app

And then open sbom.cdx.json and see the terraform dependencies. Currently, Trivy doesn't discover those dependencies so sbom.cdx.json doesn't list any dependencies.

Target

Filesystem

Scanner

Vulnerability

[simar7]

@candrews thanks for your question, to summarize you are looking at having an SBoM for IaC, in this case Terraform specifically? We've thought about it in the past but didn't get to a conclusion. @knqyf263 what do you think?

[candrews]

to summarize you are looking at having an SBoM for IaC, in this case Terraform specifically?

Yes, exactly 👍

[knqyf263]

It sounds good, but I'm unsure if we can maintain it. Due to the lack of standardization, even regular SBOMs have compatibility problems, and we've been spending so much time on that. If something already has a strict specification and we just implement it accordingly, that might be fine.