bug: trivy config on modules not working expected with reading template file

[posquit0]

Description

• Same result with the tfsec issue
• trivy config does not give correct results when reading variable values from an external YAML file via templatefile() function.

What did you expect to happen?

When using the templatefile() function, it incorrectly reports unset variable values in the called module.

The result should be reported after scanning for when the module has been rendered via the values in the YAML file.

What happened instead?

• So many false detections. trivy doesn't consider the result of templatefile() function as terraform variables.

Output of run with -debug:

(paste your output here)

Output of trivy -v:

> trivy -v
Version: 0.36.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-01-31 00:13:49.292485119 +0000 UTC
  NextUpdate: 2023-01-31 06:13:49.292484919 +0000 UTC
  DownloadedAt: 2023-01-31 05:37:42.057341 +0000 UTC

Additional details (base image name, container registry info...):

• https://github.com/aquasecurity/tfsec/issues/1980

[posquit0]

Any update?

[nikpivkin]

I created the issue .