On Azure KeyVault Key, Auto-rotate policy not detected #6687

Joerg-L · 2024-05-14T16:52:24Z

Joerg-L
May 14, 2024

IDs

AVD-AZU-0014

Description

We are createing an Azure KeyVault Key with following terraform code

resource "azurerm_key_vault_key" "key" {
  name         = "storage-key"
  key_vault_id = module.keyvault.id
  key_type     = "RSA"
  key_size     = 2048
  key_opts = [
    "decrypt",
    "encrypt",
    "sign",
    "unwrapKey",
    "verify",
    "wrapKey"
  ]

  rotation_policy {
    automatic {
      time_after_creation = "P18M"
    }

    expire_after         = "P90D"
    notify_before_expiry = "P29D"
  }

  depends_on = [
    azurerm_key_vault_access_policy.client,
    azurerm_key_vault_access_policy.storage
  ]
}

Trivy trivy config . prints out

Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

MEDIUM: Key should have an expiry date specified.
════════════════════════════════════════
Expiration Date is an optional Key Vault Key behavior and is not set by default.

Set when the resource will be become inactive.

See https://avd.aquasec.com/misconfig/avd-azu-0014
────────────────────────────────────────
keyvault.tf:50-77
────────────────────────────────────────
50 ┌ resource "azurerm_key_vault_key" "key" {
51 │ name = "storage-key"
52 │ key_vault_id = module.keyvault.id
53 │ key_type = "RSA"
54 │ key_size = 2048
55 │ key_opts = [
56 │ "decrypt",
57 │ "encrypt",
58 └ "sign",
..
────────────────────────────────────────

Reproduction Steps

1.
2.
3.
...

Target

Filesystem

Scanner

Misconfiguration

Target OS

No response

Debug Output

2024-05-21T12:13:59+02:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-05-21T12:13:59+02:00       DEBUG   Cache dir       dir="C:\\Users\\adm-langjo\\AppData\\Local\\trivy"
2024-05-21T12:13:59+02:00       INFO    Misconfiguration scanning is enabled
2024-05-21T12:13:59+02:00       DEBUG   Policies successfully loaded from disk
2024-05-21T12:13:59+02:00       DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]  
2024-05-21T12:13:59+02:00       DEBUG   [nuget] The nuget packages directory couldn't be found. License search disabled
2024-05-21T12:13:59+02:00       DEBUG   Scanning files for misconfigurations... scanner="Terraform"
2024-05-21T12:13:59+02:00       DEBUG   [misconf] 13:59.622366800 terraform.scanner                Scanning [&{%!s(*mapfs.file=&{ [] {. 256 2147484096 {13946305378607720244 630026201 0xd5d0a80} <nil>} {{{0 0} {[] {} 0xc001a332c0} map[.terraform:0xc0000f6f60 main.tf:0xc0000f6f88 provider.tf:0xc0000f6f98 terraform.tf:0xc0000f6fa8 terraform.tfvars:0xc0000f6fb8 variables.tf:0xc0000f6fc8] 0}}}) .}] at '.'...
2024-05-21T12:13:59+02:00       DEBUG   [misconf] 13:59.625366800 terraform.scanner.rego           Overriding filesystem for checks!
2024-05-21T12:13:59+02:00       DEBUG   [misconf] 13:59.628367600 terraform.scanner.rego           Loaded 3 embedded libraries.
2024-05-21T12:13:59+02:00       DEBUG   [misconf] 13:59.688392100 terraform.scanner.rego           Loaded 191 embedded policies.
2024-05-21T12:13:59+02:00       DEBUG   [misconf] 13:59.780252800 terraform.scanner.rego           Loaded 194 policies from disk.
2024-05-21T12:13:59+02:00       DEBUG   [misconf] 13:59.780764500 terraform.scanner.rego           Overriding filesystem for data!
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.068306600 terraform.parser.<root>          Setting project/module root to '.'
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.070318800 terraform.parser.<root>          Parsing FS from '.'
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.070834200 terraform.parser.<root>          Parsing 'main.tf'...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.071383500 terraform.parser.<root>          Added file main.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.071383500 terraform.parser.<root>          Parsing 'provider.tf'...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.071383500 terraform.parser.<root>          Added file provider.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.071890900 terraform.parser.<root>          Parsing 'terraform.tf'...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.071890900 terraform.parser.<root>          Added file terraform.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.071890900 terraform.parser.<root>          Parsing 'variables.tf'...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.072404500 terraform.parser.<root>          Added file variables.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.072916700 terraform.scanner                Scanning root module '.'...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.072916700 terraform.parser.<root>          Setting project/module root to '.'
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.073428100 terraform.parser.<root>          Parsing FS from '.'
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.073428100 terraform.parser.<root>          Parsing 'main.tf'...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.073935700 terraform.parser.<root>          Added file main.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.073935700 terraform.parser.<root>          Parsing 'provider.tf'...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.073935700 terraform.parser.<root>          Added file provider.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.073935700 terraform.parser.<root>          Parsing 'terraform.tf'...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.074448300 terraform.parser.<root>          Added file terraform.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.074448300 terraform.parser.<root>          Parsing 'variables.tf'...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.074956000 terraform.parser.<root>          Added file variables.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.074956000 terraform.parser.<root>          Evaluating module...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.074956000 terraform.parser.<root>          Read 13 block(s) and 0 ignore(s) for module 'root' (4 file[s])...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.075469700 terraform.parser.<root>          Added 0 variables from tfvars.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.075926500 terraform.parser.<root>          Loaded module metadata for 59 module(s) from '.terraform/modules/modules.json'.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.075926500 terraform.parser.<root>          Working directory for module evaluation is 'C:\Entwicklung\Azure\envs\MIL\prod'
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.075926500 terraform.parser.<root>.evaluator Filesystem key is '676e78e3c2cdf846d98354f4d1b352b01fd36b046cf87e1ce743b168051d594d'
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.075926500 terraform.parser.<root>.evaluator Starting module evaluation...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.076441400 terraform.parser.<root>.evaluator Starting submodule evaluation...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.076441400 terraform.parser.<root>.evaluator Module 'module.deploy_mil_environment' resolved to path '../../../modules-environment/Infrastructure-Environment-MIL' in filesystem '&{%!s(*mapfs.file=&{ [] {. 256 2147484096 {13946305378607720244 630026201 0xd5d0a80} <nil>} {{{0 0} {[] {} 0xc001a335c0} map[] 0}}}) .}' using modules.json    
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.076952900 terraform.parser.<deploy_mil_environment> Parsing FS from '../../../modules-environment/Infrastructure-Environment-MIL'
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.076952900 terraform.parser.<deploy_mil_environment> Parsing '../../../modules-environment/Infrastructure-Environment-MIL/aks.tf'...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.077465000 terraform.parser.<deploy_mil_environment> Added file ../../../modules-environment/Infrastructure-Environment-MIL/aks.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.077465000 terraform.parser.<deploy_mil_environment> Parsing '../../../modules-environment/Infrastructure-Environment-MIL/eventhub.tf'...    
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.077972500 terraform.parser.<deploy_mil_environment> Added file ../../../modules-environment/Infrastructure-Environment-MIL/eventhub.tf.     
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.077972500 terraform.parser.<deploy_mil_environment> Parsing '../../../modules-environment/Infrastructure-Environment-MIL/main.tf'...        
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.078483600 terraform.parser.<deploy_mil_environment> Added file ../../../modules-environment/Infrastructure-Environment-MIL/main.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.078483600 terraform.parser.<deploy_mil_environment> Parsing '../../../modules-environment/Infrastructure-Environment-MIL/network.tf'...     
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.078995200 terraform.parser.<deploy_mil_environment> Added file ../../../modules-environment/Infrastructure-Environment-MIL/network.tf.      
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.078995200 terraform.parser.<deploy_mil_environment> Parsing '../../../modules-environment/Infrastructure-Environment-MIL/output.tf'...      
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.079514700 terraform.parser.<deploy_mil_environment> Added file ../../../modules-environment/Infrastructure-Environment-MIL/output.tf.       
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.079514700 terraform.parser.<deploy_mil_environment> Parsing '../../../modules-environment/Infrastructure-Environment-MIL/sql.tf'...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.080024300 terraform.parser.<deploy_mil_environment> Added file ../../../modules-environment/Infrastructure-Environment-MIL/sql.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.080024300 terraform.parser.<deploy_mil_environment> Parsing '../../../modules-environment/Infrastructure-Environment-MIL/storage.tf'...     
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.080535800 terraform.parser.<deploy_mil_environment> Added file ../../../modules-environment/Infrastructure-Environment-MIL/storage.tf.      
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.080535800 terraform.parser.<deploy_mil_environment> Parsing '../../../modules-environment/Infrastructure-Environment-MIL/tags.tf'...        
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.081044800 terraform.parser.<deploy_mil_environment> Added file ../../../modules-environment/Infrastructure-Environment-MIL/tags.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.081044800 terraform.parser.<deploy_mil_environment> Parsing '../../../modules-environment/Infrastructure-Environment-MIL/terraform.tf'...   
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.081557600 terraform.parser.<deploy_mil_environment> Added file ../../../modules-environment/Infrastructure-Environment-MIL/terraform.tf.    
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.081557600 terraform.parser.<deploy_mil_environment> Parsing '../../../modules-environment/Infrastructure-Environment-MIL/variables.tf'...   
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.082132000 terraform.parser.<deploy_mil_environment> Added file ../../../modules-environment/Infrastructure-Environment-MIL/variables.tf.    
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.082132000 terraform.parser.<root>.evaluator found module '../../../modules-environment/Infrastructure-Environment-MIL' in .terraform/modules2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.082132000 terraform.parser.<root>.evaluator Loaded module "deploy_mil_environment" from "../../../modules-environment/Infrastructure-Environment-MIL".
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.082649600 terraform.parser.<root>.evaluator Module 'module.global-informations' resolved to path '../../../global-informations' in filesystem '&{%!s(*mapfs.file=&{ [] {. 256 2147484096 {13946305378607720244 630026201 0xd5d0a80} <nil>} {{{0 0} {[] {} 0xc001a335c0} map[] 0}}}) .}' using modules.json
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.083876800 terraform.parser.<global-informations> Parsing FS from '../../../global-informations'
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.087086300 terraform.parser.<global-informations> Parsing '../../../global-informations/main.tf'...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.090102400 terraform.parser.<global-informations> Added file ../../../global-informations/main.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.091750500 terraform.parser.<global-informations> Parsing '../../../global-informations/network.tf'...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.094747700 terraform.parser.<global-informations> Added file ../../../global-informations/network.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.095284700 terraform.parser.<global-informations> Parsing '../../../global-informations/output.tf'...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.096895000 terraform.parser.<global-informations> Added file ../../../global-informations/output.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.096895000 terraform.parser.<global-informations> Parsing '../../../global-informations/private_dns_zones.tf'...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.097428500 terraform.parser.<global-informations> Added file ../../../global-informations/private_dns_zones.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.098405800 terraform.parser.<global-informations> Parsing '../../../global-informations/tags.tf'...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.099107500 terraform.parser.<global-informations> Added file ../../../global-informations/tags.tf.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.099107500 terraform.parser.<root>.evaluator found module '../../../global-informations' in .terraform/modules
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.099107500 terraform.parser.<root>.evaluator Loaded module "global-informations" from "../../../global-informations".
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.100097400 terraform.parser.<deploy_mil_environment> Evaluating module...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.102096200 terraform.parser.<deploy_mil_environment> Read 34 block(s) and 0 ignore(s) for module 'deploy_mil_environment' (10 file[s])...    
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.102096200 terraform.parser.<deploy_mil_environment> Added 11 input variables from module definition.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.103096400 terraform.parser.<deploy_mil_environment> Loaded module metadata for 59 module(s) from '.terraform/modules/modules.json'.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.103096400 terraform.parser.<deploy_mil_environment> Working directory for module evaluation is 'C:\Entwicklung\Azure\envs\MIL\prod'
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.103096400 terraform.parser.<global-informations> Evaluating module...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.104096300 terraform.parser.<global-informations> Read 15 block(s) and 0 ignore(s) for module 'global-informations' (5 file[s])...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.104096300 terraform.parser.<global-informations> Added 2 input variables from module definition.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.104096300 terraform.parser.<global-informations> Loaded module metadata for 59 module(s) from '.terraform/modules/modules.json'.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.105097700 terraform.parser.<global-informations> Working directory for module evaluation is 'C:\Entwicklung\Azure\envs\MIL\prod'
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.105097700 terraform.parser.<root>.evaluator Evaluating submodule deploy_mil_environment
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.105097700 terraform.parser.<deploy_mil_environment>.evaluator Filesystem key is '676e78e3c2cdf846d98354f4d1b352b01fd36b046cf87e1ce743b168051d594d'
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.105097700 terraform.parser.<deploy_mil_environment>.evaluator Starting module evaluation...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.109097600 terraform.parser.<deploy_mil_environment>.evaluator Starting submodule evaluation...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.109097600 terraform.parser.<deploy_mil_environment>.evaluator Module 'module.deploy_mil_environment.module.aks' resolved to path '../../../modules/aks' in filesystem '&{%!s(*mapfs.file=&{ [] {. 256 2147484096 {13946305378607720244 630026201 0xd5d0a80} <nil>} {{{0 0} {[] {} 0xc001a335c0} map[] 0}}}) .}' using modules.json
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.110097700 terraform.parser.<deploy_mil_environment>.evaluator found module '../../modules/aks' in .terraform/modules
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.110097700 terraform.parser.<deploy_mil_environment>.evaluator Loaded module "aks" from "../../../modules/aks".
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.111098600 terraform.parser.<deploy_mil_environment>.evaluator Module 'module.deploy_mil_environment.module.eventhub_namespace' resolved to path '../../../modules/eventhub_namespace' in filesystem '&{%!s(*mapfs.file=&{ [] {. 256 2147484096 {13946305378607720244 630026201 0xd5d0a80} <nil>} {{{0 0} {[] {} 0xc001a335c0} map[] 0}}}) .}' using modules.json
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.112148700 terraform.parser.<deploy_mil_environment>.evaluator found module '../../modules/eventhub_namespace' in .terraform/modules
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.112148700 terraform.parser.<deploy_mil_environment>.evaluator Loaded module "eventhub_namespace" from "../../../modules/eventhub_namespace".2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.112148700 terraform.parser.<deploy_mil_environment>.evaluator Module 'module.deploy_mil_environment.module.global-informations' resolved to 
path '../../../global-informations' in filesystem '&{%!s(*mapfs.file=&{ [] {. 256 2147484096 {13946305378607720244 630026201 0xd5d0a80} <nil>} {{{0 0} {[] {} 0xc001a335c0} map[] 0}}}) .}' using modules.json
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.113149200 terraform.parser.<deploy_mil_environment>.evaluator found module '../../global-informations' in .terraform/modules
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.113149200 terraform.parser.<deploy_mil_environment>.evaluator Loaded module "global-informations" from "../../../global-informations".      
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.113149200 terraform.parser.<deploy_mil_environment>.evaluator Module 'module.deploy_mil_environment.module.network' resolved to path '../../../modules/network' in filesystem '&{%!s(*mapfs.file=&{ [] {. 256 2147484096 {13946305378607720244 630026201 0xd5d0a80} <nil>} {{{0 0} {[] {} 0xc001a335c0} map[] 0}}}) .}' using modules.json      
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.115149100 terraform.parser.<deploy_mil_environment>.evaluator found module '../../modules/network' in .terraform/modules
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.115149100 terraform.parser.<deploy_mil_environment>.evaluator Loaded module "network" from "../../../modules/network".
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.115149100 terraform.parser.<deploy_mil_environment>.evaluator Module 'module.deploy_mil_environment.module.storageaccount_terraformstate' resolved to path '../../../modules/storageaccount' in filesystem '&{%!s(*mapfs.file=&{ [] {. 256 2147484096 {13946305378607720244 630026201 0xd5d0a80} <nil>} {{{0 0} {[] {} 0xc001a335c0} map[] 0}}}) .}' using modules.json
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.116150000 terraform.parser.<deploy_mil_environment>.evaluator found module '../../modules/storageaccount' in .terraform/modules
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.116150000 terraform.parser.<deploy_mil_environment>.evaluator Loaded module "storageaccount_terraformstate" from "../../../modules/storageaccount".
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.121154200 terraform.parser.<deploy_mil_environment>.evaluator Evaluating submodule aks
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.126154700 terraform.parser.<deploy_mil_environment>.evaluator Submodule aks inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.126154700 terraform.parser.<deploy_mil_environment>.evaluator Evaluating submodule eventhub_namespace
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.146658300 terraform.parser.<deploy_mil_environment>.evaluator Submodule aks inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.147167900 terraform.parser.<deploy_mil_environment>.evaluator Submodule eventhub_namespace inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.147167900 terraform.parser.<deploy_mil_environment>.evaluator Evaluating submodule global-informations
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.149711900 terraform.parser.<deploy_mil_environment>.evaluator Evaluating submodule aks
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.155876600 terraform.parser.<deploy_mil_environment>.evaluator Submodule aks inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.156388000 terraform.parser.<deploy_mil_environment>.evaluator Evaluating submodule eventhub_namespace
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.195388600 terraform.parser.<deploy_mil_environment>.evaluator Submodule aks inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.196388600 terraform.parser.<deploy_mil_environment>.evaluator Submodule eventhub_namespace inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.196388600 terraform.parser.<deploy_mil_environment>.evaluator Submodule global-informations inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.196388600 terraform.parser.<deploy_mil_environment>.evaluator Evaluating submodule network
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.209482900 terraform.parser.<deploy_mil_environment>.evaluator Submodule aks inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.209482900 terraform.parser.<deploy_mil_environment>.evaluator Submodule eventhub_namespace inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.209482900 terraform.parser.<deploy_mil_environment>.evaluator Submodule global-informations inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.210483600 terraform.parser.<deploy_mil_environment>.evaluator Submodule network inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.210483600 terraform.parser.<deploy_mil_environment>.evaluator Evaluating submodule storageaccount_terraformstate
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.239325800 terraform.parser.<deploy_mil_environment>.evaluator Submodule aks inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.240316000 terraform.parser.<deploy_mil_environment>.evaluator Submodule eventhub_namespace inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.240316000 terraform.parser.<deploy_mil_environment>.evaluator Submodule global-informations inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.240316000 terraform.parser.<deploy_mil_environment>.evaluator Submodule network inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.240980000 terraform.parser.<deploy_mil_environment>.evaluator Submodule storageaccount_terraformstate inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.240980000 terraform.parser.<deploy_mil_environment>.evaluator All submodules are evaluated at i=7
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.240980000 terraform.parser.<deploy_mil_environment>.evaluator Starting post-submodule evaluation...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.241976100 terraform.parser.<deploy_mil_environment>.evaluator Finished processing 22 submodule(s).
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.241976100 terraform.parser.<deploy_mil_environment>.evaluator Module evaluation complete.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.241976100 terraform.parser.<deploy_mil_environment>.evaluator Added module output subnet_ids=cty.ObjectVal(map[string]cty.Value{"ACI":cty.DynamicVal, "AKS":cty.DynamicVal, "AKSServices":cty.DynamicVal, "AppService":cty.DynamicVal, "ApplicationGW":cty.DynamicVal, "AzureBus":cty.DynamicVal, "AzureSQL":cty.DynamicVal, "DevOps":cty.DynamicVal, "KeyVaults":cty.DynamicVal, "StorageAccount":cty.DynamicVal, "notAssigned":cty.DynamicVal}).
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.242982600 terraform.parser.<deploy_mil_environment>.evaluator Added module output subnet_names=cty.ObjectVal(map[string]cty.Value{"ACI":cty.DynamicVal, "AKS":cty.DynamicVal, "AKSServices":cty.DynamicVal, "AppService":cty.DynamicVal, "ApplicationGW":cty.DynamicVal, "AzureBus":cty.DynamicVal, "AzureSQL":cty.DynamicVal, "DevOps":cty.DynamicVal, "KeyVaults":cty.DynamicVal, "StorageAccount":cty.DynamicVal, "notAssigned":cty.DynamicVal}).
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.242982600 terraform.parser.<deploy_mil_environment>.evaluator Added module output vnet_id=cty.StringVal("c1fea14c-7192-448b-a5c0-ed752888d0da").
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.242982600 terraform.parser.<deploy_mil_environment>.evaluator Added module output vnet_name=cty.NilVal.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.243978700 terraform.parser.<root>.evaluator Submodule deploy_mil_environment inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.243978700 terraform.parser.<root>.evaluator Evaluating submodule global-informations
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.243978700 terraform.parser.<global-informations>.evaluator Filesystem key is '676e78e3c2cdf846d98354f4d1b352b01fd36b046cf87e1ce743b168051d594d'
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.243978700 terraform.parser.<global-informations>.evaluator Starting module evaluation...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.244979100 terraform.parser.<global-informations>.evaluator Expanded block 'data.azurerm_private_dns_zone.zones' into 4 clones via 'for_each' attribute.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.244979100 terraform.parser.<global-informations>.evaluator Starting submodule evaluation...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.244979100 terraform.parser.<global-informations>.evaluator All submodules are evaluated at i=0
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.244979100 terraform.parser.<global-informations>.evaluator Starting post-submodule evaluation...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.245979800 terraform.parser.<global-informations>.evaluator Finished processing 0 submodule(s).
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.245979800 terraform.parser.<global-informations>.evaluator Module evaluation complete.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.245979800 terraform.parser.<global-informations>.evaluator Added module output ado_keyvault=cty.ObjectVal(map[string]cty.Value{"name":cty.StringVal("kv-intrum-de-weu-ado"), "resource_group_name":cty.StringVal("rg-intrum-de-kv-ado")}).
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.245979800 terraform.parser.<global-informations>.evaluator Added module output ado_url=cty.StringVal("dev.azure.com/intrum-de").
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.245979800 terraform.parser.<global-informations>.evaluator Added module output central_acr=cty.ObjectVal(map[string]cty.Value{"name":cty.StringVal("acr-intrum-de-weu"), "resource_group_name":cty.StringVal("rg-intrum-de-acr")}).
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.246980000 terraform.parser.<global-informations>.evaluator Added module output central_law=cty.ObjectVal(map[string]cty.Value{"name":cty.StringVal("law-intrum-de-weu"), "resource_group_name":cty.StringVal("rg-intrum-de-law")}).
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.246980000 terraform.parser.<global-informations>.evaluator Added module output global_project_tags=cty.ObjectVal(map[string]cty.Value{"CloudData":cty.ObjectVal(map[string]cty.Value{"Billing":cty.StringVal("Infra"), "BusinessApplication":cty.StringVal("tbd"), "BusinessCriticallity":cty.StringVal("High"), "CostCentre":cty.StringVal("FCC-1111"), "DataClassification":cty.StringVal("tbd"), "Project":cty.StringVal("CloudData")}), "MIL":cty.ObjectVal(map[string]cty.Value{"Billing":cty.StringVal("Infra"), "BusinessApplication":cty.StringVal("IKAROS/MIL"), "BusinessCriticallity":cty.StringVal("High"), "CostCentre":cty.StringVal("FCC-0918"), "DataClassification":cty.StringVal("tbd"), "Project":cty.StringVal("Market Integration Layer / MIL")})}).
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.246980000 terraform.parser.<global-informations>.evaluator Added module output global_tags=cty.ObjectVal(map[string]cty.Value{"Company":cty.StringVal("Intrum"), "Country":cty.StringVal("Germany"), "ResourceCreator":cty.StringVal("Terraform"), "SupportTeam":cty.StringVal("Xinqi Liu <Xinqi.Liu@intrum.com>;Jörg Lang <Joerg.Lang@intrum.com>")}).
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.246980000 terraform.parser.<global-informations>.evaluator Added module output location_abbreviation=cty.ObjectVal(map[string]cty.Value{"Germany West Central":cty.StringVal("Ger"), "North Europe":cty.StringVal("Neu"), "West Europe":cty.StringVal("Weu")}).
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.247979800 terraform.parser.<global-informations>.evaluator Added module output ui_devops_aci=cty.ObjectVal(map[string]cty.Value{"name":cty.StringVal("ui-intrum-de-devops-aci"), "resource_group_name":cty.StringVal("rg-intrum-de-managed-identity")}).
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.247979800 terraform.parser.<global-informations>.evaluator Added module output zone_ids=cty.ObjectVal(map[string]cty.Value{"blob":cty.StringVal("5542e575-82fb-4ab3-9208-9519bb1b9773"), "bus":cty.StringVal("d79827a4-353b-4f9d-a247-b93f8db70fbf"), "kv":cty.StringVal("dfcc2ab4-d346-4429-853e-de8f07f5e2cc"), "sql":cty.StringVal("02241f01-1c60-4ece-bad3-2a5fb0fe63ce")}).
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.247979800 terraform.parser.<root>.evaluator Submodule deploy_mil_environment inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.247979800 terraform.parser.<root>.evaluator Submodule global-informations inputs unchanged
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.248979900 terraform.parser.<root>.evaluator All submodules are evaluated at i=2
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.248979900 terraform.parser.<root>.evaluator Starting post-submodule evaluation...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.248979900 terraform.parser.<root>.evaluator Finished processing 24 submodule(s).
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.248979900 terraform.parser.<root>.evaluator Module evaluation complete.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.248979900 terraform.parser.<root>          Finished parsing module 'root'.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.248979900 terraform.executor               Adapting modules...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.249980800 terraform.executor               Adapted 25 module(s) into defsec state data.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.249980800 terraform.executor               Using max routines of 11
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.249980800 terraform.executor               Initialized 486 rule(s).
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.249980800 terraform.executor               Created pool with 11 worker(s) to apply rules.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.253071700 terraform.scanner.rego           Scanning 1 inputs...
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.259072300 terraform.executor               Finished applying rules.
2024-05-21T12:14:00+02:00       DEBUG   [misconf] 14:00.259072300 terraform.executor               Applying ignores...
2024-05-21T12:14:00+02:00       DEBUG   OS is not detected.
2024-05-21T12:14:00+02:00       INFO    Detected config files   num=6
2024-05-21T12:14:00+02:00       DEBUG   Scanned config file     path="."
2024-05-21T12:14:00+02:00       DEBUG   Scanned config file     path="../../../modules/aks/main.tf"
2024-05-21T12:14:00+02:00       DEBUG   Scanned config file     path="../../../modules/keyvault/main.tf"
2024-05-21T12:14:00+02:00       DEBUG   Scanned config file     path="../../../modules/keyvault_key/main.tf"
2024-05-21T12:14:00+02:00       DEBUG   Scanned config file     path="../../../modules/network/subnets.tf"
2024-05-21T12:14:00+02:00       DEBUG   Scanned config file     path="../../../modules/storageaccount/main.tf"

../../../modules/keyvault_key/main.tf (terraform)
=================================================
Tests: 2 (SUCCESSES: 0, FAILURES: 2, EXCEPTIONS: 0)
Failures: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 0, CRITICAL: 0)

MEDIUM: Key should have an expiry date specified.
════════════════════════════════════════
Expiration Date is an optional Key Vault Key behavior and is not set by default.

Set when the resource will be become inactive.

See https://avd.aquasec.com/misconfig/avd-azu-0014
────────────────────────────────────────
 ../../../modules/keyvault_key/main.tf:74-104
   via ../../../modules/eventhub_namespace/main.tf:31-35 (module.keyvault_key)
    via ../../../modules-environment/Infrastructure-Environment-MIL/eventhub.tf:8-19 (module.eventhub_namespace)
     via main.tf:5-28 (module.deploy_mil_environment)
────────────────────────────────────────
  74 ┌ resource "azurerm_key_vault_key" "key" {
  75 │   #checkov:skip=CKV_AZURE_40: we will use auto-rotate policy
  76 │   #checkov:skip=CKV_AZURE_112: hsm not planned to be used
  77 │   name         = "cm-key-for-ecnryption"
  78 │   key_vault_id = var.key_vault_id
  79 │   key_type     = "RSA"
  80 │   key_size     = 2048
  81 │   key_opts = [
  82 └     "decrypt",
  ..
────────────────────────────────────────


MEDIUM: Key should have an expiry date specified.
════════════════════════════════════════
Expiration Date is an optional Key Vault Key behavior and is not set by default.

Set when the resource will be become inactive.

See https://avd.aquasec.com/misconfig/avd-azu-0014
────────────────────────────────────────
 ../../../modules/keyvault_key/main.tf:74-104
   via ../../../modules/storageaccount/keyvault.tf:15-19 (module.keyvault_key)
    via ../../../modules-environment/Infrastructure-Environment-MIL/storage.tf:32-45 (module.storageaccount_terraformstate)
     via main.tf:5-28 (module.deploy_mil_environment)
────────────────────────────────────────
  74 ┌ resource "azurerm_key_vault_key" "key" {
  75 │   #checkov:skip=CKV_AZURE_40: we will use auto-rotate policy
  76 │   #checkov:skip=CKV_AZURE_112: hsm not planned to be used
  77 │   name         = "cm-key-for-ecnryption"
  78 │   key_vault_id = var.key_vault_id
  79 │   key_type     = "RSA"
  80 │   key_size     = 2048
  81 │   key_opts = [
  82 └     "decrypt",
  ..
────────────────────────────────────────

Version

trivy version
Version: 0.51.1
Check Bundle:
  Digest: sha256:6d0771effa53c6cf8130861fc3ac28f5515c35a028edb4bb1e67261b9218c80e
  DownloadedAt: 2024-05-14 08:56:56.3843128 +0000 UTC

Checklist

Read the documentation regarding wrong detection
Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

simar7 · 2024-05-14T20:39:34Z

simar7
May 14, 2024
Maintainer

@nikpivkin can you take a look?

0 replies

nikpivkin · 2024-05-20T09:19:04Z

nikpivkin
May 20, 2024
Maintainer

Hi @Joerg-L !

According to the logs, the keyvault module was not resolved. Could you please share how this module is declared? Is the terraform init command executed successfully?

4 replies

Joerg-L May 20, 2024
Author

Hi @nikpivkin
At the moment, the modules are located locally and referenced with full path on windows so c:\folder1\modules\keyvault

nikpivkin May 20, 2024
Maintainer

The local path to the module must begin with ./ or ../. https://developer.hashicorp.com/terraform/language/modules/sources#local-paths

Joerg-L May 21, 2024
Author

Hi @nikpivkin
I updated the source references accordingly and also updated the debug output.

As you see, the issue still persists

nikpivkin May 21, 2024
Maintainer

Thanks @Joerg-L . Why do you think the AVD-AZU-0014 check should not be triggered? You don't set an expiration date for the key in your configuration. I think the answer from Microsoft employee will give you an idea of the difference between expiration date and expiry time that is set in the rotation policy.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

On Azure KeyVault Key, Auto-rotate policy not detected #6687

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 4 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

On Azure KeyVault Key, Auto-rotate policy not detected #6687

Joerg-L May 14, 2024

IDs

Description

Reproduction Steps

Target

Scanner

Target OS

Debug Output

Version

Checklist

Replies: 2 comments · 4 replies

simar7 May 14, 2024 Maintainer

nikpivkin May 20, 2024 Maintainer

Joerg-L May 20, 2024 Author

nikpivkin May 20, 2024 Maintainer

Joerg-L May 21, 2024 Author

nikpivkin May 21, 2024 Maintainer

Joerg-L
May 14, 2024

Replies: 2 comments 4 replies

simar7
May 14, 2024
Maintainer

nikpivkin
May 20, 2024
Maintainer

Joerg-L May 20, 2024
Author

nikpivkin May 20, 2024
Maintainer

Joerg-L May 21, 2024
Author

nikpivkin May 21, 2024
Maintainer