Skip to content

Conversation

@eshmayovitz
Copy link
Collaborator

@eshmayovitz eshmayovitz commented Dec 3, 2025

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

Fixed a bug in Checkov's Terraform graph builder where cross-module resource connections were not detected when resources reference each other through module outputs.

Problem: When a resource (e.g., aws_dynamodb_resource_policy) references another resource (e.g., aws_dynamodb_table) via a module output (e.g., module.dynamodb.table_arn), Checkov's graph builder created an edge to the OUTPUT block but failed to trace the output's value back to the actual source resource. This caused connection-based security checks to fail incorrectly.

Fix

Added _trace_output_to_source_resource() method in checkov/terraform/graph_builder/local_graph.py that:

Checklist:

  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have added tests that prove my feature, policy, or fix is effective and works
  • New and existing tests pass locally with my changes

@eshmayovitz eshmayovitz changed the title initial adding edge from output fix adding edge from output Dec 3, 2025
@eshmayovitz eshmayovitz changed the title fix adding edge from output fix(terraform): correctly add edge from output to source Dec 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants