Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

False positives in ckv_aws_237 #6300

Open
pingoleon108 opened this issue May 13, 2024 · 1 comment
Open

False positives in ckv_aws_237 #6300

pingoleon108 opened this issue May 13, 2024 · 1 comment
Labels
checks Check additions or changes

Comments

@pingoleon108
Copy link

Describe the issue
If it is related to an existing check, please note the relevant check ID.
Also, explain the logic for this addition / change.
ckv_aws_237

Examples
Please share an example code sample (in the IaC of your choice) + the expected outcomes.
We have 2 resources as part of the main apigateway.tf

resource "aws_api_gateway_deployment" "default" {
  rest_api_id       = aws_api_gateway_rest_api.default.*.id[0]
  description       = var.description
  stage_description = var.stage_description
  variables         = var.variables
  depends_on = [
    aws_api_gateway_rest_api_policy.default
  ]

  lifecycle {
    create_before_destroy = true
  }
}

and the dependency

resource "aws_api_gateway_rest_api" "default" {
  name        = var.name
  description = var.description
  body        = templatefile(var.body_filename, var.body_template_params)
  endpoint_configuration {
    types = var.types
  }

  tags = merge(
    var.platform_mandatory_tags,
    {
      "created_via" = "terra",
      "team"     = local.team_tag
    },
  )
}

As terraform note says : Note that Terraform propagates and applies the create_before_destroy meta-attribute behaviour to all resource dependencies
That being said, ckv_aws_237 should pass for the above code because aws_api_gateway_deployment resource has the lifecycle on it.

Version (please complete the following information):

  • Checkov Version [e.g. 22]
    3.2.65 version
    Additional context
    Add any other context about the problem here.
@pingoleon108 pingoleon108 added the checks Check additions or changes label May 13, 2024
@mannycepeda1989
Copy link

Good afternoon @pingoleon108 , thank you for bringing this issue of a potential false positive to our attention. We will further investigate it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
checks Check additions or changes
Projects
None yet
Development

No branches or pull requests

2 participants