Skip to content

Conversation

@piax93
Copy link

@piax93 piax93 commented Oct 13, 2025

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

All terraform checks that rely on Cloudsplaining use the entity_path, and consequently the resource name, to cache parsed policies. This is a problem when dealing with IAM resources managed in a for_each block.

The fix is to use the full resource address to infer the resource name, rather than just it's un-indexed form, so that entity paths will result into something like ...:<resouce_type>.<resrouce_name>[<resource_index>] and the IAM policy caching won't get broken anymore by overlapping keys.

I am not sure if __address__ is available in all cases when this code is called, I know for sure it is the case when parsing terraform plan outputs, which is where this issue appears the most, so I made the name extraction conditional on the field being present to avoid breaking other input cases.

Fixes #7337

Checklist:

  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have added tests that prove my feature, policy, or fix is effective and works
  • New and existing tests pass locally with my changes

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

terraform: IAM resources using for_each are not correctly scanned

1 participant