aws scan: fatal rego_type_error: undefined function from content in the trivy cache

[tstraley]

Description

Encountering this fatal error:

$ trivy aws --region us-east-1 -f json -o ./trivy-aws-report.json
2024-11-21T13:46:43Z	INFO	Loaded	file_path="trivy.yaml"
2024/11/21 13:46:43 INFO Loaded file_path=trivy.yaml
2024-11-21T13:47:08Z	FATAL	aws scan error: 11 errors occurred:
<REDACTED>/.trivy-cache/policy/content/policies/cloud/policies/aws/ec2/as_no_secrets_in_user_data.rego:40: rego_type_error: undefined function squealer.scan_string
<REDACTED>/.trivy-cache/policy/content/policies/cloud/policies/aws/ec2/no_public_egress_sgr.rego:41: rego_type_error: undefined function cidr.is_public
<REDACTED>/.trivy-cache/policy/content/policies/cloud/policies/aws/ec2/no_public_egress_sgr.rego:42: rego_type_error: undefined function cidr.count_addresses
<REDACTED>/.trivy-cache/policy/content/policies/cloud/policies/aws/ec2/no_secrets_in_user_data.rego:41: rego_type_error: undefined function squealer.scan_string
<REDACTED>/.trivy-cache/policy/content/policies/cloud/policies/aws/ec2/no_sensitive_info.rego:35: rego_type_error: undefined function squealer.scan_string
<REDACTED>/.trivy-cache/policy/content/policies/cloud/policies/aws/ecs/no_plaintext_secrets.rego:40: rego_type_error: undefined function squealer.scan_string
<REDACTED>/.trivy-cache/policy/content/policies/cloud/policies/aws/eks/no_public_cluster_access_to_cidr.rego:37: rego_type_error: undefined function cidr.is_public
<REDACTED>/.trivy-cache/policy/content/policies/cloud/policies/azure/compute/no_secrets_in_custom_data.rego:38: rego_type_error: undefined function squealer.scan_string
<REDACTED>/.trivy-cache/policy/content/policies/cloud/policies/azure/database/no_public_firewall_access.rego:47: rego_type_error: undefined function cidr.is_public
<REDACTED>/.trivy-cache/policy/content/policies/cloud/policies/azure/database/no_public_firewall_access.rego:49: rego_type_error: undefined function cidr.is_public
rego_compile_error: error limit reached	<nil>

Seems like rego content from trivy itself (in the trivy cache) is invalid? Or it is trying to scan this directory when it shouldn't?

Note that I have this directory excluded from scans, so that shouldn't be the case:

scan:
  skip-dirs:
    - .trivy-cache

Desired Behavior

No fatal errors.

Actual Behavior

See above.

Reproduction Steps

1. `export TRIVY_CACHE_DIR=${PWD}/.trivy-cache`
2. `trivy aws --region us-east-1 -f json -o ./trivy-aws-report.json`
...

Target

AWS

Scanner

None

Output Format

JSON

Mode

Standalone

Debug Output

$ trivy aws --region us-east-1 -f json -o ./trivy-aws-report.json --debug
2024-12-05T11:33:57-07:00	INFO	Loaded	file_path="trivy.yaml"
2024-12-05T11:33:58-07:00	FATAL	unknown flag: --debug	<nil>


(:shrug:)

Operating System

Debian GNU/Linux 12 (bookworm)

Version

0.57.1

Checklist

• Run trivy clean --all
• Read the troubleshooting

[simar7]

@nikpivkin can you take a look?

[nikpivkin]

Hi @tstraley !

What version of the plugin and Trivy are you using? My guess is that you are using that version of Trivy, where we switched to the checks bundle of the newer version and are using the aws plugin with the older version of Trivy, which is causing a conflict. Could you please update the aws plugin or use a different cache directory in the plugin?

[tstraley]

Trivy 0.57.1 and trivy-aws plugin version 0.14.2

Plugin version was installed fresh when this issue occurred, so it was the latest available at that time.

use a different cache directory in the plugin

I'm not clear on the suggestion here. I think you are suggesting that when running the aws scan that I don't point to the same trivy cache as other trivy scanners? Does this not defeat the purpose of using a cache to avoid duplicating and re-pulling data? Or am I misinterpreting?

[nikpivkin]

Trivy 0.57.1 and trivy-aws plugin version 0.14.2

The plugin v0.15.0 uses Trivy, which will have no conflict with the Trivy you are using.

I'm not clear on the suggestion here. I think you are suggesting that when running the aws scan that I don't point to the same trivy cache as other trivy scanners? Does this not defeat the purpose of using a cache to avoid duplicating and re-pulling data? Or am I misinterpreting?

That's right, that's what the cache is for. But in your case you are using versions of Trivy that conflict with each other, so if you can't update the plugin for some reason, you can use a different directory for the cache. But it's better to just update the plugin.

[tstraley]

@nikpivkin - what am I missing here: installing the aws plugin fresh results in 0.14.2 and this upgrade command also only confirms 0.14.2 as latest available

$ trivy plugin upgrade
2024-12-09T14:41:15-07:00	INFO	[plugin] Upgrading plugin...	name="aws"
2024-12-09T14:41:22-07:00	INFO	[plugin] Plugin successfully installed	name="aws" version="0.14.2"
2024-12-09T14:41:22-07:00	INFO	[plugin] The plugin is up-to-date	name="aws" version="0.14.2"

How do I upgrade to 0.15.0 if that is necessary for this to work correctly with my trivy version?

you are using versions of Trivy that conflict with each other

Is there some way in which the appropriate compatible plugin versions would be installed for the version of trivy being used to plugin install it?

[nikpivkin]

Hi @tstraley

I have released a new version with a fix. The plugin is not yet updated in the index but you can install directly from the repository: trivy plugin uninstall trivy-aws && trivy plugin install github.com/aquasecurity/trivy-aws