checkov -f plan.json does not download external terraform modules for enrichment

with a sample config when file is used for tfplan.json i can see it does not download the external terraform modules ( my scenario is a git source ) i can see when --directory is used it does download the external terraform module

I thought the enrichment should download the external module so the enrichment can work and suppression and so forth I only use the #comment suppression.

download-external-modules: True
evaluate-variables: True
external-modules-download-path: '.external_modules'
file:
  - 'tfplan.json'
repo-root-for-plan-enrichment: '.'
framework: 'all'
no-guide: True
output: 'cli'
skip-fixes: True
skip-suppressions: True

[jSherz]

Thank you @melbit-michaelw for your investigation. This was a blocker for me so I ended up patching it after install:

--- runner_registry.py	2022-05-12 12:13:47.000000000 +0100
+++ runner_registry_fixed.py	2022-05-18 16:44:19.000000000 +0100
@@ -277,6 +277,7 @@
                 directory=repo_root,  # assume plan file is in the repo-root
                 out_definitions=tf_definitions,
                 out_parsing_errors=parsing_errors,
+                download_external_modules=True,
             )
             repo_definitions[repo_root] = {'tf_definitions': tf_definitions, 'parsing_errors': parsing_errors}

patch runner_registry.py < /tmp/checkov-runner-registry.patch

[melbit-michaelw]

So this looks like it is because of the plan enrichment. Specifically, this call to parse_directory which doesn’t pass along the configuration for download-external-modules (or external-modules-download-path):

https://github.com/bridgecrewio/checkov/blob/d73fd4bd7096d48ab3434a92a177bcc55605460a/checkov/common/runners/runner_registry.py#L250

Parser().parse_directory(
                directory=repo_root,  # assume plan file is in the repo-root
                out_definitions=tf_definitions,
                out_parsing_errors=parsing_errors,
            )

However, I’m not sure modifying that would help with suppression, since as best I can tell, this stage only happens after checkov has determined any failures already, and is only used for output formatting.

In my particular use case, I have a terraform module which creates an aws_acm_certificate, with the create_before_destroy lifecycle rule, however CKV_AWS_233 “Ensure Create before destroy for ACM certificates” still fires when checking against the plan since that information isn’t contained within the plan file.

Enriching the plan (and forcing it to download modules by modifying the code I linked above) changes the output from a JSON map of the acm certificate resource to the full terraform code of the resource, but does nothing to correct the false positive.