Motivation

PR #194 enables Terraform plan scanning behind the --x-terraform-plan flag, but the tfplan parser has critical bugs that cause resource loss in multi-module plans. These bugs prevent accurate scanning of real-world Terraform plans with modules, count, or for_each.

Related: #194

Changes

Bug Fixes

1. Fixed module resource loss: Resources from child modules were overwriting root module resources of the same type

   • Root cause: readModule was reinitializing kp.Resource[resource.Type] for each module, erasing previous resources
   • Solution: Check if map exists before creating (accumulate, don't reinitialize)
   • Disambiguation: Child module resources prefixed with module path (e.g., module.networking.subnet)
   • Backward compatibility: Root module resources keep simple names for existing Rego queries

2. Fixed count/for_each resource loss: Resources using count or for_each were overwriting each other

   • Root cause: Only resource.Name used as key, ignoring Index field
   • Solution: Format keys as name[0], name[1] for count and name["prod"], name["dev"] for for_each
   • Added formatResourceKeyWithIndex function to handle both numeric and string indexes

Test Coverage

Added 6 comprehensive test cases in tfplan_test.go:

• Multi-module with same resource type
• Same resource name in different modules
• Deeply nested modules (3 levels deep)
• Multiple sibling modules with same resource types
• Count creates multiple instances (3 instances)
• For_each creates multiple instances (3 environments)

Author Checklist

• I have reviewed my own PR.
• I have added or updated relevant unit tests where necessary. If no tests are added, I've explained why.
• All new and existing tests pass.
• I have tested my changes on staging (if applicable).
• I have updated any relevant documentation (if applicable).

QA Instruction

Test the fixes:

1. Module resource accumulation:

go test -v ./pkg/parser/json/... -run "TestJson_parseTFPlan/test_-_multi-module"
go test -v ./pkg/parser/json/... -run "TestJson_parseTFPlan/test_-_same_resource_name"
go test -v ./pkg/parser/json/... -run "TestJson_parseTFPlan/test_-_deeply_nested"

2. Count/for_each support:

go test -v ./pkg/parser/json/... -run "TestJson_parseTFPlan/test_-_count"
go test -v ./pkg/parser/json/... -run "TestJson_parseTFPlan/test_-_for_each"

3. Full test suite:

go test ./pkg/parser/json/...

Verify Rego query compatibility:

Existing Rego queries using split(resource, ".")[1] patterns continue to work because root module resources maintain simple names without module prefixes.

Blast Radius

• Impact: Only affects Terraform plan JSON parsing (currently gated behind --x-terraform-plan experimental flag)
• Scope: Fixes prevent data loss in scans, enabling accurate security analysis of multi-module Terraform plans
• Compatibility: Backward compatible with existing Rego queries

Additional Notes

Key Implementation Details

Resource key formats:

• Root module: resource_name (no prefix for backward compatibility)
• Child module: module.path.resource_name
• Count: resource_name[0], resource_name[1], etc.
• For_each: resource_name["prod"], resource_name["staging"], etc.
• Combined: module.app.web[0], module.storage.bucket["prod"]

Before these fixes:

{
  "resource": {
    "aws_s3_bucket": {
      "backup": {...}  // Only last module's bucket survives
    }
  }
}

After these fixes:

{
  "resource": {
    "aws_s3_bucket": {
      "main": {...},  // Root module bucket
      "module.storage.backup": {...}  // Child module bucket - both preserved!
    }
  }
}

I submit this contribution under the Apache-2.0 license.