Ignore after_unknown resources

CHANGELOG.md

@@ -1,6 +1,7 @@
 # CHANGELOG
 
 ## Unreleased
+* Removed some `after_unknown` values (a.k.a "known after apply" values) being added to the evaluated resources. ([#417])
 * New [tag](https://terraform-compliance.com/pages/bdd-references/using_tags/#supported-tags) to exclude resources from tagged scenario. ([#414](https://github.com/eerkunt/terraform-compliance/issues/414))
 
 ## 1.3.7 (2020-11-09)

terraform_compliance/extensions/terraform.py

@@ -1,5 +1,5 @@
 import json
-from terraform_compliance.common.helper import seek_key_in_dict, flatten_list, dict_merge, Match
+from terraform_compliance.common.helper import seek_key_in_dict, flatten_list, Match
 import sys
 from copy import deepcopy
 from terraform_compliance.common.defaults import Defaults
@@ -131,7 +131,7 @@ def _parse_resources(self):
             change = resource.get('change', {})
             actions = change.get('actions', [])
             if actions != ['delete']:
-                resource['values'] = dict_merge(change.get('after', {}), change.get('after_unknown', {}))
+                resource['values'] = change.get('after', {})
                 if 'change' in resource:
                     del resource['change']
 
@@ -252,7 +252,7 @@ def _mount_resources(self, source, target, ref_type):
                     if Defaults.r_mount_addr_ptr_list not in self.resources[target_resource]:
                         self.resources[target_resource][Defaults.r_mount_addr_ptr_list] = []
 
-                    if ref_type not in self.resources[target_resource]['values']:
+                    if ref_type not in self.resources[target_resource]['values'] or self.resources[target_resource]['values'][ref_type] == 'known after apply':
                         self.resources[target_resource]['values'][ref_type] = []
 
                     self.resources[target_resource]['values'][ref_type].append(resource)

tests/functional/test_dynamodb_kms_key_problem/plan.out.json

@@ -1 +1 @@
-{"format_version":"0.1","terraform_version":"0.12.20","planned_values":{"root_module":{"resources":[{"address":"aws_dynamodb_table.test","mode":"managed","type":"aws_dynamodb_table","name":"test","provider_name":"aws","schema_version":1,"values":{"attribute":[{"name":"GameTitle","type":"S"},{"name":"TopScore","type":"N"},{"name":"UserId","type":"S"}],"billing_mode":"PROVISIONED","global_secondary_index":[{"hash_key":"GameTitle","name":"GameTitleIndex","non_key_attributes":["UserId"],"projection_type":"INCLUDE","range_key":"TopScore","read_capacity":10,"write_capacity":10}],"hash_key":"UserId","local_secondary_index":[],"name":"test-table","range_key":"GameTitle","read_capacity":20,"server_side_encryption":[{"enabled":true}],"stream_enabled":null,"tags":{"Environment":"production","Name":"dynamodb-table-1"},"timeouts":null,"ttl":[{"attribute_name":"TimeToExist","enabled":false}],"write_capacity":20}},{"address":"aws_kms_key.test","mode":"managed","type":"aws_kms_key","name":"test","provider_name":"aws","schema_version":0,"values":{"customer_master_key_spec":"SYMMETRIC_DEFAULT","deletion_window_in_days":null,"description":"Test","enable_key_rotation":false,"is_enabled":true,"key_usage":"ENCRYPT_DECRYPT","tags":null}}]}},"resource_changes":[{"address":"aws_dynamodb_table.test","mode":"managed","type":"aws_dynamodb_table","name":"test","provider_name":"aws","change":{"actions":["create"],"before":null,"after":{"attribute":[{"name":"GameTitle","type":"S"},{"name":"TopScore","type":"N"},{"name":"UserId","type":"S"}],"billing_mode":"PROVISIONED","global_secondary_index":[{"hash_key":"GameTitle","name":"GameTitleIndex","non_key_attributes":["UserId"],"projection_type":"INCLUDE","range_key":"TopScore","read_capacity":10,"write_capacity":10}],"hash_key":"UserId","local_secondary_index":[],"name":"test-table","range_key":"GameTitle","read_capacity":20,"server_side_encryption":[{"enabled":true}],"stream_enabled":null,"tags":{"Environment":"production","Name":"dynamodb-table-1"},"timeouts":null,"ttl":[{"attribute_name":"TimeToExist","enabled":false}],"write_capacity":20},"after_unknown":{"arn":true,"attribute":[{},{},{}],"global_secondary_index":[{"non_key_attributes":[false]}],"id":true,"local_secondary_index":[],"point_in_time_recovery":true,"server_side_encryption":[{"kms_key_arn":true}],"stream_arn":true,"stream_label":true,"stream_view_type":true,"tags":{},"ttl":[{}]}}},{"address":"aws_kms_key.test","mode":"managed","type":"aws_kms_key","name":"test","provider_name":"aws","change":{"actions":["create"],"before":null,"after":{"customer_master_key_spec":"SYMMETRIC_DEFAULT","deletion_window_in_days":null,"description":"Test","enable_key_rotation":false,"is_enabled":true,"key_usage":"ENCRYPT_DECRYPT","tags":null},"after_unknown":{"arn":true,"id":true,"key_id":true,"policy":true}}}],"configuration":{"root_module":{"resources":[{"address":"aws_dynamodb_table.test","mode":"managed","type":"aws_dynamodb_table","name":"test","provider_config_key":"aws","expressions":{"attribute":[{"name":{"constant_value":"UserId"},"type":{"constant_value":"S"}},{"name":{"constant_value":"GameTitle"},"type":{"constant_value":"S"}},{"name":{"constant_value":"TopScore"},"type":{"constant_value":"N"}}],"billing_mode":{"constant_value":"PROVISIONED"},"global_secondary_index":[{"hash_key":{"constant_value":"GameTitle"},"name":{"constant_value":"GameTitleIndex"},"non_key_attributes":{"constant_value":["UserId"]},"projection_type":{"constant_value":"INCLUDE"},"range_key":{"constant_value":"TopScore"},"read_capacity":{"constant_value":10},"write_capacity":{"constant_value":10}}],"hash_key":{"constant_value":"UserId"},"name":{"constant_value":"test-table"},"range_key":{"constant_value":"GameTitle"},"read_capacity":{"constant_value":20},"server_side_encryption":[{"enabled":{"constant_value":true},"kms_key_arn":{"references":["aws_kms_key.test"]}}],"tags":{"constant_value":{"Environment":"production","Name":"dynamodb-table-1"}},"ttl":[{"attribute_name":{"constant_value":"TimeToExist"},"enabled":{"constant_value":false}}],"write_capacity":{"constant_value":20}},"schema_version":1},{"address":"aws_kms_key.test","mode":"managed","type":"aws_kms_key","name":"test","provider_config_key":"aws","expressions":{"description":{"constant_value":"Test"}},"schema_version":0}]}}}
+{"format_version":"0.1","terraform_version":"0.13.0","planned_values":{"root_module":{"resources":[{"address":"aws_dynamodb_table.test","mode":"managed","type":"aws_dynamodb_table","name":"test","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":1,"values":{"attribute":[{"name":"GameTitle","type":"S"},{"name":"TopScore","type":"N"},{"name":"UserId","type":"S"}],"billing_mode":"PROVISIONED","global_secondary_index":[{"hash_key":"GameTitle","name":"GameTitleIndex","non_key_attributes":["UserId"],"projection_type":"INCLUDE","range_key":"TopScore","read_capacity":10,"write_capacity":10}],"hash_key":"UserId","local_secondary_index":[],"name":"test-table","range_key":"GameTitle","read_capacity":20,"replica":[],"server_side_encryption":[{"enabled":true}],"stream_enabled":null,"tags":{"Environment":"production","Name":"dynamodb-table-1"},"timeouts":null,"ttl":[{"attribute_name":"TimeToExist","enabled":false}],"write_capacity":20}},{"address":"aws_kms_key.test","mode":"managed","type":"aws_kms_key","name":"test","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"customer_master_key_spec":"SYMMETRIC_DEFAULT","deletion_window_in_days":null,"description":"Test","enable_key_rotation":false,"is_enabled":true,"key_usage":"ENCRYPT_DECRYPT","tags":null}}]}},"resource_changes":[{"address":"aws_dynamodb_table.test","mode":"managed","type":"aws_dynamodb_table","name":"test","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"attribute":[{"name":"GameTitle","type":"S"},{"name":"TopScore","type":"N"},{"name":"UserId","type":"S"}],"billing_mode":"PROVISIONED","global_secondary_index":[{"hash_key":"GameTitle","name":"GameTitleIndex","non_key_attributes":["UserId"],"projection_type":"INCLUDE","range_key":"TopScore","read_capacity":10,"write_capacity":10}],"hash_key":"UserId","local_secondary_index":[],"name":"test-table","range_key":"GameTitle","read_capacity":20,"replica":[],"server_side_encryption":[{"enabled":true}],"stream_enabled":null,"tags":{"Environment":"production","Name":"dynamodb-table-1"},"timeouts":null,"ttl":[{"attribute_name":"TimeToExist","enabled":false}],"write_capacity":20},"after_unknown":{"arn":true,"attribute":[{},{},{}],"global_secondary_index":[{"non_key_attributes":[false]}],"id":true,"local_secondary_index":[],"point_in_time_recovery":true,"replica":[],"server_side_encryption":[{"kms_key_arn":true}],"stream_arn":true,"stream_label":true,"stream_view_type":true,"tags":{},"ttl":[{}]}}},{"address":"aws_kms_key.test","mode":"managed","type":"aws_kms_key","name":"test","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"customer_master_key_spec":"SYMMETRIC_DEFAULT","deletion_window_in_days":null,"description":"Test","enable_key_rotation":false,"is_enabled":true,"key_usage":"ENCRYPT_DECRYPT","tags":null},"after_unknown":{"arn":true,"id":true,"key_id":true,"policy":true}}}],"configuration":{"root_module":{"resources":[{"address":"aws_dynamodb_table.test","mode":"managed","type":"aws_dynamodb_table","name":"test","provider_config_key":"aws","expressions":{"attribute":[{"name":{"constant_value":"UserId"},"type":{"constant_value":"S"}},{"name":{"constant_value":"GameTitle"},"type":{"constant_value":"S"}},{"name":{"constant_value":"TopScore"},"type":{"constant_value":"N"}}],"billing_mode":{"constant_value":"PROVISIONED"},"global_secondary_index":[{"hash_key":{"constant_value":"GameTitle"},"name":{"constant_value":"GameTitleIndex"},"non_key_attributes":{"constant_value":["UserId"]},"projection_type":{"constant_value":"INCLUDE"},"range_key":{"constant_value":"TopScore"},"read_capacity":{"constant_value":10},"write_capacity":{"constant_value":10}}],"hash_key":{"constant_value":"UserId"},"name":{"constant_value":"test-table"},"range_key":{"constant_value":"GameTitle"},"read_capacity":{"constant_value":20},"server_side_encryption":[{"enabled":{"constant_value":true},"kms_key_arn":{"references":["aws_kms_key.test"]}}],"tags":{"constant_value":{"Environment":"production","Name":"dynamodb-table-1"}},"ttl":[{"attribute_name":{"constant_value":"TimeToExist"},"enabled":{"constant_value":false}}],"write_capacity":{"constant_value":20}},"schema_version":1},{"address":"aws_kms_key.test","mode":"managed","type":"aws_kms_key","name":"test","provider_config_key":"aws","expressions":{"description":{"constant_value":"Test"}},"schema_version":0}]}}}

tests/functional/test_dynamodb_kms_key_problem/test.feature

@@ -1,7 +1,15 @@
 Feature: Image scan to be enabled on push to ECR
   This feature will enforce vulnerabilty scan on images pushed to ECR
-  ​
+
+  IMPORTANT!
+  This feature can not test the said vulnerability.
+  kms_key_arn is only known after apply and won't be in the plan
+  both enabled = false and enabled = true && not setting kms_key_arn results in server-side encryption being set to AWS owned CMK
+  https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table#server_side_encryption
+
+  Keeping this test for future reference
+
   Scenario: Image scan to be enabled on push.
     Given I have aws_dynamodb_table defined
     Then it must contain server_side_encryption
-    And it must contain kms_key_arn
+#     And it must contain kms_key_arn