trivy-checks: "Error occurred while parsing" for 'specify_ami_owners' / AVD-AWS-0344

[MiGrandjean]

Description

We ran in an issue today where trivy fails with a parsing error after downloading the latest trivy-checks version

Desired Behavior

Do not fail with a parsing error :)

Actual Behavior

Running trivy results in the following error message:

❯ trivy config .
2025-03-27T11:18:59+01:00	INFO	[misconfig] Misconfiguration scanning is enabled
2025-03-27T11:19:00+01:00	ERROR	[rego] Error occurred while parsing. Trying to fallback to embedded check	file_path="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego" err="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego:30: rego_type_error: undefined ref: input.aws.ec2.requestedamis[__local622__]\n\tinput.aws.ec2.requestedamis[__local622__]\n\t              ^\n\t              have: \"requestedamis\"\n\t              want (one of): [\"instances\" \"launchconfigurations\" \"launchtemplates\" \"networkacls\" \"securitygroups\" \"subnets\" \"volumes\" \"vpcs\"]"
2025-03-27T11:19:00+01:00	ERROR	[rego] Failed to find embedded check, skipping	file_path="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego"
2025-03-27T11:19:00+01:00	ERROR	[rego] Error occurred while parsing	file_path="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego" err="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego:30: rego_type_error: undefined ref: input.aws.ec2.requestedamis[__local622__]\n\tinput.aws.ec2.requestedamis[__local622__]\n\t              ^\n\t              have: \"requestedamis\"\n\t              want (one of): [\"instances\" \"launchconfigurations\" \"launchtemplates\" \"networkacls\" \"securitygroups\" \"subnets\" \"volumes\" \"vpcs\"]"
2025-03-27T11:19:01+01:00	ERROR	[rego] Error occurred while parsing. Trying to fallback to embedded check	file_path="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego" err="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego:30: rego_type_error: undefined ref: input.aws.ec2.requestedamis[__local622__]\n\tinput.aws.ec2.requestedamis[__local622__]\n\t              ^\n\t              have: \"requestedamis\"\n\t              want (one of): [\"instances\" \"launchconfigurations\" \"launchtemplates\" \"networkacls\" \"securitygroups\" \"subnets\" \"volumes\" \"vpcs\"]"
2025-03-27T11:19:01+01:00	ERROR	[rego] Failed to find embedded check, skipping	file_path="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego"
2025-03-27T11:19:01+01:00	ERROR	[rego] Error occurred while parsing	file_path="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego" err="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego:30: rego_type_error: undefined ref: input.aws.ec2.requestedamis[__local622__]\n\tinput.aws.ec2.requestedamis[__local622__]\n\t              ^\n\t              have: \"requestedamis\"\n\t              want (one of): [\"instances\" \"launchconfigurations\" \"launchtemplates\" \"networkacls\" \"securitygroups\" \"subnets\" \"volumes\" \"vpcs\"]"
2025-03-27T11:19:01+01:00	INFO	[terraform scanner] Scanning root module	file_path="."
[...]

Reproduction Steps

1. Use latest `trivy` version `0.60.0`
2. Clean local cache: `trivy clean --all`
3. Run `trivy config .` on your local config repository

Target

Git Repository

Scanner

Misconfiguration

Output Format

None

Mode

Standalone

Debug Output

❯ trivy --debug config .
2025-03-27T11:21:44+01:00	DEBUG	No plugins loaded
2025-03-27T11:21:44+01:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-03-27T11:21:44+01:00	DEBUG	Cache dir	dir="/home/michael/.cache/trivy"
2025-03-27T11:21:44+01:00	DEBUG	Cache dir	dir="/home/michael/.cache/trivy"
2025-03-27T11:21:44+01:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-03-27T11:21:44+01:00	INFO	[misconfig] Misconfiguration scanning is enabled
2025-03-27T11:21:44+01:00	DEBUG	[misconfig] Checks successfully loaded from disk
2025-03-27T11:21:44+01:00	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-03-27T11:21:44+01:00	DEBUG	Initializing scan cache...	type="memory"
2025-03-27T11:21:44+01:00	DEBUG	[fs] Analyzing...	root="."
2025-03-27T11:21:44+01:00	DEBUG	[fs] Random cache key will be used	err="repository is dirty"
2025-03-27T11:21:44+01:00	DEBUG	Skipping path	path=".git"
2025-03-27T11:21:44+01:00	DEBUG	[misconfig] Scanning files for misconfigurations...	scanner="Helm"
2025-03-27T11:21:44+01:00	DEBUG	[rego] Overriding filesystem for checks
2025-03-27T11:21:44+01:00	DEBUG	[rego] Embedded libraries are loaded	count=17
2025-03-27T11:21:44+01:00	DEBUG	[rego] Embedded checks are loaded	count=517
2025-03-27T11:21:44+01:00	DEBUG	[rego] Checks from disk are loaded	count=533
2025-03-27T11:21:44+01:00	DEBUG	[rego] Overriding filesystem for data
2025-03-27T11:21:45+01:00	ERROR	[rego] Error occurred while parsing. Trying to fallback to embedded check	file_path="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego" err="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego:30: rego_type_error: undefined ref: input.aws.ec2.requestedamis[__local622__]\n\tinput.aws.ec2.requestedamis[__local622__]\n\t              ^\n\t              have: \"requestedamis\"\n\t              want (one of): [\"instances\" \"launchconfigurations\" \"launchtemplates\" \"networkacls\" \"securitygroups\" \"subnets\" \"volumes\" \"vpcs\"]"
2025-03-27T11:21:45+01:00	ERROR	[rego] Failed to find embedded check, skipping	file_path="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego"
2025-03-27T11:21:45+01:00	ERROR	[rego] Error occurred while parsing	file_path="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego" err="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego:30: rego_type_error: undefined ref: input.aws.ec2.requestedamis[__local622__]\n\tinput.aws.ec2.requestedamis[__local622__]\n\t              ^\n\t              have: \"requestedamis\"\n\t              want (one of): [\"instances\" \"launchconfigurations\" \"launchtemplates\" \"networkacls\" \"securitygroups\" \"subnets\" \"volumes\" \"vpcs\"]"
2025-03-27T11:21:45+01:00	DEBUG	[misconfig] Scanning files for misconfigurations...	scanner="Kubernetes"
2025-03-27T11:21:45+01:00	DEBUG	[rego] Overriding filesystem for checks
2025-03-27T11:21:45+01:00	DEBUG	[rego] Embedded libraries are loaded	count=17
2025-03-27T11:21:45+01:00	DEBUG	[rego] Embedded checks are loaded	count=517
2025-03-27T11:21:45+01:00	DEBUG	[rego] Checks from disk are loaded	count=533
2025-03-27T11:21:45+01:00	DEBUG	[rego] Overriding filesystem for data
2025-03-27T11:21:45+01:00	ERROR	[rego] Error occurred while parsing. Trying to fallback to embedded check	file_path="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego" err="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego:30: rego_type_error: undefined ref: input.aws.ec2.requestedamis[__local622__]\n\tinput.aws.ec2.requestedamis[__local622__]\n\t              ^\n\t              have: \"requestedamis\"\n\t              want (one of): [\"instances\" \"launchconfigurations\" \"launchtemplates\" \"networkacls\" \"securitygroups\" \"subnets\" \"volumes\" \"vpcs\"]"
2025-03-27T11:21:45+01:00	ERROR	[rego] Failed to find embedded check, skipping	file_path="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego"
2025-03-27T11:21:45+01:00	ERROR	[rego] Error occurred while parsing	file_path="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego" err="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego:30: rego_type_error: undefined ref: input.aws.ec2.requestedamis[__local622__]\n\tinput.aws.ec2.requestedamis[__local622__]\n\t              ^\n\t              have: \"requestedamis\"\n\t              want (one of): [\"instances\" \"launchconfigurations\" \"launchtemplates\" \"networkacls\" \"securitygroups\" \"subnets\" \"volumes\" \"vpcs\"]"
2025-03-27T11:21:45+01:00	DEBUG	[kubernetes scanner] Scanning files...	count=23
2025-03-27T11:21:45+01:00	DEBUG	[rego] Scanning inputs	count=23
2025-03-27T11:21:46+01:00	DEBUG	[misconfig] Scanning files for misconfigurations...	scanner="Terraform"
2025-03-27T11:21:46+01:00	DEBUG	[terraform scanner] Scanning directory	file_path="."
2025-03-27T11:21:46+01:00	DEBUG	[rego] Overriding filesystem for checks
2025-03-27T11:21:46+01:00	DEBUG	[rego] Embedded libraries are loaded	count=17
2025-03-27T11:21:46+01:00	DEBUG	[rego] Embedded checks are loaded	count=517
2025-03-27T11:21:46+01:00	DEBUG	[rego] Checks from disk are loaded	count=533
2025-03-27T11:21:46+01:00	DEBUG	[rego] Overriding filesystem for data
2025-03-27T11:21:46+01:00	ERROR	[rego] Error occurred while parsing. Trying to fallback to embedded check	file_path="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego" err="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego:30: rego_type_error: undefined ref: input.aws.ec2.requestedamis[__local622__]\n\tinput.aws.ec2.requestedamis[__local622__]\n\t              ^\n\t              have: \"requestedamis\"\n\t              want (one of): [\"instances\" \"launchconfigurations\" \"launchtemplates\" \"networkacls\" \"securitygroups\" \"subnets\" \"volumes\" \"vpcs\"]"
2025-03-27T11:21:46+01:00	ERROR	[rego] Failed to find embedded check, skipping	file_path="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego"
2025-03-27T11:21:46+01:00	ERROR	[rego] Error occurred while parsing	file_path="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego" err="home/michael/.cache/trivy/policy/content/policies/cloud/policies/aws/ec2/specify_ami_owners.rego:30: rego_type_error: undefined ref: input.aws.ec2.requestedamis[__local622__]\n\tinput.aws.ec2.requestedamis[__local622__]\n\t              ^\n\t              have: \"requestedamis\"\n\t              want (one of): [\"instances\" \"launchconfigurations\" \"launchtemplates\" \"networkacls\" \"securitygroups\" \"subnets\" \"volumes\" \"vpcs\"]"
2025-03-27T11:21:46+01:00	DEBUG	[terraform parser] Setting project/module root	module="root" file_path="."
2025-03-27T11:21:46+01:00	DEBUG	[terraform parser] Parsing FS	module="root" file_path="."
2025-03-27T11:21:46+01:00	DEBUG	[terraform parser] Parsing	module="root" file_path="helm.tf"
2025-03-27T11:21:46+01:00	DEBUG	[terraform parser] Added file	module="root" file_path="helm.tf"
2025-03-27T11:21:46+01:00	DEBUG	[terraform parser] Parsing	module="root" file_path="kubernetes-manifests.tf"
2025-03-27T11:21:46+01:00	DEBUG	[terraform parser] Added file	module="root" file_path="kubernetes-manifests.tf"
2025-03-27T11:21:46+01:00	DEBUG	[terraform parser] Parsing	module="root" file_path="lambda.tf"
2025-03-27T11:21:46+01:00	DEBUG	[terraform parser] Added file	module="root" file_path="lambda.tf"
2025-03-27T11:21:46+01:00	DEBUG	[terraform parser] Parsing	module="root" file_path="locals.tf"
2025-03-27T11:21:46+01:00	DEBUG	[terraform parser] Added file	module="root" file_path="locals.tf"
2025-03-27T11:21:46+01:00	DEBUG	[terraform parser] Parsing	module="root" file_path="main.tf"
2025-03-27T11:21:46+01:00	DEBUG	[terraform parser] Added file	module="root" file_path="main.tf"
2025-03-27T11:21:46+01:00	DEBUG	[terraform parser] Parsing	module="root" file_path="variables.tf"
2025-03-27T11:21:46+01:00	DEBUG	[terraform parser] Added file	module="root" file_path="variables.tf"

Operating System

Ubuntu 24.04.2 LTS

Version

❯ trivy --version
Version: 0.60.0
Check Bundle:
  Digest: sha256:437134e8209404eb494ebc1caa8d0c14c02eb51e6b5b6bd7a836ecd7f0901b19
  DownloadedAt: 2025-03-27 10:11:40.148048279 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[simar7]

hi @MiGrandjean - thanks for the report. I can reproduce this behavior but it is not an issue per se as this check uses newer components that aren't present in older versions of Trivy. Once we release the new version of Trivy, the error should go away.

I'll create an issue to track improving the logging message that gets shown in such a scenario as it should not be an error.

[simar7]

Track #8632

[MiGrandjean]

Thx! Can confirm that 0.61.0 solved this :)

[nikpivkin]

Track #8632