Terraform: 使用 `merge()` 构建的 `tags` 无法为 `for_each` 模块内的资源解析 (有时是非确定性的),导致标签检查出现错误。

作者: brgsstm创建于 2026年9月9日更新于 2026年9月9日

标签graph

Both reproductions use this custom check (any tag check works; this is the smallest one):

policies/RequireOsTag.yaml

yaml

metadata:
  id: "CKV2_CUSTOM_REPRO"
  name: "repro: require os tag"
  category: "GENERAL_SECURITY"
definition:
  cond_type: "attribute"
  resource_types:
    - "azurerm_windows_virtual_machine"
  attribute: "tags.os"
  operator: "exists"

Run from the parent of repro-a/ / repro-b/:

bash

checkov -d repro-a --external-checks-dir policies --check CKV2_CUSTOM_REPRO --compact

Reproduction A — `merge()` inside the `for_each`-invoked child module (intermittent)

repro-a/
├── main.tf
└── mod/
    └── main.tf

repro-a/main.tf

hcl

locals {
  instances = {
    vm01 = {
      size = "Standard_B2ms"
    }
  }

  common_tags = {
    team = "platform"
    os   = "Windows"
  }
}

module "vm" {
  for_each = local.instances
  source   = "./mod"

  name    = each.key
  size    = each.value.size # <-- each.value.<attr> on a sibling argument
  vm_role = "testing"
…

内容来源: bridgecrewio/checkov

查看 GitHub 原文在 GitHub 查看讨论

Terraform: 使用 `merge()` 构建的 `tags` 无法为 `for_each` 模块内的资源解析 (有时是非确定性的),导致标签检查出现错误。

Reproduction A — merge() inside the for_each-invoked child module (intermittent)

Reproduction A — `merge()` inside the `for_each`-invoked child module (intermittent)