Skip to content

Conversation

@yagreut
Copy link
Contributor

@yagreut yagreut commented Nov 12, 2025

Update Azure network schema for new checks:

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

@nikpivkin
Copy link
Contributor

Hi @yagreut !

Currently, searching for related resources is not implemented for ARM templates, unlike Terraform and CloudFormation. In this PR, I suggest adding the adaptation only for Terraform. I’ll review soon whether it’s possible to implement related resource search for ARM — at the moment, the parser cannot evaluate expressions and, as far as I remember, has no concept of references.

@github-actions github-actions bot added the apidiff Indicates Go API changes relevant to library consumers (CLI compatibility may be unaffected) label Nov 13, 2025
@github-actions
Copy link

github-actions bot commented Nov 13, 2025

📊 API Changes Detected

Semver impact: major

github.com/aquasecurity/trivy/pkg/iac/providers/azure/compute
  Incompatible changes:
  - LinuxVirtualMachine.NetworkInterfaces: changed from []NetworkInterface to []github.com/aquasecurity/trivy/pkg/iac/providers/azure/network.NetworkInterface
  - NetworkInterface: removed
  - VirtualMachine.NetworkInterfaces: changed from []NetworkInterface to []github.com/aquasecurity/trivy/pkg/iac/providers/azure/network.NetworkInterface
  - WindowsVirtualMachine.NetworkInterfaces: changed from []NetworkInterface to []github.com/aquasecurity/trivy/pkg/iac/providers/azure/network.NetworkInterface

github.com/aquasecurity/trivy/pkg/iac/adapters/terraform/azure/network
  Compatible changes:
  - AdaptNetworkInterface: added

github.com/aquasecurity/trivy/pkg/iac/providers/azure/network
  Compatible changes:
  - IPConfiguration: added
  - Network.NetworkInterfaces: added
  - NetworkInterface: added
  - NetworkWatcherFlowLog.Enabled: added

@aqua-bot aqua-bot requested a review from a team November 13, 2025 10:38
PublicIPAddress: iacTypes.StringDefault("", nicID.GetMetadata()),
// EnableIPForwarding is not available from the VM's networkProfile, so it defaults to false
networkInterface := network.NetworkInterface{
Metadata: nicID.GetMetadata(),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have two options for handling the network interface in ARM:

  • Option 1:
    If you do not plan to add checks that require the presence of a network interface, for example:

    count(compute.networkinterfaces) == 0
    result.new("Compute instance must have at least one network interface", ...)

    we can simply skip adding them during parsing.

  • Option 2: Otherwise, we should create metadata via NewUnmanagedMetadata(), so that we can skip unmanaged networks in checks, for example:

    some ni in compute.networkinterfaces
    isManaged(ni)

Personally, I prefer Option 1, but I’m not sure how these interfaces will be used.

@nikpivkin nikpivkin force-pushed the reut-update-azure-network branch from 3e2c2c7 to 98fb9a1 Compare November 19, 2025 13:22
@nikpivkin nikpivkin added this pull request to the merge queue Nov 19, 2025
Merged via the queue into aquasecurity:main with commit ea2dc58 Nov 19, 2025
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

apidiff Indicates Go API changes relevant to library consumers (CLI compatibility may be unaffected)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants