feat(terraform): support nested HCL identifier parsing by grouping variable paths and preserving relative subpaths

[cx-artur-ribeiro]

Reason for Proposed Changes

• We identified a problem with our Terraform parser due to a false positive (FP) result on the query S3 Bucket Policy Accepts HTTP Requests, Specifically, the issue stemmed from how the parser handled variable resolution for resources like aws_cloudfront_origin_access_identity.
  In the added unit test negative8.tf,we encountered an issue where the variable identifier referencing the resource aws_cloudfront_origin_access_identity caused the parser to throw an error during variable resolution:

The parser couldn't resolve the policy on the payload, leading to the detection of a false positive:

Proposed Changes

• Manually add the missing variable to the inputVariableMap and ensure the nested path map is built correctly with the resource identifier;
• Note that when Terraform evaluates something like:
  identifiers = [aws_cloudfront_origin_access_identity.support_site_origin_access_identity.iam_arn]
  It expects an actual object with nested fields, not a string like:
  "aws_cloudfront_origin_access_identity.support_site_origin_access_identity.iam_arn"
  Otherwise, we get the "Unsupported attribute" error. Thats why the root path is removed in this case, as we can see on line 319:

Related Issues

• Decode returning errors upon decoding policy referring resources not present hashicorp/hcl#544 - 3 years ago we tried to discuss this issue with HCL but we lacked information/knowledge on how the hcl library worked. Hope this thread can provide more information that I was unable to provide above.

I submit this contribution under the Apache-2.0 license.

[github-actions]

KICS version: v2.1.6

Category Results CRITICAL 0 HIGH 0 MEDIUM 0 LOW 0 INFO 0 TRACE 0 TOTAL 0	Metric Values Files scanned 1 Files parsed 1 Files failed to scan 0 Total executed queries 47 Queries failed to execute 0 Execution time 0

[cx-rui-araujo]

@cx-artur-ribeiro please check my comment

[cx-miguel-dasilva]

LGTM 🚀