Repository: aquasecurity/tfsec (go)

Issue:
Possible false positive with sensitive-in-attribute check
**Describe the bug**
When the `private_key_format` attribute is set in a `vault_pki_secret_backend_cert` resource for the Hashicorp Vault provider, the attribute is flagged as a sensitive-in-attribute finding

**To Reproduce**
```
provider "vault" {
  address = var.vault_address
  token   = var.vault_token
}

resource "vault_pki_secret_backend_cert" "server_cert" {
  backend     = var.vault_backend
  name        = var.vault_name
  common_name = var.server_name
  format = "pem"
  # this line is flagged
  private_key_format = "pkcs8"
}
```

**Expected behavior**
This shouldn't be a finding. The check refers to placing secrets in attributes whereas `private_key_format` defines the output format only.


**Additional context**
tfsec version 0.63.1


Pull request:
Remove false positive in vault pki
resolves #1219

Patch:
diff --git a/internal/app/tfsec/rules/general/secrets/sensitive_in_attribute_rule.go b/internal/app/tfsec/rules/general/secrets/sensitive_in_attribute_rule.go
index ae728acd2..a79d3d3c6 100644
--- a/internal/app/tfsec/rules/general/secrets/sensitive_in_attribute_rule.go
+++ b/internal/app/tfsec/rules/general/secrets/sensitive_in_attribute_rule.go
@@ -38,6 +38,10 @@ var sensitiveWhitelist = []struct {
 		Resource:  "google_secret_manager_secret",
 		Attribute: "secret_id",
 	},
+	{
+		Resource:  "vault_pki_secret_backend_cert",
+		Attribute: "private_key_format",
+	},
 }
 
 func init() {


Test patch:
diff --git a/internal/app/tfsec/rules/general/secrets/sensitive_in_attribute_rule_test.go b/internal/app/tfsec/rules/general/secrets/sensitive_in_attribute_rule_test.go
index 7044f0f3f..2077cbf8e 100644
--- a/internal/app/tfsec/rules/general/secrets/sensitive_in_attribute_rule_test.go
+++ b/internal/app/tfsec/rules/general/secrets/sensitive_in_attribute_rule_test.go
@@ -55,6 +55,26 @@ func Test_AWSSensitiveAttributes(t *testing.T) {
  }`,
 			mustExcludeResultCode: expectedCode,
 		},
+		{
+			name: "avoid vault pki false positive",
+			source: `
+provider "vault" {
+  address = var.vault_address
+  token   = var.vault_token
+}
+
+resource "vault_pki_secret_backend_cert" "server_cert" {
+  backend     = var.vault_backend
+  name        = var.vault_name
+  common_name = var.server_name
+  format = "pem"
+  # this line is flagged
+  private_key_format = "pkcs8"
+}
+
+            `,
+			mustExcludeResultCode: expectedCode,
+		},
 	}
 
 	for _, test := range tests {