Repository: Checkmarx/kics (language: python)

Issue:
[Feat] Allow user to specify the directories to look for when performing IaC scanning for terraform 
Hi,

Have come across this open source solution recently that supports various vulnerability scans. 👍

**Problem Statement:**

We make use of Gitlab for our CI/CD platform. Gitlab seems to be relying on KICS for IaC scanning. At the moment, it seems there is no way for a user to specify what dirs to look in when performing IaC scanning for terraform. It will only look for files with **.tf** extension and input variables using **terraform.tfvars** or files with **.auto.tfvars** extension that are in same directory of **.tf** files

**Some context:** 
We are using terraform to manage our GCP infra. Our repository structure is below
```
.
├── README.md
├── generator.py
├── modules
│   ├── main.tf
│   ├── outputs.tf
│   └── variables.tf
├── pipeline.py
├── projects
│   ├── prj_crh_cep_npd_yls_eng_amer
│   │   ├── ansible.tfvars
│   │   ├── bastion.tfvars
│   │   ├── bigtable.tfvars
│   │   ├── buckets.tfvars
│   │   ├── cloud_sql.tfvars
│   │   ├── composer.tfvars
│   │   ├── engvm.tfvars
│   │   ├── gke.tfvars
│   │   ├── kafka_bk_dev.tfvars
│   │   ├── kafka_zk_dev.tfvars
│   │   ├── terragrunt.hcl
│   │   └── vars.hcl
│   ├── prj_crh_cep_npd_yls_imp_amer
│   │   ├── ansible.tfvars
│   │   ├── bastion.tfvars
│   │   ├── bigtable.tfvars
│   │   ├── buckets.tfvars
│   │   ├── cloud_sql.tfvars
│   │   ├── composer.tfvars
│   │   ├── engvm.tfvars
│   │   ├── gke.tfvars
│   │   ├── kafka_bk_dev.tfvars
│   │   ├── kafka_zk_dev.tfvars
│   │   ├── terragrunt.hcl
│   │   └── vars.hcl
│   └── prj_crh_cep_shd_yls_ops_glbl
│       ├── buckets.tfvars
│       ├── gke.tfvars
│       ├── terragrunt.hcl
│       └── vars.hcl
└── terragrunt.hcl

5 directories, 35 files
```

In a nutshell, `modules` dir would have nothing but few lines of code in `main.tf` file that calls the root modules from an other gitlab project, empty default variables in `variables.tf` file and outputs blocks in `outputs.tf`. There is no use of scanning those files as they have no actual code or variables. 

The way it is now, KICS is only raising flags from those `*.tf` files and not very helpful in terms of validation as it display's vulnerabilities like `Output Without Description`, `Variable Without Type` by only looking at `*.tf` files in `modules` dir which would not have the actual user input vars.


**My expectation:**

`*.tfvars` in other directories would contain the actual variables that we feed to modules in `modules/main.tf`. I expected KICS to scan the user input variables we pass through the `*.tfvars` files and raise flags if there are any over permissive roles that are being granted to a user/group or using a default service account which has `Editor` access on a `Google Cloud Platform` project for example or something of this sort.



Discussion / hints:
Hello, @gopipara!

Thank you so much for raising this question! We are looking into it!

Can you provide us with your project for testing purposes, please? You can send it to our private email [kics@checkmarx.com](mailto:kics@checkmarx.com)
I have sent a sample project via email to your core team.

**Just a bit more detail about the project i sent via email:**

Once you unzip the attached file you should see modules and projects dirs. modules dir contains `main/variables/outputs.tf` files. 

Each module in `main.tf` file will refer to a remote location where the source code for the module is located, this way we can keep our parent modules centralized and use them as necessary.

`outputs.tf` file will show the outputs from the modules in `main.tf` which in turn will return from parent modules output as each module itself is referring to parent module in remote location.

variable values in `variables.tf` will be empty by default. we will pass the variable input from `*.tfvars` files in `projects/project` dir

So, technically when we run KICS scan pointing it to a root dir it will only find `*.tf` files wherever they are in the dir tree (this is actually good for us because as part of initialization, terraform will download the parent modules into the current dir tree) and analyzes the source code. 

Scanning those files without taking the `*.tfvars` in the `projects/project` dir into account will produce false positives as the attributes in the source code may be optional and we set it to `null` if it is not defined in the `*.tfvars`. 

For example KICS scan produced a Medium level vulnerability saying below
<img width="931" alt="Screen Shot 2022-06-04 at 5 55 20 PM" src="https://user-images.githubusercontent.com/14302157/172026898-1030613b-d28b-4f37-b1d5-bf5f2aa47f54.png">

the above points at below
<img width="876" alt="Screen Shot 2022-06-04 at 5 55 08 PM" src="https://user-images.githubusercontent.com/14302157/172026902-6f768191-7eb9-44db-8cd1-9c5fcce68f03.png">

but in reality, we have defined the service account through a variable in `*.tfvars` file and are passing it to `terraform` commands.
 
As of now, there seems no way to specify extra locations where the `*.tfvars` files are located. My expectation is KICS would let me provide the `*.tfvars` dir path and let it warn based on the user input; like (if any over permissive roles are being granted, any plain text passwords etc.. for example).

**Below is an other example just in case:**
KICS scan produced below High vulnerability 
<img width="1021" alt="Screen Shot 2022-06-04 at 6 15 34 PM" src="https://user-images.githubusercontent.com/14302157/172027101-abe0d5c2-0629-40e7-87c4-fbecb3f74b16.png">

But in reality, we have `logging` attribute present in the resource but it is dynamic and we enable it through the variable passed via *.tfvars` file.


Hope this helps.
Hello, @gopipara!

Thank you so much for sending the project and for the detailed explanation!

We will discuss internally this feature as soon as possible! Thank you so much for suggesting it 🚀 

Fix patch:
diff --git a/internal/console/assets/scan-flags.json b/internal/console/assets/scan-flags.json
index bb6b4581780..34aa8ae0ff9 100644
--- a/internal/console/assets/scan-flags.json
+++ b/internal/console/assets/scan-flags.json
@@ -184,6 +184,12 @@
     "usage": "case insensitive list of platform types not to scan\n(${supportedPlatforms})\ncannot be provided with type inclusion flags",
     "validation": "validateMultiStrEnum"
   },
+  "terraform-vars-path": {
+    "flagType": "str",
+    "shorthandFlag": "",
+    "defaultValue": "",
+    "usage": "path where terraform variables are present"
+  },
   "exclude-gitignore": {
     "flagType": "bool",
     "shorthandFlag": "",
diff --git a/internal/console/flags/scan_flags.go b/internal/console/flags/scan_flags.go
index b282072a709..d994d9f3bea 100644
--- a/internal/console/flags/scan_flags.go
+++ b/internal/console/flags/scan_flags.go
@@ -27,6 +27,7 @@ const (
 	ReportFormatsFlag      = "report-formats"
 	TypeFlag               = "type"
 	ExcludeTypeFlag        = "exclude-type"
+	TerraformVarsPathFlag  = "terraform-vars-path"
 	QueryExecTimeoutFlag   = "timeout"
 	LineInfoPayloadFlag    = "payload-lines"
 	DisableSecretsFlag     = "disable-secrets"
diff --git a/internal/console/scan.go b/internal/console/scan.go
index cdd4d7d61c3..df5ed692f7b 100644
--- a/internal/console/scan.go
+++ b/internal/console/scan.go
@@ -128,6 +128,7 @@ func getScanParameters(changedDefaultQueryPath, changedDefaultLibrariesPath bool
 		ReportFormats:               flags.GetMultiStrFlag(flags.ReportFormatsFlag),
 		Platform:                    flags.GetMultiStrFlag(flags.TypeFlag),
 		ExcludePlatform:             flags.GetMultiStrFlag(flags.ExcludeTypeFlag),
+		TerraformVarsPath:           flags.GetStrFlag(flags.TerraformVarsPathFlag),
 		QueryExecTimeout:            flags.GetIntFlag(flags.QueryExecTimeoutFlag),
 		LineInfoPayload:             flags.GetBoolFlag(flags.LineInfoPayloadFlag),
 		DisableSecrets:              flags.GetBoolFlag(flags.DisableSecretsFlag),
diff --git a/pkg/parser/terraform/terraform.go b/pkg/parser/terraform/terraform.go
index a2d012c3d7e..136f6db1382 100644
--- a/pkg/parser/terraform/terraform.go
+++ b/pkg/parser/terraform/terraform.go
@@ -24,8 +24,9 @@ type Converter func(file *hcl.File, inputVariables converter.VariableMap) (model
 
 // Parser struct that contains the function to parse file and the number of retries if something goes wrong
 type Parser struct {
-	convertFunc  Converter
-	numOfRetries int
+	convertFunc       Converter
+	numOfRetries      int
+	terraformVarsPath string
 }
 
 // NewDefault initializes a parser with Parser default values
@@ -36,9 +37,16 @@ func NewDefault() *Parser {
 	}
 }
 
+// NewDefaultWithVarsPath initializes a parser with the default values using a variables path
+func NewDefaultWithVarsPath(terraformVarsPath string) *Parser {
+	parser := NewDefault()
+	parser.terraformVarsPath = terraformVarsPath
+	return parser
+}
+
 // Resolve - replace or modifies in-memory content before parsing
 func (p *Parser) Resolve(fileContent []byte, filename string) ([]byte, error) {
-	getInputVariables(filepath.Dir(filename))
+	getInputVariables(filepath.Dir(filename), string(fileContent), p.terraformVarsPath)
 	getDataSourcePolicy(filepath.Dir(filename))
 	return fileContent, nil
 }
diff --git a/pkg/parser/terraform/variables.go b/pkg/parser/terraform/variables.go
index f903e691984..b3ae14d64ff 100644
--- a/pkg/parser/terraform/variables.go
+++ b/pkg/parser/terraform/variables.go
@@ -4,6 +4,8 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"regexp"
+	"strings"
 
 	"github.com/Checkmarx/kics/pkg/parser/terraform/converter"
 	"github.com/hashicorp/hcl/v2"
@@ -85,7 +87,7 @@ func getInputVariablesFromFile(filename string) (converter.VariableMap, error) {
 	return variables, nil
 }
 
-func getInputVariables(currentPath string) {
+func getInputVariables(currentPath, fileContent, terraformVarsPath string) {
 	variablesMap := make(converter.VariableMap)
 	tfFiles, err := filepath.Glob(filepath.Join(currentPath, "*.tf"))
 	if err != nil {
@@ -115,12 +117,44 @@ func getInputVariables(currentPath string) {
 	for _, tfVarsFile := range tfVarsFiles {
 		variables, errInputVariables := getInputVariablesFromFile(tfVarsFile)
 		if errInputVariables != nil {
-			log.Error().Msgf("Error getting values from %s", tfVarsFiles)
+			log.Error().Msgf("Error getting values from %s", tfVarsFile)
 			log.Err(errInputVariables)
 			continue
 		}
 		mergeMaps(variablesMap, variables)
 	}
 
+	// If the flag is empty let's look for the value in the first written line of the file
+	if terraformVarsPath == "" {
+		terraformVarsPathRegex := regexp.MustCompile(`(?m)^\s*// kics_terraform_vars: ([\w/\\.:-]+)\r?\n`)
+		terraformVarsPathMatch := terraformVarsPathRegex.FindStringSubmatch(fileContent)
+		if terraformVarsPathMatch != nil {
+			// There is a path tp the variables file in the file so that will be the path to the variables tf file
+			terraformVarsPath = terraformVarsPathMatch[1]
+			// If the path contains ":" assume its a global path
+			if !strings.Contains(terraformVarsPath, ":") {
+				// If not then add the current folder path before so that the comment path can be relative
+				terraformVarsPath = filepath.Join(currentPath, terraformVarsPath)
+			}
+		}
+	}
+
+	// If the terraformVarsPath is empty, this means that it is not in the flag
+	// and it is not in the first written line of the file
+	if terraformVarsPath != "" {
+		_, err = os.Stat(terraformVarsPath)
+		if err != nil {
+			log.Trace().Msgf("%s file not found", terraformVarsPath)
+		} else {
+			variables, errInputVariables := getInputVariablesFromFile(terraformVarsPath)
+			if errInputVariables != nil {
+				log.Error().Msgf("Error getting values from %s", terraformVarsPath)
+				log.Err(errInputVariables)
+			} else {
+				mergeMaps(variablesMap, variables)
+			}
+		}
+	}
+
 	inputVariableMap["var"] = cty.ObjectVal(variablesMap)
 }
diff --git a/pkg/scan/client.go b/pkg/scan/client.go
index 18af39ae1bd..b2065b571be 100644
--- a/pkg/scan/client.go
+++ b/pkg/scan/client.go
@@ -33,6 +33,7 @@ type Parameters struct {
 	ReportFormats               []string
 	Platform                    []string
 	ExcludePlatform             []string
+	TerraformVarsPath           string
 	QueryExecTimeout            int
 	LineInfoPayload             bool
 	DisableSecrets              bool
diff --git a/pkg/scan/scan.go b/pkg/scan/scan.go
index 0601c3349f4..6a3ff3dde7a 100644
--- a/pkg/scan/scan.go
+++ b/pkg/scan/scan.go
@@ -222,7 +222,7 @@ func (c *Client) createService(
 	combinedParser, err := parser.NewBuilder().
 		Add(&jsonParser.Parser{}).
 		Add(&yamlParser.Parser{}).
-		Add(terraformParser.NewDefault()).
+		Add(terraformParser.NewDefaultWithVarsPath(c.ScanParams.TerraformVarsPath)).
 		Add(&dockerParser.Parser{}).
 		Add(&protoParser.Parser{}).
 		Add(&buildahParser.Parser{}).


Test patch:
diff --git a/e2e/fixtures/E2E_CLI_062_PAYLOAD.json b/e2e/fixtures/E2E_CLI_062_PAYLOAD.json
new file mode 100644
index 00000000000..a18f6cab76c
--- /dev/null
+++ b/e2e/fixtures/E2E_CLI_062_PAYLOAD.json
@@ -0,0 +1,17 @@
+{
+	"document": [
+		{
+			"id": "0",
+			"resource": {
+				"test": {
+					"test1": {
+						"test_map": {
+							"map3Key1": "givenByVar"
+						}
+					}
+				}
+			},
+			"file": "file"
+		}
+	]
+}
diff --git a/e2e/fixtures/E2E_CLI_063_PAYLOAD.json b/e2e/fixtures/E2E_CLI_063_PAYLOAD.json
new file mode 100644
index 00000000000..a18f6cab76c
--- /dev/null
+++ b/e2e/fixtures/E2E_CLI_063_PAYLOAD.json
@@ -0,0 +1,17 @@
+{
+	"document": [
+		{
+			"id": "0",
+			"resource": {
+				"test": {
+					"test1": {
+						"test_map": {
+							"map3Key1": "givenByVar"
+						}
+					}
+				}
+			},
+			"file": "file"
+		}
+	]
+}
diff --git a/e2e/fixtures/assets/scan_help b/e2e/fixtures/assets/scan_help
index 67f307451a2..44a266fcb54 100644
--- a/e2e/fixtures/assets/scan_help
+++ b/e2e/fixtures/assets/scan_help
@@ -53,6 +53,7 @@ Flags:
   -q, --queries-path strings          paths to directory with queries (default [./assets/queries])
       --report-formats strings        formats in which the results will be exported (all, asff, codeclimate, csv, cyclonedx, glsast, html, json, junit, pdf, sarif, sonarqube) (default [json])
   -r, --secrets-regexes-path string   path to secrets regex rules configuration file
+      --terraform-vars-path string    path where terraform variables are present
       --timeout int                   number of seconds the query has to execute before being canceled (default 60)
   -t, --type strings                  case insensitive list of platform types to scan
                                       (Ansible, AzureResourceManager, Buildah, CloudFormation, Crossplane, DockerCompose, Dockerfile, GRPC, GoogleDeploymentManager, Knative, Kubernetes, OpenAPI, Pulumi, ServerlessFW, Terraform)
diff --git a/e2e/fixtures/samples/terraform-vars-path/terraform-vars.tfvars b/e2e/fixtures/samples/terraform-vars-path/terraform-vars.tfvars
new file mode 100644
index 00000000000..045dddb7bb3
--- /dev/null
+++ b/e2e/fixtures/samples/terraform-vars-path/terraform-vars.tfvars
@@ -0,0 +1,3 @@
+map3 = {
+  map3Key1 = "givenByVar"
+}
diff --git a/e2e/fixtures/samples/terraform-vars-path/tfFiles/terraform-vars-path.tf b/e2e/fixtures/samples/terraform-vars-path/tfFiles/terraform-vars-path.tf
new file mode 100644
index 00000000000..fb56249e701
--- /dev/null
+++ b/e2e/fixtures/samples/terraform-vars-path/tfFiles/terraform-vars-path.tf
@@ -0,0 +1,5 @@
+// kics_terraform_vars: ../terraform-vars.tfvars
+
+resource "test" "test1" {
+  test_map        = var.map3
+}
\ No newline at end of file
diff --git a/e2e/testcases/e2e-cli-062_tf_variables_comment_path.go b/e2e/testcases/e2e-cli-062_tf_variables_comment_path.go
new file mode 100644
index 00000000000..524febbef5f
--- /dev/null
+++ b/e2e/testcases/e2e-cli-062_tf_variables_comment_path.go
@@ -0,0 +1,22 @@
+// Package testcases provides end-to-end (E2E) testing functionality for the application.
+package testcases
+
+// E2E-CLI-062 - KICS  scan and get the variables using a variables path as a comment
+// should perform the scan successfully and return exit code 0
+func init() { //nolint
+	testSample := TestCase{
+		Name: "should perform a valid scan and get the variables using a variables path as a comment [E2E-CLI-062]",
+		Args: args{
+			Args: []cmdArgs{
+				[]string{"scan", "-p", "\"/path/e2e/fixtures/samples/terraform-vars-path/tfFiles\"",
+					"--silent", "--payload-path", "/path/e2e/output/E2E_CLI_062_PAYLOAD.json"},
+			},
+			ExpectedPayload: []string{
+				"E2E_CLI_062_PAYLOAD.json",
+			},
+		},
+		WantStatus: []int{0},
+	}
+
+	Tests = append(Tests, testSample)
+}
diff --git a/e2e/testcases/e2e-cli-063_tf_variables_flag_path.go b/e2e/testcases/e2e-cli-063_tf_variables_flag_path.go
new file mode 100644
index 00000000000..65ddf4388f4
--- /dev/null
+++ b/e2e/testcases/e2e-cli-063_tf_variables_flag_path.go
@@ -0,0 +1,23 @@
+// Package testcases provides end-to-end (E2E) testing functionality for the application.
+package testcases
+
+// E2E-CLI-063 - KICS  scan and get the variables using a variables path as a flag
+// should perform the scan successfully and return exit code 0
+func init() { //nolint
+	testSample := TestCase{
+		Name: "should perform a valid scan and get the variables using a variables path as a flag [E2E-CLI-063]",
+		Args: args{
+			Args: []cmdArgs{
+				[]string{"scan", "-p", "\"/path/e2e/fixtures/samples/terraform-vars-path/tfFiles\"",
+					"--silent", "--payload-path", "/path/e2e/output/E2E_CLI_063_PAYLOAD.json",
+					"--terraform-vars-path", "/path/e2e/fixtures/samples/terraform-vars-path/terraform-vars.tfvars"},
+			},
+			ExpectedPayload: []string{
+				"E2E_CLI_063_PAYLOAD.json",
+			},
+		},
+		WantStatus: []int{0},
+	}
+
+	Tests = append(Tests, testSample)
+}
diff --git a/pkg/parser/terraform/terraform_test.go b/pkg/parser/terraform/terraform_test.go
index 20dc285dc0b..1d0512b5a82 100644
--- a/pkg/parser/terraform/terraform_test.go
+++ b/pkg/parser/terraform/terraform_test.go
@@ -118,7 +118,7 @@ func Test_Count(t *testing.T) {
 // Test_Parentheses_Expr tests if parentheses expr is well parsed
 func Test_Parentheses_Expr(t *testing.T) {
 	parser := NewDefault()
-	getInputVariables(filepath.FromSlash("../../../test/fixtures/test-tf-parentheses"))
+	getInputVariables(filepath.FromSlash("../../../test/fixtures/test-tf-parentheses"), parentheses, "")
 	document, _, err := parser.Parse("parentheses.tf", []byte(parentheses))
 	require.NoError(t, err)
 	require.Len(t, document, 1)
@@ -263,7 +263,7 @@ resource "test" "test1" {
   test_map        = var.map2
   test_bool       = var.test1
   test_list       = var.test2
-  test_neted_map  = var.map2[var.map1["map1key1"]]]
+  test_neted_map  = var.map2[var.map1["map1key1"]]
 
   test_block {
     terraform_var = var.test_terraform
diff --git a/pkg/parser/terraform/variables_test.go b/pkg/parser/terraform/variables_test.go
index 5cb686b7eaa..e9c860ebe6e 100644
--- a/pkg/parser/terraform/variables_test.go
+++ b/pkg/parser/terraform/variables_test.go
@@ -1,6 +1,7 @@
 package terraform
 
 import (
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -170,6 +171,9 @@ func TestGetInputVariables(t *testing.T) {
 					"map2": cty.ObjectVal(map[string]cty.Value{
 						"map2Key1": cty.StringVal("nestedMap"),
 					}),
+					"map3": cty.ObjectVal(map[string]cty.Value{
+						"map3Key1": cty.StringVal("givenByVar"),
+					}),
 					"test_terraform":    cty.StringVal("terraform.tfvars"),
 					"default_var_file":  cty.StringVal("default_var_file"),
 					"local_default_var": cty.StringVal("local_default"),
@@ -177,11 +181,24 @@ func TestGetInputVariables(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		{
+			name:     "Should load input variables",
+			filename: filepath.FromSlash("../../../test/fixtures/test_terraform_variables/test_variables_comment_path.tf"),
+			want: converter.VariableMap{
+				"var": cty.ObjectVal(map[string]cty.Value{
+					"map3": cty.ObjectVal(map[string]cty.Value{
+						"map3Key1": cty.StringVal("givenByVar"),
+					}),
+				}),
+			},
+			wantErr: false,
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			getInputVariables(tt.filename)
+			fileContent, _ := os.ReadFile(tt.filename)
+			getInputVariables(tt.filename, string(fileContent), "../../../test/fixtures/test_terraform_variables/varsToUse/varsToUse.tf")
 			require.Equal(t, tt.want, inputVariableMap)
 		})
 	}
diff --git a/test/fixtures/test_terraform_variables/test.tf b/test/fixtures/test_terraform_variables/test.tf
index fe06f956b39..ff033d8cf3b 100644
--- a/test/fixtures/test_terraform_variables/test.tf
+++ b/test/fixtures/test_terraform_variables/test.tf
@@ -15,7 +15,7 @@ resource "test" "test1" {
   test_map        = var.map2
   test_bool       = var.test1
   test_list       = var.test2
-  test_neted_map  = var.map2[var.map1["map1key1"]]]
+  test_neted_map  = var.map2[var.map1["map1key1"]]
 
   test_block {
     terraform_var = var.test_terraform
diff --git a/test/fixtures/test_terraform_variables/test_variables_comment_path.tf b/test/fixtures/test_terraform_variables/test_variables_comment_path.tf
new file mode 100644
index 00000000000..efd9d23a95e
--- /dev/null
+++ b/test/fixtures/test_terraform_variables/test_variables_comment_path.tf
@@ -0,0 +1,15 @@
+// kics_terraform_vars: varsToUse\\varsToUse.tf
+
+resource "test" "test1" {
+  test_map        = var.map2
+  test_bool       = var.test1
+  test_list       = var.test2
+  test_neted_map  = var.map2[var.map1["map1key1"]]
+
+  test_block {
+    terraform_var = var.test_terraform
+  }
+
+  test_default_local = var.local_default_var
+  test_default       = var.default_var
+}
\ No newline at end of file
diff --git a/test/fixtures/test_terraform_variables/test_without_variables_block.tf b/test/fixtures/test_terraform_variables/test_without_variables_block.tf
index 98691057260..995d487aad9 100644
--- a/test/fixtures/test_terraform_variables/test_without_variables_block.tf
+++ b/test/fixtures/test_terraform_variables/test_without_variables_block.tf
@@ -2,7 +2,7 @@ resource "test" "test1" {
   test_map        = var.map2
   test_bool       = var.test1
   test_list       = var.test2
-  test_neted_map  = var.map2[var.map1["map1key1"]]]
+  test_neted_map  = var.map2[var.map1["map1key1"]]
 
   test_block {
     terraform_var = var.test_terraform
diff --git a/test/fixtures/test_terraform_variables/varsToUse/varsToUse.tf b/test/fixtures/test_terraform_variables/varsToUse/varsToUse.tf
new file mode 100644
index 00000000000..045dddb7bb3
--- /dev/null
+++ b/test/fixtures/test_terraform_variables/varsToUse/varsToUse.tf
@@ -0,0 +1,3 @@
+map3 = {
+  map3Key1 = "givenByVar"
+}