fix(terraform): resolve relative module paths from file directory not CWD - #7656
Open
pankhuriVarshney wants to merge 3 commits into
Open
fix(terraform): resolve relative module paths from file directory not CWD#7656pankhuriVarshney wants to merge 3 commits into
pankhuriVarshney wants to merge 3 commits into
Conversation
… CWD When Terraform files in nested directories reference local modules using relative paths (e.g. ../../../../modules/foo), Checkov was resolving these paths relative to the current working directory instead of the declaring file's directory. This caused module loading failures with FileNotFoundError when running Checkov from the repository root on monorepo structures. The fix ensures os.path.abspath() is used when computing the base directory for relative module source resolution, so the resolved path is absolute and correct regardless of where Checkov is executed from. Fixes bridgecrewio#7547
… CWD When Terraform files in nested directories reference local modules using relative paths (e.g. ../../../../modules/foo), Checkov was resolving these paths relative to the current working directory instead of the declaring file's directory. This caused module loading failures with FileNotFoundError when running Checkov from the repository root on monorepo structures. The fix ensures os.path.abspath() is used when computing the base directory for relative module source resolution, so the resolved path is absolute and correct regardless of where Checkov is executed from. Fixes bridgecrewio#7547
…tion Add tests covering GitHub issue bridgecrewio#7547: - test_relative_module_path_resolved_from_file_directory: end-to-end integration test verifying a nested stack can load a module via relative paths when parsed from the repo root - test_get_module_source_resolves_relative_path_from_cwd: direct unit test for TFParser.get_module_source() ensuring relative sources are resolved to absolute paths from the declaring file's directory
pankhuriVarshney
requested a deployment
to
scan-security
August 21, 2026 17:36 — with 
GitHub Actions
Waiting
GitHub Actions
Waiting
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Description
This PR fixes an issue where Checkov resolves relative Terraform module paths from the current working directory instead of from the directory containing the
.tffile that declares the module.In monorepo structures with nested Terraform stacks referencing modules via relative paths like
../../../../modules/cloudsql-mysql, running Checkov from the repository root causedFileNotFoundErrorbecause the relative path was being joined with the scan root directory rather than the declaring file's directory.The fix ensures
os.path.abspath()is used when computing the base directory for relative module source resolution inTFParser.get_module_source(), so the resolved path is absolute and correct regardless of where Checkov is executed from.Fixes #7547
Checklist: