GCP-0078 triggers on code that do not declare a storage bucket

[lodig-einride]

Description

The Trivy CLI's misconfiguration scanners reports the issue GCP-0078 on Terraform code unrelated to declaring a storage bucket. The Terraform file does not declare a storage bucket itself but an IAM member on a storage bucket. GCP-0078 is not a finding applicable to IAM members.

This looks like a bug / false positive.

Desired Behavior

No found misconfigurations

Actual Behavior

Issue GCP-0078 reported by the CLI

Reproduction Steps

1. Create a new Terraform file with the following contents
resource "google_storage_bucket_iam_member" "qwe" {
  bucket = "qwe"
  role   = "roles/storage.objectViewer"
  member = "serviceAccount:qwe"
}

2. Run Trivy for a misconfiguration scan: trivy config .

3. Observe that trivy reports "GCP-0078: Storage bucket versioning is not enabled."

Target

Filesystem

Scanner

Misconfiguration

Output Format

Table

Mode

Standalone

Debug Output

❯ trivy config . --debug
2026-03-03T11:45:23+01:00       DEBUG   No plugins loaded
2026-03-03T11:45:23+01:00       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2026-03-03T11:45:23+01:00       DEBUG   Cache dir       dir="/Users/greg/Library/Caches/trivy"
2026-03-03T11:45:23+01:00       DEBUG   Cache dir       dir="/Users/greg/Library/Caches/trivy"
2026-03-03T11:45:23+01:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2026-03-03T11:45:23+01:00       DEBUG   [notification] Running version check
2026-03-03T11:45:23+01:00       INFO    [misconfig] Misconfiguration scanning is enabled
2026-03-03T11:45:23+01:00       INFO    [checks-client] Using existing checks from cache        path="/Users/greg/Library/Caches/trivy/policy/content"
2026-03-03T11:45:23+01:00       DEBUG   [misconfig] Checks successfully loaded from disk
2026-03-03T11:45:23+01:00       DEBUG   [notification] Version check completed  latest_version="0.69.2"
2026-03-03T11:45:23+01:00       DEBUG   [rego] Overriding filesystem for checks
2026-03-03T11:45:23+01:00       DEBUG   [rego] Embedded libraries are loaded    count=17
2026-03-03T11:45:23+01:00       DEBUG   [rego] Embedded checks are loaded       count=563
2026-03-03T11:45:23+01:00       DEBUG   [rego] Checks from disk are loaded      count=580
2026-03-03T11:45:23+01:00       DEBUG   [rego] Overriding filesystem for data
2026-03-03T11:45:23+01:00       DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot ansible]
2026-03-03T11:45:23+01:00       DEBUG   Initializing scan cache...      type="memory"
2026-03-03T11:45:23+01:00       DEBUG   [fs] Analyzing...       root="."
2026-03-03T11:45:23+01:00       DEBUG   Created process-specific temp directory path="/var/folders/02/s6w7nrhn6hl8_b1t1nslsfkh0000gp/T/trivy-93697"
2026-03-03T11:45:23+01:00       DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Terraform"
2026-03-03T11:45:23+01:00       DEBUG   [terraform scanner] Scanning directory  file_path="."
2026-03-03T11:45:23+01:00       DEBUG   [terraform parser] Setting project/module root  module="root" file_path="."
2026-03-03T11:45:23+01:00       DEBUG   [terraform parser] Parsing FS   module="root" file_path="."
2026-03-03T11:45:23+01:00       DEBUG   [terraform parser] Parsing      module="root" file_path="test.tf"
2026-03-03T11:45:23+01:00       DEBUG   [terraform parser] Added file   module="root" file_path="test.tf"
2026-03-03T11:45:23+01:00       INFO    [terraform scanner] Scanning root module        file_path="."
2026-03-03T11:45:23+01:00       DEBUG   [terraform parser] Setting project/module root  module="root" file_path="."
2026-03-03T11:45:23+01:00       DEBUG   [terraform parser] Parsing FS   module="root" file_path="."
2026-03-03T11:45:23+01:00       DEBUG   [terraform parser] Parsing      module="root" file_path="test.tf"
2026-03-03T11:45:23+01:00       DEBUG   [terraform parser] Added file   module="root" file_path="test.tf"
2026-03-03T11:45:23+01:00       DEBUG   [terraform parser] Loading module       module="root" module="root"
2026-03-03T11:45:23+01:00       DEBUG   [terraform parser] Read block(s) and ignore(s)  module="root" blocks=1 ignores=0
2026-03-03T11:45:23+01:00       DEBUG   [terraform parser] Added input variables from tfvars    module="root" count=0
2026-03-03T11:45:23+01:00       DEBUG   [terraform parser] Working directory for module evaluation      module="root" file_path="/tmp/test"
2026-03-03T11:45:23+01:00       DEBUG   [terraform evaluator] Starting module evaluation...     module="root" path="."
2026-03-03T11:45:23+01:00       DEBUG   [terraform evaluator] Starting iteration        module="root" iteration=0
2026-03-03T11:45:23+01:00       DEBUG   [terraform evaluator] Starting iteration        module="root" iteration=1
2026-03-03T11:45:23+01:00       DEBUG   [terraform evaluator] Context unchanged module="root" iteration=1
2026-03-03T11:45:23+01:00       DEBUG   [terraform evaluator] Starting post-submodules evaluation...    module="root"
2026-03-03T11:45:23+01:00       DEBUG   [terraform evaluator] Starting iteration        module="root" iteration=0
2026-03-03T11:45:23+01:00       DEBUG   [terraform evaluator] Starting iteration        module="root" iteration=1
2026-03-03T11:45:23+01:00       DEBUG   [terraform evaluator] Context unchanged module="root" iteration=1
2026-03-03T11:45:23+01:00       DEBUG   [terraform evaluator] Module evaluation complete.       module="root"
2026-03-03T11:45:23+01:00       DEBUG   [terraform parser] Finished parsing module      module="root"
2026-03-03T11:45:23+01:00       DEBUG   [terraform executor] Adapting modules...
2026-03-03T11:45:23+01:00       DEBUG   [terraform executor] Adapted module(s) into state data. count=1
2026-03-03T11:45:23+01:00       DEBUG   [terraform executor] Scan state data
2026-03-03T11:45:23+01:00       DEBUG   [rego] Scanning inputs  count=1
2026-03-03T11:45:23+01:00       DEBUG   [terraform executor] Finished applying checks
2026-03-03T11:45:23+01:00       DEBUG   [terraform executor] Applying ignores...
2026-03-03T11:45:23+01:00       DEBUG   [terraform executor] No matching Terraform block found  cause_range=""
2026-03-03T11:45:23+01:00       DEBUG   OS is not detected.
2026-03-03T11:45:23+01:00       INFO    Detected config files   num=2
2026-03-03T11:45:23+01:00       DEBUG   Scanned config file     file_path="."
2026-03-03T11:45:23+01:00       DEBUG   Scanned config file     file_path=""
2026-03-03T11:45:23+01:00       DEBUG   Specified ignore file does not exist    file=".trivyignore"
2026-03-03T11:45:23+01:00       DEBUG   [vex] VEX filtering is disabled

Report Summary

┌────────┬───────────┬───────────────────┐
│ Target │   Type    │ Misconfigurations │
├────────┼───────────┼───────────────────┤
│        │ terraform │         1         │
├────────┼───────────┼───────────────────┤
│ .      │ terraform │         0         │
└────────┴───────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


 (terraform)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

GCP-0078 (MEDIUM): Storage bucket versioning is not enabled.
═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Object versioning in Cloud Storage is recommended to protect against accidental or malicious deletions.


See https://avd.aquasec.com/misconfig/gcp-0078
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────


2026-03-03T11:45:23+01:00       DEBUG   Cleaning up temp directory      path="/var/folders/02/s6w7nrhn6hl8_b1t1nslsfkh0000gp/T/trivy-93697"

Operating System

macOS Tahoe 26.3, Ubuntu 24.04.3

Version

❯ trivy --version
Version: 0.69.2
Vulnerability DB:
  Version: 2
  UpdatedAt: 2026-03-03 08:28:59.854838975 +0000 UTC
  NextUpdate: 2026-03-04 08:28:59.854838615 +0000 UTC
  DownloadedAt: 2026-03-03 10:26:05.76426 +0000 UTC
Check Bundle:
  Digest: sha256:ff1f8aeb19a802446ed4125bd084f2d6f50ad6800328fee24a4bc2f5a03c23c1
  DownloadedAt: 2026-03-03 10:30:21.724697 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[nikpivkin]

Hi @lodig-einride !

Thanks for the report.

Track #10321