Trivy get a parsing error when scanning a terraform plan json file for certain resources

[andrea-migliaccio]

Description

I'm trying to scan a terraform project that reference a certain type of data structure. Here an example

2026-03-18T16:20:30Z ERROR [terraform parser] Error parsing file module="root" file_path="main.tf" cause=" map[string]interface {}{"drain_timeout_in_minutes":0, "max_surge":"10%", "node_soak_duration_in_minutes":0}," err="main.tf:333,18-27: Missing item separator; Expected a comma to mark the beginning of the next item."

The original HCL being tf-planned is, where the "upgrade_settings" property is defined:

  default_node_pool {

    name    = var.node_pool_name
    vm_size = var.vm_size

    os_disk_size_gb             = var.os_disk_size_gb
    os_disk_type                = var.os_disk_type
    max_pods                    = var.max_pods
    os_sku                      = var.os_sku
    type                        = var.node_pool_type
    auto_scaling_enabled        = true
    min_count                   = var.node_count
    max_count                   = var.max_count
    vnet_subnet_id              = module.subnet.subnetId
    orchestrator_version        = var.kubernetes_version
    temporary_name_for_rotation = var.temporary_name_for_rotation
    only_critical_addons_enabled = var.only_critical_addons_enabled
    zones                       = (var.tags_env == "development") ? [] : var.zones
    upgrade_settings {
      drain_timeout_in_minutes      = 0
      max_surge                     = "10%"
      node_soak_duration_in_minutes = 0
    }
  }```

### Desired Behavior

The plan.json files has been produced by tf right before running trivy from an actual planout and a scan should be feasible.

### Actual Behavior

A parsing error is returned and no scan is actually performed.

### Reproduction Steps

```bash
As shown, the offending resource is a node_pool if an azure kubernetes service resource. The most straighforward way is building a small tf project for this kind of resource.

Please notice that, in my case, the offending resource is not in the main.tf file of my project but in a git-referenced terraform module (in THAT main.tf module I find the offending data structure).

Target

None

Scanner

Misconfiguration

Output Format

Table

Mode

Standalone

Debug Output

-----Trivy-Scan-Terraform-Plan -----------------------------------------------------
2026-03-19T08:46:32Z	DEBUG	No plugins loaded
2026-03-19T08:46:32Z	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2026-03-19T08:46:32Z	DEBUG	Cache dir	dir="/home/AzDevOps/.cache/trivy"
2026-03-19T08:46:32Z	DEBUG	Cache dir	dir="/home/AzDevOps/.cache/trivy"
2026-03-19T08:46:32Z	DEBUG	Parsed severities	severities=[HIGH CRITICAL]
2026-03-19T08:46:32Z	DEBUG	[notification] Running version check
2026-03-19T08:46:32Z	INFO	[misconfig] Misconfiguration scanning is enabled
2026-03-19T08:46:32Z	DEBUG	[checks-client] Failed to open the check metadata	err="open /home/AzDevOps/.cache/trivy/policy/metadata.json: no such file or directory"
2026-03-19T08:46:32Z	DEBUG	[checks-client] Cache does not exist, will be created
2026-03-19T08:46:32Z	INFO	[checks-client] Need to update the checks bundle
2026-03-19T08:46:32Z	INFO	[checks-client] Downloading the checks bundle...
2026-03-19T08:46:32Z	DEBUG	[checks-client] Initializing OCI checks bundle artifact	repository="mirror.gcr.io/aquasec/trivy-checks:2"
2026-03-19T08:46:32Z	DEBUG	[notification] Version check completed	latest_version="0.69.3"
2026-03-19T08:46:32Z	DEBUG	Created process-specific temp directory	path="/tmp/trivy-5913"
234.65 KiB / 234.65 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2026-03-19T08:46:32Z	DEBUG	[checks-client] Built-in checks	digest="sha256:1583562f8b90ed2a071b99f0e5ffff6b57e4ceb6ca3e4796577b4e6a339eb74c" major_version=2
2026-03-19T08:46:32Z	DEBUG	[misconfig] Checks successfully loaded from disk
2026-03-19T08:46:33Z	DEBUG	[rego] Overriding filesystem for checks
2026-03-19T08:46:33Z	DEBUG	[rego] Embedded libraries are loaded	count=17
2026-03-19T08:46:33Z	DEBUG	[rego] Embedded checks are loaded	count=563
2026-03-19T08:46:33Z	DEBUG	[rego] Checks from disk are loaded	count=580
2026-03-19T08:46:33Z	DEBUG	[rego] Overriding filesystem for data
2026-03-19T08:46:33Z	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot ansible]
2026-03-19T08:46:33Z	DEBUG	Initializing scan cache...	type="memory"
2026-03-19T08:46:33Z	DEBUG	[fs] Analyzing...	root="plan.json"
2026-03-19T08:46:33Z	DEBUG	[fs] Random cache key will be used	err="failed to open git repository: stat /mnt/vss/_work/1/s/UAT/plan.json/.git: not a directory"
2026-03-19T08:46:33Z	DEBUG	[misconfig] Scanning files for misconfigurations...	scanner="Terraform Plan JSON"
2026-03-19T08:46:33Z	DEBUG	[tfjson scanner] Scanning file	file_path="plan.json"
2026-03-19T08:46:33Z	DEBUG	[terraform scanner] Scanning directory	file_path="."
2026-03-19T08:46:33Z	DEBUG	[terraform parser] Setting project/module root	module="root" file_path="."
2026-03-19T08:46:33Z	DEBUG	[terraform parser] Parsing FS	module="root" file_path="."
2026-03-19T08:46:33Z	DEBUG	[terraform parser] Parsing	module="root" file_path="main.tf"
2026-03-19T08:46:33Z	ERROR	[terraform parser] Error parsing file	module="root" file_path="main.tf" cause="      map[string]interface {}{\"drain_timeout_in_minutes\":0, \"max_surge\":\"10%\", \"node_soak_duration_in_minutes\":0}," err="main.tf:333,18-27: Missing item separator; Expected a comma to mark the beginning of the next item."
2026-03-19T08:46:33Z	INFO	[terraform scanner] Scanning root module	file_path="."
2026-03-19T08:46:33Z	DEBUG	[terraform parser] Setting project/module root	module="root" file_path="."
2026-03-19T08:46:33Z	DEBUG	[terraform parser] Parsing FS	module="root" file_path="."
2026-03-19T08:46:33Z	DEBUG	[terraform parser] Parsing	module="root" file_path="main.tf"
2026-03-19T08:46:33Z	ERROR	[terraform parser] Error parsing file	module="root" file_path="main.tf" cause="      map[string]interface {}{\"drain_timeout_in_minutes\":0, \"max_surge\":\"10%\", \"node_soak_duration_in_minutes\":0}," err="main.tf:333,18-27: Missing item separator; Expected a comma to mark the beginning of the next item."
2026-03-19T08:46:33Z	DEBUG	[terraform parser] Loading module	module="root" module="root"
2026-03-19T08:46:33Z	INFO	[terraform parser] No files found, nothing to do.	module="root"
2026-03-19T08:46:33Z	DEBUG	[terraform executor] Adapting modules...
2026-03-19T08:46:33Z	DEBUG	[terraform executor] Adapted module(s) into state data.	count=0
2026-03-19T08:46:33Z	DEBUG	[terraform executor] Scan state data
2026-03-19T08:46:33Z	DEBUG	[rego] Scanning inputs	count=1
2026-03-19T08:46:33Z	DEBUG	[terraform executor] Finished applying checks
2026-03-19T08:46:33Z	DEBUG	[terraform executor] Applying ignores...
2026-03-19T08:46:33Z	DEBUG	[misconfig] Scanning files for misconfigurations...	scanner="Ansible"
2026-03-19T08:46:33Z	DEBUG	OS is not detected.
2026-03-19T08:46:33Z	INFO	Detected config files	num=1
2026-03-19T08:46:33Z	DEBUG	Scanned config file	file_path="."
2026-03-19T08:46:33Z	DEBUG	Specified ignore file does not exist	file=".trivyignore"
2026-03-19T08:46:33Z	DEBUG	[vex] VEX filtering is disabled
2026-03-19T08:46:33Z	DEBUG	Cleaning up temp directory	path="/tmp/trivy-5913"

Operating System

Ubuntu Linux 2024.04

Version

Version: 0.69.3
Vulnerability DB:
  Version: 2
  UpdatedAt: 2026-03-18 12:44:09.244343062 +0000 UTC
  NextUpdate: 2026-03-19 12:44:09.244342802 +0000 UTC
  DownloadedAt: 2026-03-18 13:35:56.885075929 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2023-09-28 00:59:05.752754748 +0000 UTC
  NextUpdate: 2023-10-01 00:59:05.752754248 +0000 UTC
  DownloadedAt: 2023-09-28 11:53:40.661842753 +0000 UTC
Check Bundle:
  Digest: sha256:1583562f8b90ed2a071b99f0e5ffff6b57e4ceb6ca3e4796577b4e6a339eb74c
  DownloadedAt: 2026-03-17 15:37:41.411208297 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting