fix(terraform): resolve module output edges by identity, not path alone

checkov/terraform/graph_builder/local_graph.py

@@ -845,8 +845,7 @@ def _should_add_edge(self, vertex: TerraformBlock, dest_module_path: str, module
         return (self.get_dirname(vertex.path) == dest_module_path) and \
             (
                 vertex.source_module_object == module_node.source_module_object  # The vertex is in the same file
-                or self.get_abspath(vertex.source_module_object.path)
-                == self.get_abspath(module_node.path)  # The vertex is in the correct dependency path)
+                or vertex.source_module_object == get_vertex_as_tf_module(module_node)  # The vertex belongs to this specific module instance
         )
 
     def _build_virtual_resources_edges(self, origin_node_index: int, vertex: TerraformBlock) -> None:

tests/terraform/graph/graph_builder/test_local_graph.py

@@ -434,3 +434,30 @@ def test_variables_same_name_different_modules(self):
         # Check they point to 2 different modules
         self.assertEqual(2, len(module_variable_edges))
         self.assertNotEqual(local_graph.vertices[module_variable_edges[0].origin], local_graph.vertices[module_variable_edges[1].origin])
+
+    def test_module_output_edge_with_same_source_siblings(self):
+        resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/modules/same_source_module_edge'))
+        hcl_config_parser = TFParser()
+        module, _ = hcl_config_parser.parse_hcl_module(resources_dir, self.source)
+        local_graph = TerraformLocalGraph(module)
+        local_graph.build_graph(render_variables=True)
+
+        # Find the azurerm_storage_account.sa vertex (inside module "c")
+        sa_vertices = [
+            v for v in local_graph.vertices
+            if v.block_type == BlockType.RESOURCE
+            and v.name == "azurerm_storage_account.sa"
+        ]
+        self.assertEqual(1, len(sa_vertices))
+        sa_vertex = sa_vertices[0]
+
+        # The key assertion: var.default_action must have been resolved to "Deny"
+        # Without the fix, the edge connects to module "a"'s output (wrong module),
+        # corrupting variable resolution and leaving "var.default_action" unresolved.
+        network_rules = sa_vertex.config.get("azurerm_storage_account", {}).get("sa", {}).get("network_rules", {})
+        if isinstance(network_rules, list):
+            network_rules = network_rules[0]
+        default_action = network_rules.get("default_action", [None])
+        if isinstance(default_action, list):
+            default_action = default_action[0]
+        self.assertEqual("Deny", default_action)

tests/terraform/graph/resources/modules/same_source_module_edge/main.tf

@@ -0,0 +1,16 @@
+module "b" {
+  source = "./mod_a"
+}
+
+module "a" {
+  source = "./mod_a"
+  result = module.b.result
+}
+
+module "c" {
+  source = "./mod_c"
+
+  default_action = "Deny"
+
+  ref = module.b.result.some_attr
+}

tests/terraform/graph/resources/modules/same_source_module_edge/mod_a/main.tf

@@ -0,0 +1,7 @@
+variable "result" {
+  default = null
+}
+
+output "result" {
+  value = var.result
+}

tests/terraform/graph/resources/modules/same_source_module_edge/mod_c/main.tf

@@ -0,0 +1,14 @@
+variable "default_action" {
+  type    = string
+  default = "Deny"
+}
+
+variable "ref" {
+  default = null
+}
+
+resource "azurerm_storage_account" "sa" {
+  network_rules {
+    default_action = var.default_action
+  }
+}