fix(misconf): skip rewriting expr if attr is nil

[nikpivkin]

Description

When searching for a policy by the policy_arn attribute of a role, the following logic occurs:

• We try to evaluate policy_arn. If it is a known string, we use it directly.
• Otherwise, we attempt to find the related policy by analyzing the block referenced by policy_arn.

The problem is that the GetReferencedBlock function returns all references found in the expression. For example, in the configuration below, it may return aws_partition, which does not contain a policy attribute. Attempting to rewrite the expression on such a block leads to a panic due to the missing attribute.

This PR introduces:

• A nil check for the attribute before attempting to rewrite the expression.

• Restricts the search for referenced blocks to cases where the expression is a traversal (RelativeTraversalExpr or ScopeTraversalExpr) that directly references another block.

Example configuration:

resource "aws_iam_role" "default" {
  name = "test"
}

resource "aws_iam_role_policy_attachment" "amazon_eks_cluster_policy" {
  role       = aws_iam_role.default.name
  policy_arn = format("arn:%s:iam::aws:policy/AmazonEKSClusterPolicy", data.aws_partition.current.partition)
}

data "aws_partition" "current" {}

Related issues

• Close fix(misconf): skip rewriting expr if attr is nil #9123

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[simar7]

@nikpivkin is this ready for review? I see it's marked as draft.

[nikpivkin]

@nikpivkin is this ready for review? I see it's marked as draft.

Yes, it's ready

[simar7]

While I understand the check for nil values, but I'm curious why would they be nil in the first place?

[nikpivkin]

@aqua-bot backport release/v0.64

[aqua-bot]

Backport PR created: #9127