mirror of
https://github.com/aquasecurity/trivy.git
synced 2025-12-05 20:40:16 -08:00
docs(misconf): Remove duplicate sections (#9819)
This commit is contained in:
@@ -343,127 +343,3 @@ You can use wildcards in the `ws` (workspace) and `ignore` sections of the ignor
|
||||
```
|
||||
|
||||
This example ignores all checks starting with `aws-s3-` for workspaces matching the pattern `dev-*`.
|
||||
|
||||
### Expiration Date
|
||||
|
||||
You can specify the expiration date of the ignore rule in `yyyy-mm-dd` format. This is a useful feature when you want to make sure that an ignored issue is not forgotten and worth revisiting in the future. For example:
|
||||
```tf
|
||||
#trivy:ignore:aws-s3-enable-logging:exp:2024-03-10
|
||||
resource "aws_s3_bucket" "example" {
|
||||
bucket = "test"
|
||||
}
|
||||
```
|
||||
|
||||
The `aws-s3-enable-logging` check will be ignored until `2024-03-10` until the ignore rule expires.
|
||||
|
||||
#### Ignoring by attributes
|
||||
|
||||
You can ignore a resource by its attribute value. This is useful when using the `for-each` meta-argument. For example:
|
||||
|
||||
```tf
|
||||
locals {
|
||||
ports = ["3306", "5432"]
|
||||
}
|
||||
|
||||
#trivy:ignore:aws-ec2-no-public-ingress-sgr[from_port=3306]
|
||||
resource "aws_security_group_rule" "example" {
|
||||
for_each = toset(local.ports)
|
||||
type = "ingress"
|
||||
from_port = each.key
|
||||
to_port = each.key
|
||||
protocol = "TCP"
|
||||
cidr_blocks = ["0.0.0.0/0"]
|
||||
security_group_id = aws_security_group.example.id
|
||||
source_security_group_id = aws_security_group.example.id
|
||||
}
|
||||
```
|
||||
|
||||
The `aws-ec2-no-public-ingress-sgr` check will be ignored only for the `aws_security_group_rule` resource with port number `5432`. It is important to note that the ignore rule should not enclose the attribute value in quotes, despite the fact that the port is represented as a string.
|
||||
|
||||
If you want to ignore multiple resources on different attributes, you can specify multiple ignore rules:
|
||||
|
||||
```tf
|
||||
#trivy:ignore:aws-ec2-no-public-ingress-sgr[from_port=3306]
|
||||
#trivy:ignore:aws-ec2-no-public-ingress-sgr[from_port=5432]
|
||||
```
|
||||
|
||||
You can also ignore a resource on multiple attributes in the same rule:
|
||||
```tf
|
||||
locals {
|
||||
rules = {
|
||||
first = {
|
||||
port = 1000
|
||||
type = "ingress"
|
||||
},
|
||||
second = {
|
||||
port = 1000
|
||||
type = "egress"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#trivy:ignore:aws-ec2-no-public-ingress-sgr[from_port=1000,type=egress]
|
||||
resource "aws_security_group_rule" "example" {
|
||||
for_each = { for k, v in local.rules : k => v }
|
||||
|
||||
type = each.value.type
|
||||
from_port = each.value.port
|
||||
to_port = each.value.port
|
||||
protocol = "TCP"
|
||||
cidr_blocks = ["0.0.0.0/0"]
|
||||
security_group_id = aws_security_group.example.id
|
||||
source_security_group_id = aws_security_group.example.id
|
||||
}
|
||||
```
|
||||
|
||||
Checks can also be ignored by nested attributes:
|
||||
|
||||
```tf
|
||||
#trivy:ignore:*[logging_config.prefix=myprefix]
|
||||
resource "aws_cloudfront_distribution" "example" {
|
||||
logging_config {
|
||||
include_cookies = false
|
||||
bucket = "mylogs.s3.amazonaws.com"
|
||||
prefix = "myprefix"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
#### Ignoring module issues
|
||||
|
||||
Issues in third-party modules cannot be ignored using the method described above, because you may not have access to modify the module source code. In such a situation you can add ignore rules above the module block, for example:
|
||||
|
||||
```tf
|
||||
#trivy:ignore:aws-s3-enable-logging
|
||||
module "s3_bucket" {
|
||||
source = "terraform-aws-modules/s3-bucket/aws"
|
||||
|
||||
bucket = "my-s3-bucket"
|
||||
}
|
||||
```
|
||||
|
||||
An example of ignoring checks for a specific bucket in a module:
|
||||
```tf
|
||||
locals {
|
||||
bucket = ["test1", "test2"]
|
||||
}
|
||||
|
||||
#trivy:ignore:*[bucket=test1]
|
||||
module "s3_bucket" {
|
||||
for_each = toset(local.bucket)
|
||||
source = "terraform-aws-modules/s3-bucket/aws"
|
||||
bucket = each.value
|
||||
}
|
||||
```
|
||||
|
||||
#### Support for Wildcards
|
||||
|
||||
You can use wildcards in the `ws` (workspace) and `ignore` sections of the ignore rules.
|
||||
|
||||
```tf
|
||||
# trivy:ignore:aws-s3-*:ws:dev-*
|
||||
```
|
||||
|
||||
This example ignores all checks starting with `aws-s3-` for workspaces matching the pattern `dev-*`.
|
||||
|
||||
[custom]: custom/index.md
|
||||
|
||||
Reference in New Issue
Block a user