Skip to content

Commit 5c42cc5

Browse files
authored
docs(misconf): Remove duplicate sections (#9819)
1 parent ea2dc58 commit 5c42cc5

1 file changed

Lines changed: 0 additions & 124 deletions

File tree

  • docs/guide/scanner/misconfiguration/config

docs/guide/scanner/misconfiguration/config/config.md

Lines changed: 0 additions & 124 deletions
Original file line numberDiff line numberDiff line change
@@ -343,127 +343,3 @@ You can use wildcards in the `ws` (workspace) and `ignore` sections of the ignor
343343
```
344344

345345
This example ignores all checks starting with `aws-s3-` for workspaces matching the pattern `dev-*`.
346-
347-
### Expiration Date
348-
349-
You can specify the expiration date of the ignore rule in `yyyy-mm-dd` format. This is a useful feature when you want to make sure that an ignored issue is not forgotten and worth revisiting in the future. For example:
350-
```tf
351-
#trivy:ignore:aws-s3-enable-logging:exp:2024-03-10
352-
resource "aws_s3_bucket" "example" {
353-
bucket = "test"
354-
}
355-
```
356-
357-
The `aws-s3-enable-logging` check will be ignored until `2024-03-10` until the ignore rule expires.
358-
359-
#### Ignoring by attributes
360-
361-
You can ignore a resource by its attribute value. This is useful when using the `for-each` meta-argument. For example:
362-
363-
```tf
364-
locals {
365-
ports = ["3306", "5432"]
366-
}
367-
368-
#trivy:ignore:aws-ec2-no-public-ingress-sgr[from_port=3306]
369-
resource "aws_security_group_rule" "example" {
370-
for_each = toset(local.ports)
371-
type = "ingress"
372-
from_port = each.key
373-
to_port = each.key
374-
protocol = "TCP"
375-
cidr_blocks = ["0.0.0.0/0"]
376-
security_group_id = aws_security_group.example.id
377-
source_security_group_id = aws_security_group.example.id
378-
}
379-
```
380-
381-
The `aws-ec2-no-public-ingress-sgr` check will be ignored only for the `aws_security_group_rule` resource with port number `5432`. It is important to note that the ignore rule should not enclose the attribute value in quotes, despite the fact that the port is represented as a string.
382-
383-
If you want to ignore multiple resources on different attributes, you can specify multiple ignore rules:
384-
385-
```tf
386-
#trivy:ignore:aws-ec2-no-public-ingress-sgr[from_port=3306]
387-
#trivy:ignore:aws-ec2-no-public-ingress-sgr[from_port=5432]
388-
```
389-
390-
You can also ignore a resource on multiple attributes in the same rule:
391-
```tf
392-
locals {
393-
rules = {
394-
first = {
395-
port = 1000
396-
type = "ingress"
397-
},
398-
second = {
399-
port = 1000
400-
type = "egress"
401-
}
402-
}
403-
}
404-
405-
#trivy:ignore:aws-ec2-no-public-ingress-sgr[from_port=1000,type=egress]
406-
resource "aws_security_group_rule" "example" {
407-
for_each = { for k, v in local.rules : k => v }
408-
409-
type = each.value.type
410-
from_port = each.value.port
411-
to_port = each.value.port
412-
protocol = "TCP"
413-
cidr_blocks = ["0.0.0.0/0"]
414-
security_group_id = aws_security_group.example.id
415-
source_security_group_id = aws_security_group.example.id
416-
}
417-
```
418-
419-
Checks can also be ignored by nested attributes:
420-
421-
```tf
422-
#trivy:ignore:*[logging_config.prefix=myprefix]
423-
resource "aws_cloudfront_distribution" "example" {
424-
logging_config {
425-
include_cookies = false
426-
bucket = "mylogs.s3.amazonaws.com"
427-
prefix = "myprefix"
428-
}
429-
}
430-
```
431-
432-
#### Ignoring module issues
433-
434-
Issues in third-party modules cannot be ignored using the method described above, because you may not have access to modify the module source code. In such a situation you can add ignore rules above the module block, for example:
435-
436-
```tf
437-
#trivy:ignore:aws-s3-enable-logging
438-
module "s3_bucket" {
439-
source = "terraform-aws-modules/s3-bucket/aws"
440-
441-
bucket = "my-s3-bucket"
442-
}
443-
```
444-
445-
An example of ignoring checks for a specific bucket in a module:
446-
```tf
447-
locals {
448-
bucket = ["test1", "test2"]
449-
}
450-
451-
#trivy:ignore:*[bucket=test1]
452-
module "s3_bucket" {
453-
for_each = toset(local.bucket)
454-
source = "terraform-aws-modules/s3-bucket/aws"
455-
bucket = each.value
456-
}
457-
```
458-
459-
#### Support for Wildcards
460-
461-
You can use wildcards in the `ws` (workspace) and `ignore` sections of the ignore rules.
462-
463-
```tf
464-
# trivy:ignore:aws-s3-*:ws:dev-*
465-
```
466-
467-
This example ignores all checks starting with `aws-s3-` for workspaces matching the pattern `dev-*`.
468-
469-
[custom]: custom/index.md

0 commit comments

Comments
 (0)