Skip to content

Commit

Permalink
docs(vuln): Document inline vulnerability filtering comments (#4024)
Browse files Browse the repository at this point in the history
Co-authored-by: knqyf263 <knqyf263@gmail.com>
  • Loading branch information
jof and knqyf263 committed Apr 18, 2023
1 parent 914c6f0 commit 572a619
Showing 1 changed file with 25 additions and 0 deletions.
25 changes: 25 additions & 0 deletions docs/docs/configuration/filtering.md
Original file line number Diff line number Diff line change
Expand Up @@ -383,3 +383,28 @@ Total: 9 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 4, CRITICAL: 5)
[helper]: https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go
[policy]: https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/contrib/example_policy
## By Inline Comments
| Scanner | Supported |
|:----------------:|:---------:|
| Vulnerability | |
| Misconfiguration ||
| Secret | |
| License | |
Some configuration file formats (e.g. Terraform) support inline comments.
In cases where trivy can detect comments of a specific format immediately adjacent to resource definitions, it is possible to filter/ignore findings from a single point of resource definition (in contrast to `.trivyignore`, which has a directory-wide scope on all of the files scanned).
The format for these comments is `trivy:ignore:<Vulnerability ID>` immediately following the format-specific line-comment token.
For example, to filter a Vulnerability ID "AVD-GCP-0051" in a Terraform HCL file:
```terraform
#trivy:ignore:AVD-GCP-0051
resource "google_container_cluster" "one_off_test" {
name = var.cluster_name
location = var.region
}
```

0 comments on commit 572a619

Please sign in to comment.