Ignoring Findings

Some drift is expected: a role assignment managed by PIM, a tag a deploy script sets. An ignore rule accepts a finding without hiding it. Ignored findings stay in every report, marked as ignored with the reason, but no longer trip -exit-code, raise work items or post to Teams.

Ignore file

Pass -ignore <file>, or put .tf-snag-ignore.yml (or .yaml) in the working directory or the -source root:

drift:
  - address: "module.storage_account[0].azurerm_storage_account.sa"
    reason: "temp tag from the deploy script, JIRA-123"
  - address: "azurerm_role_assignment.*"     # * matches any run of characters
    reason: "managed by PIM outside Terraform"
deprecations:
  - match: "live_trace_enabled"              # case-insensitive substring of summary + detail
    reason: "provider 4.0 upgrade tracked separately"
retirements:
  - id: azure-public-ip-basic-sku            # the catalogue entry, waived outright
    reason: "CSES deployment, exempt from the retirement"
  - address: module.legacy.azurerm_lb.edge   # just this resource
    reason: "decommissioned in Q3, tracked in PLAT-412"

A drift address is matched against both the full address and its trailing type.name, so azurerm_role_assignment.* also catches module.x.azurerm_role_assignment.foo.

A retirement id waives the whole finding. A retirement address drops only that resource from it, and the finding is suppressed only once every instance has been waived — so a waiver for one resource cannot silence the other nine. See Retirements.

Inline comments

With -source pointing at your .tf files, a comment can ignore the resource it sits in, or the one directly below it:

# tf-snag:ignore-drift  reason: managed by PIM
resource "azurerm_role_assignment" "admin" { ... }

resource "azurerm_signalr_service" "legacy" {
  # tf-snag:ignore-deprecation reason: 4.0 upgrade in backlog
  live_trace_enabled = true
}

Directive	Ignores
# tf-snag:ignore	drift and deprecations
# tf-snag:ignore-drift	drift
# tf-snag:ignore-deprecation	deprecations

The reason: (or reason=) trailer is optional, but the exceptions register flags a rule without one.

An inline rule is reviewed with the Terraform it sits beside; a rule in the ignore file is reviewed on its own. Reports record which kind matched.

What happens elsewhere

• Work items: ignoring a finding does not close its work item. tf-snag comments on it once instead. See Work Items
• Teams: ignored findings are counted on the card but not listed
• Removing a rule: the finding comes back as No longer ignored. See Baselines and Provenance
• Keeping rules honest: the Exceptions Register lists every rule, and separates the ones that no longer suppress anything