trivy ignore at resource level

ministryofjustice · Oct 15, 2024 · a2f39f0 · a2f39f0
1 parent 5e305bc
commit a2f39f0
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/terraform/environments/core-vpc/vpc.tf b/terraform/environments/core-vpc/vpc.tf
@@ -98,7 +98,6 @@ module "vpc" {
  tags_prefix = each.key
 }
 
-#trivy:ignore:AVD-AWS-0102:All ports open by design https://user-guide.modernisation-platform.service.justice.gov.uk/concepts/networking/subnet-nacls.html#all-subnets-data-private-public
 module "vpc_nacls" {
  source = "../../modules/vpc-nacls"
  for_each = local.vpcs[terraform.workspace]

diff --git a/terraform/modules/vpc-nacls/main.tf b/terraform/modules/vpc-nacls/main.tf
@@ -39,6 +39,7 @@ resource "aws_network_acl" "protected" {
 resource "aws_network_acl_rule" "data_subnet_static_rules" {
  #checkov:skip=CKV_AWS_352:Verified - these rules are reasonable
  #checkov:skip=CKV_AWS_231:Allow ingress from 0.0.0.0:0 to port 3389 required
+ #trivy:ignore:AVD-AWS-0102:All ports open by design https://user-guide.modernisation-platform.service.justice.gov.uk/concepts/networking/subnet-nacls.html#all-subnets-data-private-public
  for_each = local.static_acl_rules
  cidr_block = each.value.cidr_block
  egress = each.value.egress
@@ -54,6 +55,7 @@ resource "aws_network_acl_rule" "data_subnet_static_rules" {
 resource "aws_network_acl_rule" "private_subnet_static_rules" {
  #checkov:skip=CKV_AWS_352:Verified - these rules are reasonable
  #checkov:skip=CKV_AWS_231:Allow ingress from 0.0.0.0:0 to port 3389 required
+ #trivy:ignore:AVD-AWS-0102:All ports open by design https://user-guide.modernisation-platform.service.justice.gov.uk/concepts/networking/subnet-nacls.html#all-subnets-data-private-public
  for_each = local.static_acl_rules
  cidr_block = each.value.cidr_block
  egress = each.value.egress
@@ -83,6 +85,7 @@ resource "aws_network_acl_rule" "public_subnet_static_rules" {
 #tfsec:ignore:aws-vpc-no-excessive-port-access tfsec:ignore:aws-ec2-no-public-ingress-acl
 resource "aws_network_acl_rule" "public_subnet_internet_access_rules" {
  #checkov:skip=CKV_AWS_231:Verified - these rules are reasonable
+ #trivy:ignore:AVD-AWS-0102:All ports open by design https://user-guide.modernisation-platform.service.justice.gov.uk/concepts/networking/subnet-nacls.html#all-subnets-data-private-public
  for_each = local.public_access_acl_rules
  cidr_block = each.value.cidr_block
  egress = each.value.egress