tfignore is not considered [aws-rds-enable-iam-auth]

[tb102122]

Description

The tfsecc:ignore flag is ignored.
[aws-rds-enable-iam-auth][MEDIUM] - Instance does not have IAM Authentication enabled

Desired Behavior

tfsec runs successful

Actual Behavior

tfsec fails with warning

Reproduction Steps

1. run the below tf code

# tfsec:ignore:aws-rds-enable-iam-auth
module "db" {
  source  = "terraform-aws-modules/rds/aws"
  version = "~> 6"

  identifier = var.name
  db_name    = var.odoo_db_name
  username   = var.db_root_username
  tags       = var.tags

  instance_use_identifier_prefix = false
  create_db_option_group         = false
  create_db_parameter_group      = false

  engine         = "postgres"
  engine_version = var.postgres_version

  instance_class        = var.db_instance_type
  allocated_storage     = var.db_size
  max_allocated_storage = var.db_max_size

  port                   = var.db_port
  db_subnet_group_name   = var.database_subnet_group
  vpc_security_group_ids = [module.db_security_group.security_group_id]

  skip_final_snapshot     = true
  backup_window           = var.db_backup_window
  backup_retention_period = var.backup_retention_period
  copy_tags_to_snapshot   = true
  deletion_protection     = true

  performance_insights_enabled          = true
  performance_insights_retention_period = 31

}

### Target

AWS

### Scanner

Misconfiguration

### Output Format

None

### Mode

Standalone

### Debug Output

```bash
n/a

Operating System

linux_amd64

Version

Terraform v1.9.7 
tfsec v1.28.11
tflint version 0.54.0

Checklist

• Run trivy clean --all
• Read the troubleshooting

[simar7]

tfsec has been deprecated. The discussions in the Trivy project are for Trivy. You can read the migration guide here

[tb102122]

I understand that but it does not solve my issue, any idea why the check is failing?

[simar7]

It could be a bug in tfsec, I'm not sure. As far as Trivy is concerned this issue does not seem to occur.

trivy config .  
2024-12-02T16:17:38-07:00       INFO    [misconfig] Misconfiguration scanning is enabled
2024-12-02T16:17:39-07:00       INFO    [terraform scanner] Scanning root module        file_path="."
2024-12-02T16:17:39-07:00       INFO    [terraform executor] Ignore finding     rule="aws-rds-enable-iam-auth" range="terraform-aws-modules/rds/aws/modules/db_instance/main.tf:55"
2024-12-02T16:17:39-07:00       INFO    Detected config files   num=2

[tb102122]

ok understood.
I tired now setting up trivy in my gitlab environment.
I build a docker image based on the following definition:

FROM alpine AS builder RUN apk update && apk add --no-cache curl bash coreutils RUN curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash RUN curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin RUN wget https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/junit.tpl RUN cp junit.tpl /usr/local/bin/junit.tpl RUN chmod +x /usr/local/bin/junit.tpl FROM registry.gitlab.com/noemix/shared-resources/terraform-images/stable:latest COPY --from=builder /usr/local/bin /usr/local/bin
And then I run the following steps in my CI.

image: ghcr.io/tb102122/tfscan-gitlab_runner:main script: - gitlab-terraform init -backend=false - tflint --init - tflint --config "$(pwd)/.tflint.hcl" --format junit > ${CI_PROJECT_DIR}/tflint.test.xml - trivy config --exit-code 1 --format template --template "@usr/local/bin/junit.tpl" --output "trivy.test.xml" .

But I get the following error

2024-12-02T23:45:31Z INFO Detected config files num=3
2024-12-02T23:45:31Z FATAL Fatal error report error: unable to write results: failed to initialize template writer: error retrieving template from path: open usr/local/bin/junit.tpl: no such file or directory

Any idea what is the issue the permissions are the following

$ ls /usr/local/bin -l
total 295352
-rwxr-xr-x 1 root root 1917 Dec 2 23:36 junit.tpl

[simar7]

You can read the docs on how to setup for GitLab here https://trivy.dev/v0.57/tutorials/integrations/gitlab-ci/