v0.20.0 ignores inline ignores in the modules

[AnitaErnszt]

What

We are using private TF modules and in some cases, these modules are fairly opinionated to simplify the configuration for engineers, eg:

#trivy:ignore:AVD-AWS-0132
resource "aws_s3_bucket_server_side_encryption_configuration" "server_side_encryption_configuration" {
  bucket = aws_s3_bucket.s3_bucket.bucket

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

When using v0.19.0 the check passes as expected, however the same config and code fails using v0.20.0.

v0.19.0 more aligns with how tfsec worked for us before. If a configuration decision is made in the module (like above example the encryption method) I should be handle ignore at the module level.

GH Action job

    - name: Run Trivy vulnerability scanner in IaC mode
      uses: aquasecurity/[email protected]
      with:
        scan-type: 'fs'
        scanners: 'misconfig'
        scan-ref: ${{ inputs.terraform-directory }}
        hide-progress: false
        exit-code: '1'
        ignore-unfixed: false
        output: trivy.txt

Action output

v0.19.0:

Running trivy with options: trivy fs  --format table --exit-code  1 --vuln-type  os,library --scanners  misconfig --severity  UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --output  trivy.txt iac/terraform
Global options:  
20[24](https://github.com/thrivadev/platform-snoopy/actions/runs/9000739195/job/24725528154#step:12:25)-05-08T11:05:24.332Z	INFO	Misconfiguration scanning is enabled
2024-05-08T11:05:24.332Z	INFO	Need to update the built-in policies
2024-05-08T11:05:24.332Z	INFO	Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-08T11:05:45.833Z	INFO	Detected config files: 432

v0.20.0:

Running trivy with options: trivy fs  --format table --exit-code  1 --vuln-type  os,library --scanners  misconfig --severity  UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --output  trivy.txt iac/terraform
Global options:  
20[24](https://github.com/thrivadev/platform-snoopy/actions/runs/9000795160/job/24725690344#step:12:25)-05-08T11:09:21Z	INFO	Misconfiguration scanning is enabled
2024-05-08T11:09:21Z	INFO	Need to update the built-in policies
2024-05-08T11:09:21Z	INFO	Downloading the built-in policies...
50.41 KiB / 50.41 KiB [-----------------------------------------------------------] 100.00% ? p/s 0s2024-05-08T11:09:22Z	INFO	Detected config files	num=5

[simar7]

v0.20.0 only uses the latest release of Trivy (v0.51.1). If you see issues running the action as you mentioned, could you try running Trivy (v0.51.1) by locally to see what results you get? If there are discrepancies, could you please file a discussion in the Trivy repo: https://github.com/aquasecurity/trivy/discussions/new/choose so we can take a look?