New xray_ignore_rule resources or changes to existing ones should take effect immediately

[rorynickolls-skyral]

Is your feature request related to a problem? Please describe.

When creating or updating xray_ignore_rule Terraform resources, it does not appear to take effect immediately. Policy violations do not start showing as 'Ignored' in the Xray scans list until a scan is triggered manually through the UI.

Describe the solution you'd like

Having a manual step after creating rules defeats the purpose of managing them through Terraform - it would be ideal if changes to the Terraform-managed ignore rule took effect immediately without any intervention.

Describe alternatives you've considered

Alternatives are:

• Continue manually triggering rescans.
• Automatically trigger a rescan outside of the Terraform provider e.g. in our own CI pipeline.

Neither of which are great solutions!

Additional context

When creating a rule through the Artifactory UI, it appears to take effect immediately without triggering a scan. It is unclear how it does this, and whether there's an API request that can be made from the provider to make it happen.

[alexhung]

@rorynickolls-skyral Thanks for the suggestion. I've added this to our road map.

[yahesh]

@alexhung We ran into the same issue just recently. Are there any news on when this will be fixed?

[alexhung]

@yahesh Unfortunately, no update so far. The REST APIs to initiate a scan are designed for specific artifact, build, etc., and does not necessary match the criteria in ignore rules. I haven't been able to come up with a good way to reconcile these differences yet.

Two alternatives:

• Use the private web UI API, which may or may not be possible.
• Make feature request to the Xray team to expose new public API for this purpose.

[sgsollie]

Hey just adding my personal experiences here.
I've ran into this issue but also experienced some other, & from a user perspective slightly bizarre behaviour which I think is related.
We have policy to block downloads of all artefacts with critical vulnerabilities.

1. Add ignore rule with terraform
2. Find that the artifact with a critical vuln is still blocked & (policy violation) - with no ignore rule associated with it.
3. Add a new ignore rule for that vulnerability in the UI (click on the violation > "Ignore Violation")
4. Immediately delete that ignore rule in the UI
5. Find that the policy violation still says "Ignored" BUT the associated ignore rule is now the terraform created rule!

I've been able to re-produce this pretty consistently