Empty artifactLocation in SARIF file for AVD-AZU-0013 misconfiguration check (GitHub's upload-sarif job errors) #7905
Replies: 3 comments 7 replies
-
|
Hello @PhilipAtCisco This is related with empty ➜ trivy -q fs --scanners misconfig . -f json | grep Target
"Target": "",
"Target": ".",
"Target": "t.tf",
➜ trivy -q fs --scanners misconfig ./t.tf -f json | grep Target
"Target": "",
"Target": ".",
"Target": "t.tf",@nikpivkin can you take a look? |
Beta Was this translation helpful? Give feedback.
-
|
I took this file from |
Beta Was this translation helpful? Give feedback.
-
|
Hmm, I'm getting a different result: trivy -q fs --scanners misconfig . -f json | grep Target
"Target": ".",
"Target": "main.tf",Can you share the full json output? |
Beta Was this translation helpful? Give feedback.
-
report➜ trivy -v
Version: 0.57.0
Check Bundle:
Digest: sha256:9cc30e6eb1c0dc0b4a4791b61c3dbff8799d08daeac893c08317e7b054ecab14
DownloadedAt: 2024-11-13 06:32:23.693518 +0000 UTC
➜ trivy -q fs --scanners misconfig . -f json
{
"SchemaVersion": 2,
"CreatedAt": "2024-11-13T18:30:52.959539+06:00",
"ArtifactName": ".",
"ArtifactType": "filesystem",
"Metadata": {
"ImageConfig": {
"architecture": "",
"created": "0001-01-01T00:00:00Z",
"os": "",
"rootfs": {
"type": "",
"diff_ids": null
},
"config": {}
}
},
"Results": [
{
"Target": "",
"Class": "config",
"Type": "terraform",
"MisconfSummary": {
"Successes": 0,
"Failures": 1
},
"Misconfigurations": [
{
"Type": "Terraform Security Check",
"ID": "AVD-AZU-0013",
"AVDID": "AVD-AZU-0013",
"Title": "Key vault should have the network acl block specified",
"Description": "Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault.\n\nThe default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass.\n",
"Message": "Vault network ACL does not block access by default.",
"Namespace": "builtin.azure.keyvault.azure0013",
"Query": "data.builtin.azure.keyvault.azure0013.deny",
"Resolution": "Set a network ACL for the key vault",
"Severity": "CRITICAL",
"PrimaryURL": "https://avd.aquasec.com/misconfig/avd-azu-0013",
"References": [
"https://docs.microsoft.com/en-us/azure/key-vault/general/network-security",
"https://avd.aquasec.com/misconfig/avd-azu-0013"
],
"Status": "FAIL",
"Layer": {},
"CauseMetadata": {
"Provider": "Azure",
"Service": "keyvault",
"Code": {
"Lines": null
}
}
}
]
},
{
"Target": ".",
"Class": "config",
"Type": "terraform",
"MisconfSummary": {
"Successes": 39,
"Failures": 0
}
},
{
"Target": "t.tf",
"Class": "config",
"Type": "terraform",
"MisconfSummary": {
"Successes": 0,
"Failures": 1
},
"Misconfigurations": [
{
"Type": "Terraform Security Check",
"ID": "AVD-AZU-0016",
"AVDID": "AVD-AZU-0016",
"Title": "Key vault should have purge protection enabled",
"Description": "Purge protection is an optional Key Vault behavior and is not enabled by default.\n\nPurge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI or PowerShell.\n",
"Message": "Vault does not have purge protection enabled.",
"Namespace": "builtin.azure.keyvault.azure0016",
"Query": "data.builtin.azure.keyvault.azure0016.deny",
"Resolution": "Enable purge protection for key vaults",
"Severity": "MEDIUM",
"PrimaryURL": "https://avd.aquasec.com/misconfig/avd-azu-0016",
"References": [
"https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection",
"https://avd.aquasec.com/misconfig/avd-azu-0016"
],
"Status": "FAIL",
"Layer": {},
"CauseMetadata": {
"Resource": "azurerm_key_vault.good_example",
"Provider": "Azure",
"Service": "keyvault",
"StartLine": 6,
"EndLine": 6,
"Code": {
"Lines": [
{
"Number": 1,
"Content": "resource \"azurerm_key_vault\" \"good_example\" {",
"IsCause": false,
"Annotation": "",
"Truncated": false,
"Highlighted": "\u001b[38;5;33mresource\u001b[0m \u001b[38;5;37m\"azurerm_key_vault\"\u001b[0m \u001b[38;5;37m\"good_example\"\u001b[0m {",
"FirstCause": false,
"LastCause": false
},
{
"Number": 2,
"Content": " name = \"examplekeyvault\"",
"IsCause": false,
"Annotation": "",
"Truncated": false,
"Highlighted": " \u001b[38;5;245mname\u001b[0m = \u001b[38;5;37m\"examplekeyvault\"",
"FirstCause": false,
"LastCause": false
},
{
"Number": 3,
"Content": " location = azurerm_resource_group.good_example.location",
"IsCause": false,
"Annotation": "",
"Truncated": false,
"Highlighted": "\u001b[0m \u001b[38;5;245mlocation\u001b[0m = azurerm_resource_group.good_example.location",
"FirstCause": false,
"LastCause": false
},
{
"Number": 4,
"Content": " enabled_for_disk_encryption = true",
"IsCause": false,
"Annotation": "",
"Truncated": false,
"Highlighted": " \u001b[38;5;245menabled_for_disk_encryption\u001b[0m = \u001b[38;5;166mtrue",
"FirstCause": false,
"LastCause": false
},
{
"Number": 5,
"Content": " soft_delete_retention_days = 7",
"IsCause": false,
"Annotation": "",
"Truncated": false,
"Highlighted": "\u001b[0m \u001b[38;5;245msoft_delete_retention_days\u001b[0m = \u001b[38;5;37m7",
"FirstCause": false,
"LastCause": false
},
{
"Number": 6,
"Content": " purge_protection_enabled = false",
"IsCause": true,
"Annotation": "",
"Truncated": false,
"Highlighted": "\u001b[0m \u001b[38;5;245mpurge_protection_enabled\u001b[0m = \u001b[38;5;166mfalse",
"FirstCause": true,
"LastCause": true
},
{
"Number": 7,
"Content": " }",
"IsCause": false,
"Annotation": "",
"Truncated": false,
"Highlighted": "\u001b[0m }",
"FirstCause": false,
"LastCause": false
}
]
},
"Occurrences": [
{
"Resource": "azurerm_key_vault.good_example",
"Filename": "t.tf",
"Location": {
"StartLine": 1,
"EndLine": 7
}
}
]
}
}
]
}
]
} |
Beta Was this translation helpful? Give feedback.
-
|
@PhilipAtCisco This issue will be fixed when the checks bundle is released with this fix. |
Beta Was this translation helpful? Give feedback.
-
|
@nikpivkin thanks for watching! |
Beta Was this translation helpful? Give feedback.
-
|
@nikpivkin @DmitriyLewen Thanks so much for looking into the report and determining it will be fixed soon, really appreciate it! I found the issue by scanning https://github.com/bridgecrewio/terragoat/blob/master/terraform/azure/key_vault.tf by the way, and didn't see any other checks triggered by terragoat impacted by the bug. |
Beta Was this translation helpful? Give feedback.
-
|
Hey Folks, I've experience the same error with rules:
|
Beta Was this translation helpful? Give feedback.
-
|
cc @nikpivkin |
Beta Was this translation helpful? Give feedback.
-
Description
The AVD-AZU-0013 misconfiguration check when it fires results in an empty artifactLocation uri when Trivy is configured to output SARIF.
GitHub's upload-sarif@v3 action outputs this fatal error when it finds an empty artifact location, and no vulnerability findings are surfaced from the file.
Here's a snippit of the SARIF output (see steps to reproduce below)
Desired Behavior
Populate the file location for the artifactLocation in the SARIF
Actual Behavior
The SARIF doesn't contain the artifactLocation
Reproduction Steps
...
Operating System
macOS Sonoma 14.7
Version
Checklist
trivy clean --allBeta Was this translation helpful? Give feedback.
All reactions