Inline comment not ignoring rule when run on whole directory.

[alastairmontgomery1-nhs]

Description

I have a inline comment to ignore the rule AVD-AWS-0132 for encrypting bucket with customer managed key.

# trivy:ignore:AVD-AWS-0132
resource "aws_s3_bucket_server_side_encryption_configuration" "aes" {
  bucket = aws_s3_bucket.backup_reports.id

  rule {
    bucket_key_enabled = true
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

When I run trivy against this single file the ignore comment is honored.

/code # trivy config ./s3-reports.tf

Report Summary

┌───────────────┬───────────┬───────────────────┐
│    Target     │   Type    │ Misconfigurations │
├───────────────┼───────────┼───────────────────┤
│ .             │ terraform │         0         │
├───────────────┼───────────┼───────────────────┤
│ s3-reports.tf │ terraform │         0         │
└───────────────┴───────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

But is I run trivy against the whole directory the ignore comment isn't honored.

/code # trivy config ./

Report Summary

┌───────────────┬────────────────────────┬───────────────────┐
│    Target     │          Type          │ Misconfigurations │
├───────────────┼────────────────────────┼───────────────────┤
│ .             │ terraformplan-snapshot │         0         │
├───────────────┼────────────────────────┼───────────────────┤
│ s3-reports.tf │ terraformplan-snapshot │         1         │
└───────────────┴────────────────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


s3-reports.tf (terraformplan-snapshot)

Tests: 1 (SUCCESSES: 0, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0132 (HIGH): Bucket does not encrypt data with a customer managed key.
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.


See https://avd.aquasec.com/misconfig/avd-aws-0132
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 s3-reports.tf:24-33
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  24 ┌ resource "aws_s3_bucket_server_side_encryption_configuration" "aes" {
  25 │   bucket = aws_s3_bucket.backup_reports.id
  26 │
  27 │   rule {
  28 │     bucket_key_enabled = true
  29 │     apply_server_side_encryption_by_default {
  30 │       sse_algorithm = "AES256"
  31 │     }
  32 │   }
  33 └ }
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Trivy being run via the Docker image.

/code # trivy --version
Version: 0.64.1
Check Bundle:
  Digest: sha256:a471e90b7c7335e914ec9075b74cf8f65e4c91e6cecfa7e39c587382808d2684
  DownloadedAt: 2025-07-25 13:39:45.168487213 +0000 UTC

Configuration

/code # cat trivy.yaml
---
severity: 'CRITICAL,HIGH'
quiet: true
debug: false
hide-progress: true
scan:
  scan-type: 'config'
  ignore-unfixed: true
  exit-code: '1'
  format: 'table'
  scanners:
    - vuln
    - secret
  skip-dirs:
    - 'terraform/vspine'

Desired Behavior

I expect the ignore comment line to be honored when run both against a single file or the whole directory.

Actual Behavior

Reports errors against code which has the ignore comment.

Reproduction Steps

1. Add ignore comment
2. Run Trivy against the one file.
3. Run Trivy against the whole directory.
...

Target

AWS

Scanner

Misconfiguration

Output Format

Table

Mode

Standalone

Debug Output

/code # trivy config ./
2025-07-25T13:55:23Z    DEBUG   No plugins loaded
2025-07-25T13:55:23Z    INFO    Loaded  file_path="trivy.yaml"
2025-07-25T13:55:23Z    DEBUG   Cache dir       dir="/root/.cache/trivy"
2025-07-25T13:55:23Z    DEBUG   Cache dir       dir="/root/.cache/trivy"
2025-07-25T13:55:23Z    DEBUG   Parsed severities       severities=[CRITICAL HIGH]
2025-07-25T13:55:23Z    INFO    [misconfig] Misconfiguration scanning is enabled
2025-07-25T13:55:23Z    DEBUG   [misconfig] Checks successfully loaded from disk
2025-07-25T13:55:23Z    DEBUG   [notification] Running version check
2025-07-25T13:55:24Z    DEBUG   [rego] Overriding filesystem for checks
2025-07-25T13:55:24Z    DEBUG   [rego] Embedded libraries are loaded    count=17
2025-07-25T13:55:24Z    DEBUG   [notification] Version check completed  latest_version="0.64.1"
2025-07-25T13:55:24Z    DEBUG   [rego] Embedded checks are loaded       count=519
2025-07-25T13:55:24Z    DEBUG   [rego] Checks from disk are loaded      count=536
2025-07-25T13:55:24Z    DEBUG   [rego] Overriding filesystem for data
2025-07-25T13:55:24Z    DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-07-25T13:55:24Z    DEBUG   Initializing scan cache...      type="memory"
2025-07-25T13:55:24Z    DEBUG   [fs] Analyzing...       root="."
2025-07-25T13:55:24Z    DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Helm"
2025-07-25T13:55:24Z    DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Terraform"
2025-07-25T13:55:24Z    DEBUG   [terraform scanner] Scanning directory  file_path="."
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Setting project/module root  module="root" file_path="."
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Parsing FS   module="root" file_path="."
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Parsing      module="root" file_path="backup-settings.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Added file   module="root" file_path="backup-settings.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Parsing      module="root" file_path="backup-source.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Added file   module="root" file_path="backup-source.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Parsing      module="root" file_path="data.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Added file   module="root" file_path="data.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Parsing      module="root" file_path="kms-key-backup-notifications.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Added file   module="root" file_path="kms-key-backup-notifications.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Parsing      module="root" file_path="local.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Added file   module="root" file_path="local.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Parsing      module="root" file_path="provider.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Added file   module="root" file_path="provider.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Parsing      module="root" file_path="s3-reports.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Added file   module="root" file_path="s3-reports.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Parsing      module="root" file_path="variables.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Added file   module="root" file_path="variables.tf"
2025-07-25T13:55:24Z    INFO    [terraform scanner] Scanning root module        file_path="."
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Setting project/module root  module="root" file_path="."
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Parsing FS   module="root" file_path="."
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Parsing      module="root" file_path="backup-settings.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Added file   module="root" file_path="backup-settings.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Parsing      module="root" file_path="backup-source.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Added file   module="root" file_path="backup-source.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Parsing      module="root" file_path="data.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Added file   module="root" file_path="data.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Parsing      module="root" file_path="kms-key-backup-notifications.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Added file   module="root" file_path="kms-key-backup-notifications.tf"
2025-07-25T13:55:24Z    DEBUG   [terraform parser] Parsing      module="root" file_path="local.tf"
2025-07-25T13:55:24Z    DEBUG   [t

Operating System

Linux

Version

Version: 0.64.1
Check Bundle:
  Digest: sha256:a471e90b7c7335e914ec9075b74cf8f65e4c91e6cecfa7e39c587382808d2684
  DownloadedAt: 2025-07-25 13:39:45.168487213 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[alastairmontgomery1-nhs]

Seems it was picking up an old plan file instead of re-reading the Terraform files.