Rule IDs with spaces cannot be skipped

[adamjohnson01]

• terrascan version: 1.4.0
• Operating System: Docker and Darwin

Description

I am trying to skip the following but the rule id has spaces in it so it does not work.

	Description    :	Ensure CloudWatch logging is enabled for Route53 hosted zones.
	File           :	route53.tf
	Line           :	66
	Severity       :	MEDIUM
	Rule Name      :	route53LoggingDisabled
	Rule ID        :	AWS.Route53 query logs.Logging.Medium.0574
	Resource Name  :	dns
	Resource Type  :	aws_route53_zone
	Category       :	Logging

	-----------------------------------------------------------------------

What I Did

I added the following to the resource

ts:skip=AWS.Route53 query logs.Logging.Medium.0574 Only works with public route53

[fetep]

Also seeing this behavior. Should we fix the rule skipper to support spaces, or rename policies to not have spaces in their reference_id?

[MrMickS]

We are seeing the same issue with rules of the form AC_AWS_078 or AC_AWS_070.

[kanchwala-yusuf]

@MrMickS, Can you please share an example of your IaC file with us? Just want to reproduce it on my own? Also, please let us know how are you using rule skipping

[harkirat22]

@fetep we will make changes to all such policie's reference ids.

[nasir-rabbani]

@adamjohnson01 @MrMickS

Sorry for causing confusions and the issues, which were due to inconsistency in nomenclature of reference_id. With PR #786 we are intending to standardize the Rule IDs.

Even though we have added support for spaces while skipping rule, we highly recommend everyone to refer newly added id instead of reference_id for the scanning or suppressing of specific policy.

Please feel free to re-open this issue if it doesn't work as expected. Thanks.

[nasir-rabbani]

• terrascan version: 1.4.0
• Operating System: Docker and Darwin

Description

I am trying to skip the following but the rule id has spaces in it so it does not work.

	Description    :	Ensure CloudWatch logging is enabled for Route53 hosted zones.
	File           :	route53.tf
	Line           :	66
	Severity       :	MEDIUM
	Rule Name      :	route53LoggingDisabled
	Rule ID        :	AWS.Route53 query logs.Logging.Medium.0574
	Resource Name  :	dns
	Resource Type  :	aws_route53_zone
	Category       :	Logging

	-----------------------------------------------------------------------

What I Did

I added the following to the resource

ts:skip=AWS.Route53 query logs.Logging.Medium.0574 Only works with public route53

The corresponding id for this policy is AC_AWS_0204. Please let us know if this works for you.

[nasir-rabbani]

AC_AWS_078

Please use the following corresponding id values:

AC_AWS_0497 instead of AC_AWS_078
AC_AWS_0480 instead of AC_AWS_070

Please confirm if this solves your purpose.

[sarahc23]

Hi there, we're having a similar issue. We're trying to suppress AC_AWS_0320, whose id field has the same name.

We've tried

#ts:skip=AC_AWS_0320 Allow SSH

and also (just for good measure)

#ts:skip=networkPort22ExposedToprivate Allow SSH

but neither worked.

As a shot in the dark, terrascan flagged the issue inside an aws_security_group_rule so that's where we placed the comment. Is this supposed to go inside an aws_security_group resource instead?

[nasir-rabbani]

@sarahc23

It would be better for us to understand if you could please attach some reference of where exactly you are putting the comment.

We need to put the comment inside the resource block which is violating the policy. Refer this.

Do let us know if this helped.