Both "ID" and "AVDID" fields in scan output are both set by avd_id metadata tag

[dave505]

Description

Setting different values for metadata tags id: and avd_id: results in only avd_id: tag being used to populate both ID and AVDID

Desired Behavior

ID and AVDID should be different, I don't want to set AVDID for internal policies but it looks like I have to set the ID.

Actual Behavior

ID and AVDID are the same, id: tag was ignored

Reproduction Steps

Create a custom rego policy and set the metdata:

# METADATA
# title: some title
# description: a description
# scope: package
# schemas:
# - input: schema["cloud"]
# custom:
#   id: ID-001
#   avd_id: AVDID-001
#   recommended_action: fix this please
#   provider: aws
#   service: s3
#   severity: LOW
#   input:
#     selector:
#     - type: cloud
#       subtypes:
#         - service: s3
#           provider: aws

Results in:

        {
          "Type": "AWS",
          "ID": "AVDID-001",
          "AVDID": "AVDID-001",
          "Title": "some title",
          "Description": "a description",
          "Query": "deny",
          "Resolution": "fix this please",
          "Severity": "LOW",

Target

AWS

Scanner

Vulnerability

Output Format

None

Mode

Standalone

Debug Output

debug isn't working in v0.57.0

Operating System

macOS Sonoma 14.5

Version

Version: 0.57.0

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

@nikpivkin take a look, please

[nikpivkin]

Hi @dave505

Here's the output I got:

 {
          "Type": "Terraform Security Check",
          "ID": "ID-001",
          "AVDID": "AVDID-001",
          "Title": "some title",
          "Description": "a description",
          "Message": "foo",
          "Namespace": "user.test001",
          "Query": "data.user.test001.deny",
          "Resolution": "fix this please",
          "Severity": "LOW",
          "Status": "FAIL",

check:

# METADATA
# title: some title
# description: a description
# scope: package
# schemas:
# - input: schema["cloud"]
# custom:
#   id: ID-001
#   avd_id: AVDID-001
#   recommended_action: fix this please
#   provider: aws
#   service: s3
#   severity: LOW
#   input:
#     selector:
#     - type: cloud
#       subtypes:
#         - service: s3
#           provider: aws

package user.test001

import rego.v1

deny contains res if {
    res := result.new("foo", {})
}

[dave505]

Using your example, I'm seeing

  "Misconfigurations": [
    {
      "Type": "AWS",
      "ID": "AVDID-001",
      "AVDID": "AVDID-001",
      "Title": "some title",
      "Description": "a description",
      "Message": "foo",
      "Namespace": "user.test001",
      "Query": "deny",
      "Resolution": "fix this please",
      "Severity": "LOW",
      "References": [
        ""
      ],
      "Status": "FAIL",
      "Layer": {},
      "CauseMetadata": {
        "Provider": "aws",
        "Service": "s3",
        "Code": {
          "Lines": null

[nikpivkin]

How do you run Trivy?

[dave505]

My-MacBook-Pro-16-inch-2021- trivy-cloud-scanner % trivy aws --service s3 --config-check ./custom/test.rego --check-namespaces user --format json --output ./test.out

Where ./custom/test.rego is your rego policy from above

[nikpivkin]

Thank you, I'll investigate it