IaC ignores using the .snyk policy file

When you scan IaC configuration files using the Snyk CLI iac test command, you can ignore issues that are not relevant for you by using the .snyk policy file. Snyk recommends that you store and version the .snyk file in the root of the working directory where you store your IaC configuration files.
Ignore paths
For test runs using the Snyk CLI, only issues defined in the .snyk file are ignored.
For test runs from imported git repositories, issues can be ignored in the Snyk UI. Note that these ignores apply only to scans done using the Snyk UI.
Note: Ignores in the .snyk file and ignores created in the Snyk UI are not synchronized.
.snyk file semantics
The .snyk file has some limitations for IaC projects. (See The .snyk file for standard functionality.)
The patches section is not yet supported and is ignored.
There are no IaC-supported language settings. This section is ignored.
When you run snyk iac test against a directory, either by passing in one or more directories or using the default argument of the current working directory, the Snyk CLI looks for a file named .snyk in each of those directories.
The syntax of the policy file is as follows:
1
version: v1.19.0
2
ignore:
3
  SNYK-CC-K8S-1:
4
    - '*':
5
        reason: None Given
6
        expires: 2021-08-26T08:40:35.249Z
7
        created: 2021-07-27T08:40:35.251Z
Copied!
This file can be created with the snyk ignore command. For details see Ignore vulnerabilities using Snyk CLI.
The * object key causes the CLI to ignore all instances of the SNYK-CC-K8S-1 vulnerability. You can add multiple entries, keyed by the IaC issue ID, to ignore multiple vulnerabilities.
Ignoring a single file
Ignore rules can be scoped more narrowly. To scope the ignore to a single file, change the * to the path of that single file relative to the directory being tested that contains the .snyk policy file.
You can specify scoped ignore rules either by using the ignore command in the Snyk CLI or manually modifying the .snyk file.
In the following example, an issue is being ignored with the SNYK-CC-K8S-1 ID in two specific files:
staging/deployment.yaml
staging/cronjob.yaml
You can generate the scoped ignore rules with the Snyk CLI by running the following commands:
1
snyk ignore --id=SNYK-CC-K8S-1 path='staging/cronjob.yaml > *'
2
snyk ignore --id=SNYK-CC-K8S-1 path='staging/deployment.yaml > *'
Copied!
Alternatively, manually modify the .snyk policy file as follows:
1
version: v1.19.0
2
ignore:
3
  SNYK-CC-K8S-1:
4
    - 'staging/deployment.yaml > *':
5
        reason: None Given
6
        expires: 2021-08-26T08:40:35.249Z
7
        created: 2021-07-27T08:40:35.251Z
8
  - 'staging/cronjob.yaml > *':
9
        reason: None Given
10
        expires: 2021-08-26T08:40:35.249Z
11
        created: 2021-07-27T08:40:35.251Z
Copied!
For more information about the Snyk CLI ignore command, see Ignore vulnerabilities using Snyk CLI.
Ignore instances of a vulnerability
Individual instances of a vulnerability within a file can be ignored. To do this, take the “resource path” from the output of snyk iac test, and add it to the file path.
For example, from the following output snippet:
1
Testing production/deployment.yaml...Infrastructure as code issues:
2
  ✗ Container is running in privileged mode [High Severity] [SNYK-CC-K8S-1] in Deployment
3
    introduced by [DocId: 0] > input > spec > template > spec > containers[web] > securityContext > privileged
Copied!
You could generate the scoped ignore rule with the Snyk CLI, by running the following command:
1
 snyk ignore --id=SNYK-CC-K8S-1 path='production/deployment.yaml > [DocId:1] > spec > template > spec > containers[web] > securityContext > privileged'
Copied!
Alternatively, manually modify the policy file as follows:
1
version: v1.19.0
2
ignore:
3
  SNYK-CC-K8S-1:
4
    - 'production/deployment.yaml > [DocId:1] > spec > template > spec > containers[web] > securityContext > privileged':
5
        reason: None Given
6
        expires: 2021-08-26T08:40:35.249Z
7
        created: 2021-07-27T08:40:35.251Z
Copied!
For more information about the Snyk CLI ignore command, see Ignore vulnerabilities using Snyk CLI.
Policy flags and policy file notes
You cannot have more than one .snyk policy file for each test. For example, the command snyk iac test dir1/ dir2/ loads dir1/.snyk and dir2/.snyk, but if the file dir1/foo/bar/.snyk exists, the CLI does not load it.
When you run snyk iac test, the CLI loads $PWD/.snyk. One common pattern is to use a single .snyk policy file per repository, in the root of that repository.
The CLI accepts an option, --policy-path=..., which overrides the location of .snyk policy files. The path can either be a directory containing a file named .snyk or the path to a file named .snyk. The name of the policy file must be .snyk.
Policies are not loaded automatically when the argument to snyk iac test is a file rather than a directory. In this case, --policy-path must be specified in order to load policies.
The CLI accepts the option --ignore-policy, which causes any found .snyk policy files to be ignored.

Test your configuration files

Test your Terraform files with Snyk CLI

Last modified 1mo ago

Export as PDF

Copy link

Edit on GitHub

Contents

Ignore paths

.snyk file semantics

Ignoring a single file

Ignore instances of a vulnerability

Policy flags and policy file notes