terrascan预提交钩子报告误报警报

Question

我需要一些terrascan和pre-commit hook的帮助。

terrascan报告“失败”，即使没有违反政策？

terrascan................................................................Failed
- hook id: terrascan
- exit code: 4

Scan Summary -

        File/Folder         :   /azure_modules/terraform-azurerm-acr
        IaC Type            :   terraform
        Scanned At          :   2021-10-04 07:42:02.6301449 +0000 UTC
        Policies Validated  :   1
        Violated Policies   :   0
        Low                 :   0
        Medium              :   0
        High                :   0


Scan Summary -

        File/Folder         : /azure_modules/terraform-azurerm-acr/examples
        IaC Type            :   terraform
        Scanned At          :   2021-10-04 07:42:02.635467 +0000 UTC
        Policies Validated  :   1
        Violated Policies   :   0
        Low                 :   0
        Medium              :   0
        High                :   0


Scan Summary -

        File/Folder         :  /azure_modules/terraform-azurerm-acr
        IaC Type            :   terraform
        Scanned At          :   2021-10-04 07:42:02.6844968 +0000 UTC
        Policies Validated  :   1
        Violated Policies   :   0
        Low                 :   0
        Medium              :   0
        High                :   0


Scan Summary -

        File/Folder         :   /mnt/c/azure_modules/terraform-azurerm-acr
        IaC Type            :   terraform
        Scanned At          :   2021-10-04 07:42:02.6743944 +0000 UTC
        Policies Validated  :   1
        Violated Policies   :   0
        Low                 :   0
        Medium              :   0
        High                :   0

我的预提交YAML文件如下所示：

cat .pre-commit-config.yaml
repos:
- repo: https://github.com/gruntwork-io/pre-commit
  rev: v0.1.14
  hooks:
    - id: tflint
      args:
        - "--module"
        - "--config=.tflint.hcl"
    - id: terraform-validate
    - id: terraform-fmt
    - id: markdown-link-check
- repo: git://github.com/antonbabenko/pre-commit-terraform
  rev: v1.51.0
  hooks:
    - id: terraform_tfsec
    - id: terraform_docs
    - id: checkov
    - id: terrascan

如何解决这个问题？

Answer 1

下面的代码运行得很好。

terrascan问题：terrascan扫描所有目录中的terraform文件，因此如果它没有找到terraform文件，它将报告为错误。

repos:
- repo: https://github.com/gruntwork-io/pre-commit
  rev: v0.1.14
  hooks:
    - id: tflint
      args:
        - "--module"
        - "--config=.tflint.hcl"
    - id: terraform-validate
    - id: terraform-fmt
    - id: markdown-link-check
- repo: git://github.com/antonbabenko/pre-commit-terraform
  rev: v1.52.0
  hooks:
    - id: terraform_tfsec
    - id: terraform_docs
    - id: checkov
#    - id: terrascan
- repo: https://github.com/accurics/terrascan
  rev: v1.10.0
  hooks:
    - id: terraform-pre-commit
      args: [ '-i terraform --non-recursive examples/docs/']

注意:我已经添加了--non-recursive和example/docs来告诉terrascan不要扫描该目录，因为它没有terraform文件