feat(terraform): update Trivy configuration and add .trivyignore file

Author: pauldotyu

.github/workflows/audit-terraform.yml

@@ -7,12 +7,12 @@ name: Scan Terraform code
 
 on:
   push:
-    branches: 
+    branches:
       - main
     paths:
       - "infra/terraform/**"
   pull_request:
-    branches: 
+    branches:
       - main
     paths:
       - "infra/terraform/**"
@@ -34,16 +34,17 @@ jobs:
       - name: Run Trivy vulnerability scanner in IaC mode for Terraform
         uses: aquasecurity/trivy-action@b2933f565dbc598b29947660e66259e3c7bc8561 # 0.20.0
         with:
-          scan-type: 'config'
-          scan-ref: './infra/terraform'
+          scan-type: "config"
+          scan-ref: "./infra/terraform"
           hide-progress: true
-          format: 'sarif'
-          output: 'trivy-terraform-results.sarif'
-          exit-code: '1'
+          format: "sarif"
+          output: "trivy-terraform-results.sarif"
+          exit-code: "1"
           ignore-unfixed: true
-          severity: 'CRITICAL,HIGH'
+          severity: "CRITICAL,HIGH"
+          trivyignores: "./infra/terraform/.trivyignore"
 
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@e14ec90e52a057614c707baecf2ed88a81b68bc9 # v2
         with:
-          sarif_file: 'trivy-terraform-results.sarif'
+          sarif_file: "trivy-terraform-results.sarif"

infra/terraform/.trivyignore

@@ -0,0 +1,6 @@
+# Ignore misconfigurations
+
+# https://avd.aquasec.com/misconfig/azure/container/avd-azu-0040/
+# This rule wants to set a property that is set conditionally in the code.
+# Not all deployments will have this to save on costs.
+AVD-AZU-0040