Deprecated check AVD-AWS-0088 fails my Trivy config scan

[danielelisi]

IDs

AVD-AWS-0088

Description

The Trivy check avd-aws-0088 is marked as deprecated but it still gets included in the Trivy report and makes my scan fail. Deprecated checks should only be included when using the --include-deprecated-checks flag.

$ trivy config --severity HIGH,CRITICAL --exit-code 1 ${TF_PLAN_PATH}.tfplan.json
2025-12-06T00:38:00Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-12-06T00:38:01Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-12-06T00:38:01Z	INFO	Detected config files	num=2
Report Summary
┌─────────┬───────────────┬───────────────────┐
│ Target  │     Type      │ Misconfigurations │
├─────────┼───────────────┼───────────────────┤
│ .       │ terraformplan │         0         │
├─────────┼───────────────┼───────────────────┤
│ main.tf │ terraformplan │         2         │
└─────────┴───────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)
main.tf (terraformplan)
=======================
Tests: 2 (SUCCESSES: 0, FAILURES: 2)
Failures: 2 (HIGH: 2, CRITICAL: 0)

AVD-AWS-0088 (HIGH): Bucket does not have encryption enabled
════════════════════════════════════════
S3 Buckets should be encrypted to protect the data that is stored within them if access is compromised.
See https://avd.aquasec.com/misconfig/avd-aws-0088
────────────────────────────────────────
 main.tf:771-777
   via main.tf:770-778 (server_side_encryption_configuration)
    via main.tf:739-782 (aws_s3_bucket.cdn_62aaec90aa0ff6e3ec0783864ed0bdd4)
────────────────────────────────────────
 739   resource "aws_s3_bucket" "cdn_62aaec90aa0ff6e3ec0783864ed0bdd4" {
 ...   
 771 ┌ 	rule {
 772 │ 	apply_server_side_encryption_by_default = {
 773 │ 	kms_master_key_id = ""
 774 │ 	sse_algorithm = "AES256"
 775 │ }
 776 │ 	bucket_key_enabled = false
 777 └ }
 ...   
────────────────────────────────────────
AVD-AWS-0088 (HIGH): Bucket does not have encryption enabled
════════════════════════════════════════
S3 Buckets should be encrypted to protect the data that is stored within them if access is compromised.
See https://avd.aquasec.com/misconfig/avd-aws-0088
────────────────────────────────────────
 main.tf:1320-1326
   via main.tf:1319-1327 (server_side_encryption_configuration)
    via main.tf:1287-1331 (aws_s3_bucket.this_923a314a34a2a5bb8b5f270b88aa5555)
────────────────────────────────────────
1287   resource "aws_s3_bucket" "this_923a314a34a2a5bb8b5f270b88aa5555" {
....   
1320 ┌ 	rule {
1321 │ 	apply_server_side_encryption_by_default = {
1322 │ 	kms_master_key_id = ""
1323 │ 	sse_algorithm = "AES256"
1324 │ }
1325 │ 	bucket_key_enabled = false
1326 └ }
....   
────────────────────────────────────────

Reproduction Steps

Created an S3 bucket with AWS managed keys

Target

AWS

Scanner

Misconfiguration

Target OS

No response

Debug Output

2025-12-08T19:14:43Z	DEBUG	No plugins loaded
2025-12-08T19:14:43Z	DEBUG	Default config file "file_path=[redacted]" not found, using built in values
2025-12-08T19:14:43Z	DEBUG	Cache dir	dir="[redacted]/"
2025-12-08T19:14:43Z	DEBUG	Cache dir	dir="[redacted]/"
2025-12-08T19:14:43Z	DEBUG	Parsed severities	severities=[HIGH CRITICAL]
2025-12-08T19:14:43Z	INFO	[misconfig] Misconfiguration scanning is enabled
2025-12-08T19:14:43Z	DEBUG	[misconfig] Checks successfully loaded from disk
2025-12-08T19:14:43Z	DEBUG	[notification] Running version check
2025-12-08T19:14:43Z	DEBUG	[notification] Version check completed	latest_version="0.68.1"
2025-12-08T19:14:44Z	DEBUG	[rego] Overriding filesystem for checks
2025-12-08T19:14:44Z	DEBUG	[rego] Embedded libraries are loaded	count=17
2025-12-08T19:14:44Z	DEBUG	[rego] Embedded checks are loaded	count=519
2025-12-08T19:14:44Z	DEBUG	[rego] Checks from disk are loaded	count=536
2025-12-08T19:14:44Z	DEBUG	[rego] Overriding filesystem for data
2025-12-08T19:14:44Z	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-12-08T19:14:44Z	DEBUG	Initializing scan cache...	type="memory"
2025-12-08T19:14:44Z	DEBUG	[fs] Analyzing...	root="[redacted]"
2025-12-08T19:14:44Z	DEBUG	[fs] Random cache key will be used	err="failed to open git repository: stat [redacted]: not a directory"
2025-12-08T19:14:44Z	DEBUG	Created process-specific temp directory	path="/tmp/[redacted]"
2025-12-08T19:14:45Z	DEBUG	[misconfig] Scanning files for misconfigurations...	scanner="Terraform Plan JSON"
2025-12-08T19:14:45Z	DEBUG	[tfjson scanner] Scanning file	file_path="[redacted]"
2025-12-08T19:14:45Z	DEBUG	[terraform scanner] Scanning directory	file_path="."
2025-12-08T19:14:45Z	DEBUG	[terraform parser] Setting project/module root	module="root" file_path="."
2025-12-08T19:14:45Z	DEBUG	[terraform parser] Parsing FS	module="root" file_path="."
2025-12-08T19:14:45Z	DEBUG	[terraform parser] Parsing	module="root" file_path="main.tf"
2025-12-08T19:14:45Z	DEBUG	[terraform parser] Added file	module="root" file_path="main.tf"
2025-12-08T19:14:45Z	INFO	[terraform scanner] Scanning root module	file_path="."
2025-12-08T19:14:45Z	DEBUG	[terraform parser] Setting project/module root	module="root" file_path="."
2025-12-08T19:14:45Z	DEBUG	[terraform parser] Parsing FS	module="root" file_path="."
2025-12-08T19:14:45Z	DEBUG	[terraform parser] Parsing	module="root" file_path="main.tf"
2025-12-08T19:14:45Z	DEBUG	[terraform parser] Added file	module="root" file_path="main.tf"
2025-12-08T19:14:45Z	DEBUG	[terraform parser] Loading module	module="root" module="root"
2025-12-08T19:14:45Z	DEBUG	[terraform parser] Read block(s) and ignore(s)	module="root" blocks=72 ignores=0
2025-12-08T19:14:45Z	DEBUG	[terraform parser] Added input variables from tfvars	module="root" count=13
2025-12-08T19:14:45Z	DEBUG	[terraform parser] Working directory for module evaluation	module="root" file_path="[redacted]"
2025-12-08T19:14:45Z	DEBUG	[terraform evaluator] Starting module evaluation...	module="root" path="."
2025-12-08T19:14:45Z	DEBUG	[terraform evaluator] Starting iteration	module="root" iteration=0
2025-12-08T19:14:45Z	DEBUG	[terraform evaluator] Starting iteration	module="root" iteration=1
2025-12-08T19:14:45Z	DEBUG	[terraform evaluator] Context unchanged	module="root" iteration=1
2025-12-08T19:14:45Z	DEBUG	[terraform evaluator] Starting post-submodules evaluation...	module="root"
2025-12-08T19:14:45Z	DEBUG	[terraform evaluator] Starting iteration	module="root" iteration=0
2025-12-08T19:14:45Z	DEBUG	[terraform evaluator] Starting iteration	module="root" iteration=1
2025-12-08T19:14:45Z	DEBUG	[terraform evaluator] Context unchanged	module="root" iteration=1
2025-12-08T19:14:45Z	DEBUG	[terraform evaluator] Module evaluation complete.	module="root"
2025-12-08T19:14:45Z	DEBUG	[terraform parser] Finished parsing module	module="root"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] Adapting modules...
2025-12-08T19:14:45Z	DEBUG	[terraform executor] Adapted module(s) into state data.	count=1
2025-12-08T19:14:45Z	DEBUG	[terraform executor] Scan state data
2025-12-08T19:14:45Z	DEBUG	[rego] Scanning inputs	count=1
2025-12-08T19:14:45Z	DEBUG	[terraform executor] Finished applying checks
2025-12-08T19:14:45Z	DEBUG	[terraform executor] Applying ignores...
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching Terraform block found	cause_range="main.tf:259-277"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching Terraform block found	cause_range="main.tf:259-277"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching Terraform block found	cause_range="main.tf:469-548"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching Terraform block found	cause_range="main.tf:259-277"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching Terraform block found	cause_range="main.tf:317-362"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching Terraform block found	cause_range="main.tf:561-604"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching Terraform block found	cause_range="main.tf:259-277"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching Terraform block found	cause_range="main.tf:317-362"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching Terraform block found	cause_range="main.tf:561-604"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching Terraform block found	cause_range="main.tf:259-277"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching block attribute found	cause_range="main.tf:351-357"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching block attribute found	cause_range="main.tf:593-599"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching Terraform block found	cause_range="main.tf:259-277"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching Terraform block found	cause_range="main.tf:259-277"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching Terraform block found	cause_range="main.tf:259-277"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching Terraform block found	cause_range="main.tf:259-277"
2025-12-08T19:14:45Z	DEBUG	[terraform executor] No matching Terraform block found	cause_range="main.tf:469-548"
2025-12-08T19:14:45Z	DEBUG	OS is not detected.
2025-12-08T19:14:45Z	INFO	Detected config files	num=2
2025-12-08T19:14:45Z	DEBUG	Scanned config file	file_path="."
2025-12-08T19:14:45Z	DEBUG	Scanned config file	file_path="main.tf"
2025-12-08T19:14:45Z	DEBUG	Found an ignore file	file_path="[redacted]"
2025-12-08T19:14:45Z	DEBUG	Ignored	id="AVD-AWS-0132" target="main.tf"
2025-12-08T19:14:45Z	DEBUG	Ignored	id="AVD-AWS-0132" target="main.tf"
2025-12-08T19:14:45Z	DEBUG	Ignored	id="AVD-AWS-0132" target="main.tf"
2025-12-08T19:14:45Z	DEBUG	[vex] VEX filtering is disabled

Version

0.68.1

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[simar7]

hi @danielelisi thanks for sharing, could you help us debug a bit here by sharing what's the output of trivy version? I wonder if you have a really old checks bundle where the check isn't deprecated.

[danielelisi]

Trivy version 0.68.1

[nikpivkin]

Hi @danielelisi !

The updated version of the check is not yet shipping with the checks bundle. It will be included in this release.

[danielelisi]

Ah I see! Thanks for the info all good then I'll just ignore it in trivyignore 😄