Discrepancy between the detected misconfig and the rule on the aqua site

[nikpivkin]

I have the following configuration:

resource "aws_s3_bucket" "test" {
  bucket = "my.bucket"
}

The Trivy report contains the following misconfiguration:

MEDIUM: S3 bucket name is not compliant with DNS naming requirements
════════════════════════════════════════════════════════════════════════════════════════════════════════════
Ensures that S3 buckets have DNS complaint bucket names.

See https://avd.aquasec.com/misconfig/n/a
────────────────────────────────────────────────────────────────────────────────────────────────────────────
 main.tf:2
────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   resource "aws_s3_bucket" "test" {
   2 [   bucket = "my.bucket"
   3   }
────────────────────────────────────────────────────────────────────────────────────────────────────────────

But on the aqua vulnerability database website, the severity is listed as unknown. Also the link to the rule is incorrect.

[simar7]

But on the aqua vulnerability database website, the severity is listed as unknown. Also the link to the rule is incorrect.

What did you expect to see?

[nikpivkin]

@simar7 What is the true severity information on the website or in the Trivy report? Also I would like to see the correct link, not https://avd.aquasec.com/misconfig/n/a

[simar7]

Ah - yeah we haven't updated the generator with the new version of defsec which would include these rules. Here's a PR to tackle this aquasecurity/avd-generator#73

[simar7]

Should have the fix in the next release of AVD pages (happens, once a day).

Generated link here https://avd.aquasec.com/misconfig/aws/s3/avd-aws-0320/