Regarding this issue this is the approach we are thinking of:

Users would be able to use two comments as commands in order to ignore specific lines

• kics ignore-block
• kics ignore-line

kics ignore-block

This command ignores the object and all its key-value pairs beneath the line of the command

kics ignore-line

This command ignores the line beneath the line of the command

Dockerfile

• line 6 is ignored from the comment on line 5
• line 10, 11 are ignored from the comment on lines 9
• line 15, 16, 17, 18 (whole from the block) are ignored from the comment on lines 14

Terraform

• lines 4, 5, 6 are ignored from the comment on line 3
• lines 11, 12, 13 are ignored from the comments on line 10
• line 18 is ignored from the comment on line 17

YAML

• lines 4, 5 are ignored from the comment on lines 3
• line 11 is ignored from the comment on lines 10
• lines 17, 18, 19 are ignored from the comment on lines 16
• lines 22, 23, 24, 25 are ignored from the comment on lines 21

JSON

It is not possible to add this feature since JSON files don't support comments

@joaoReigota1 It would be great !

This does not work:

Tried this:

// kics ignore-block
resource "aws_s3_bucket" "bucket" {
#checkov:skip=CKV_AWS_144:This bucket is not required to have cross-region replication enabled because it only contains test data.
count = local.create_bucket ? 1 : 0
bucket = var.bucket_name
force_destroy = var.force_destroy
object_lock_enabled = var.object_lock_enabled
}

#######################

Log Bucket creation

#######################
// kics ignore-block
resource "aws_s3_bucket" "log_bucket" {
#checkov:skip=CKV_AWS_144:This bucket is not required to have cross-region replication enabled because it only contains test data.
count = local.create_bucket ? 1 : 0
bucket = var.log_bucket_name
}

Tried this:

###################

Bucket creation

###################
#kics ignore-line
resource "aws_s3_bucket" "read_only_bucket" {
#checkov:skip=CKV_AWS_144:This is too aggressive for most cases. This should depend on the data being stored.
#kics ignore-line
bucket = var.bucket_name_read_only
}

#######################

Log Bucket creation

#######################
#kics ignore-line
resource "aws_s3_bucket" "read_only_log_bucket" {
#checkov:skip=CKV_AWS_144:This is too aggressive for most cases. This should depend on the data being stored.
#kics ignore-line
bucket = var.log_bucket_name_read_only
}

Still shows up in report

@balq60 The comment needs to start with kics-scan, not kics. See https://github.com/Checkmarx/kics/blob/master/docs/running-kics.md