Project: Trivy (Provisioning / Security & Compliance)
File: config-file.md

Trivy can be customized by tweaking a `trivy.yaml` file. The config path can be overridden by the `--config` flag. An example is . ```yaml quiet: false debug: false insecure: false timeout: 10m cache: dir: $HOME/.cache/trivy ``` ```yaml format: table report: all template: dependency-tree: false list-all-pkgs: false ignorefile: .trivyignore ignore-policy: exit-code: 0 exit-on-eol: 0 output: severity: UNKNOWN LOW MEDIUM HIGH CRITICAL scan: compliance: show-suppressed: false ``` Available in client/server mode ```yaml scan: file-patterns: skip-dirs: usr/local/ etc/ skip-files: package-dev.json offline: false scanners: vuln misconfig secret license parallel: 1 sbom-sources: oci rekor rekor-url: https://rekor.sigstore.dev include-dev-deps: false ``` ```yaml cache: backend: 'fs' ttl: 0 redis: tls: ca: cert: key: ``` ```yaml db: no-progress: false skip-update: false repository: ghcr.io/aquasecurity/trivy-db:2 java-skip-update: false java-repository: ghcr.io/aquasecurity/trivy-java-db:1 ``` ```yaml registry: username: password: registry-token: ``` Available with container image scanning ```yaml image: input: removed-pkgs: false platform: source: podman docker image-config-scanners: misconfig secret docker: host: podman: host: ``` Available with vulnerability scanning ```yaml vulnerability: type: os library ignore-unfixed: false ignore-status: endoflife ``` Available with license scanning ```yaml license: full: false ignored: MPL-2.0 MIT confidenceLevel: 0.9 forbidden: AGPL-1.0 AGPL-3.0 restricted: AGPL-1.0 AGPL-3.0 reciprocal: AGPL-1.0 AGPL-3.0 notice: AGPL-1.0 AGPL-3.0 permissive: AGPL-1.0 AGPL-3.0 unencumbered: AGPL-1.0 AGPL-3.0 ``` Available with secret scanning ```yaml secret: config: config/trivy/secret.yaml ``` ```yaml rego: trace: false skip-policy-update: false policy: policy/repository policy/custom policy/some-policy.rego data: data/ namespaces: opa.examples users ``` Available with misconfiguration scanning ```yaml misconfiguration: include-non-failures: false include-deprecated-checks: false check-bundle-repository: ghcr.io/aquasecurity/trivy-checks:0 scanners: dockerfile terraform helm: set: securityContext.runAsUser=10001 values: overrides.yaml set-file: image=dev-overrides.yaml set-string: name=true api-versions: policy/v1/PodDisruptionBudget apps/v1/Deployment kube-version: "v1.21.0" terraform: vars: dev-terraform.tfvars common-terraform.tfvars exclude-downloaded-modules: false cloudformation: params: params.json ``` Available with Kubernetes scanning ```yaml kubernetes: context: namespace: kubeconfig: ~/.kube/config2 components: workload infra k8s-version: 1.21.0 tolerations: key1=value1:NoExecute key2=value2:NoSchedule all-namespaces: false node-collector: namespace: ~/.kube/config2 imageref: ghcr.io/aquasecurity/node-collector:0.0.9 exclude: owned: true nodes: kubernetes.io/arch:arm64 team:dev qps: 5.0 burst: 10 ``` Available with git repository scanning (`trivy repo`) ```yaml repository: branch: commit: tag: ``` Available in client/server mode ```yaml server: addr: http://localhost:4954 token: "something-secret" token-header: 'My-Token-Header' custom-headers: scanner: trivy x-api-token: xxx listen: 0.0.0.0:10000 ``` Available for cloud scanning (currently only `trivy aws`) ```yaml cloud: update-cache: false max-cache-age: 24h aws: region: us-east-1 endpoint: https://my.custom.aws.endpoint account: 123456789012 service: s3 ec2 arn: arn:aws:s3:::example-bucket skip-service: s3 ec2 ``` Available for modules ```yaml module: dir: $HOME/.trivy/modules enable-modules: trivy-module-spring4shell trivy-module-wordpress ```