False negative AVD-DIG-0004

[nikpivkin]

Trivy doesn't report no ssh keys when I reference a non-existent data source.

Code:

resource "digitalocean_droplet" "this" {
  image    = "ubuntu-18-04-x64"
  name     = "web-1"
  region   = "nyc2"
  size     = "s-1vcpu-1gb"
  ssh_keys = [data.digitalocean_ssh_key.this.id]
}

Output:

trivy conf do-ssh/
2023-10-26T16:04:29.070+0700    INFO    Misconfiguration scanning is enabled
2023-10-26T16:04:29.444+0700    INFO    Detected config files: 2

[simar7]

Closing as discussed offline, the input needs to be valid for Trivy to report misconfigurations.