Write inline ignore rules

Vault Radar supports adding inline ignore rules directly to your source code for sensitive data instead of creating a global ignore rule. You can add an inline ignore rule to any line in your source code using the languages standard comment character such as a # in Python or // in C++ followed by HashiCorpIgnore.

Inline ignore rules are not supported when the sensitive data spans multiple lines.

Ignore rule behavior

When a ignore rule is added, Vault Radar will still generate an event when sensitive data is found during a scan. Any event that matches an ignore rule will have:

1. Severity set to INFO.
2. An Ignore rule flag added.
3. State set to Not important.

HCL example

resource "aws_db_instance" "database" {
  allocated_storage = 5
  engine            = "mysql"
  instance_class    = "db.t2.micro"
  username          = "admin"
  password          = "notasecurepassword" # HashiCorpIgnore

Python example

password = "notasecurepassword"  # HashiCorpIgnore

Java example

String password = "notasecurepassword"; // HashiCorpIgnore

C++ example

string password = "notasecurepassword"; // HashiCorpIgnore

Go example

const password = "b3stp@stw00rd3vA!" // HashiCorpIgnore