Let every exception expire

How to do it

Teams skip a check for a good reason, then forget it. Write each skip next to the resource, with the reason and the date. Trivy reads an end date in its own syntax, such as exp:2026-12-31. For other tools, a short script checks the date. Allow at most 90 days, and renew only after a new review.

Example

# Public product images, owner web-team
#trivy:ignore:AVD-AWS-0086:exp:2026-12-31
resource "aws_s3_bucket" "public_assets" {
  #checkov:skip=CKV_AWS_20: public product images, owner web-team, until 2026-12-31
  bucket = "example-shop-public-assets"
}

# python check_skips.py infra/
import pathlib, re, sys
from datetime import date

SKIP = re.compile(r"#checkov:skip=\S+:.*until (\d{4}-\d{2}-\d{2})")
expired = []
for path in pathlib.Path(sys.argv[1]).rglob("*.tf"):
    for number, line in enumerate(path.read_text().splitlines(), start=1):
        match = SKIP.search(line)
        if "checkov:skip" in line and (not match or date.fromisoformat(match[1]) < date.today()):
            expired.append(f"{path}:{number}")
print("\n".join(expired))
sys.exit(1 if expired else 0)

// node check-skips.mjs infra/
import { readFileSync, readdirSync } from 'node:fs';
import path from 'node:path';

const SKIP = /#checkov:skip=\S+:.*until (\d{4}-\d{2}-\d{2})/;
const today = new Date().toISOString().slice(0, 10);
const files = readdirSync(process.argv[2], { recursive: true }).filter(name => name.endsWith('.tf'));
const expired = files.flatMap(name => readFileSync(path.join(process.argv[2], name), 'utf8').split('\n')
  .map((line, index) => ({ line, where: `${name}:${index + 1}` }))
  .filter(({ line }) => line.includes('checkov:skip') && !(SKIP.exec(line)?.[1] >= today))
  .map(({ where }) => where));
console.log(expired.join('\n'));
process.exit(expired.length ? 1 : 0);

How to check

Set a skip's date to yesterday in a test branch. The build fails and names the file and line.