Describe the issue: the --create-baseline / --baseline skipping mechanism matches by resource address + check id only, ignoring which file the resource is in. This lets a violation in one file silently absorb an unrelated violation of the same check in a different file, as long as the Terraform resource address happens to match (a common pattern, e.g. aws_s3_bucket.this).
Repro, checkov 3.3.11:
Step 1) main.tf has aws_s3_bucket.this with a CKV_AWS_18 violation. Run checkov --create-baseline. Baseline stores resource=aws_s3_bucket.this, check_ids=[CKV_AWS_18].
Step 2) Fix that violation for real in main.tf.
Step 3) Add environments/staging/main.tf with a different, unrelated aws_s3_bucket.this resource that also violates CKV_AWS_18.
Step 4) Run checkov -d . with no baseline: 1 failed check, the new one, correctly detected.
Step 5) Run checkov -d . --baseline .checkov.baseline: 0 failed checks.
Actual: the new violation, in a totally different file, is absorbed by the baseline.
Expected: the baseline should only suppress the specific (file, resource, check) it recorded, not any resource sharing the same address anywhere in the repo.
Why: _is_check_in_baseline (checkov/common/output/baseline.py) matches on finding["resource"] == check.resource and check_id in finding["check_ids"]. The stored "file" key from the baseline JSON is never compared in that function.
Version: Checkov 3.3.11
Suggest: include file path in the baseline match, not just resource address + check id.
Reproduced locally, not just read from source. Background, optional: https://doi.org/10.5281/zenodo.21908527
Describe the issue: the --create-baseline / --baseline skipping mechanism matches by resource address + check id only, ignoring which file the resource is in. This lets a violation in one file silently absorb an unrelated violation of the same check in a different file, as long as the Terraform resource address happens to match (a common pattern, e.g. aws_s3_bucket.this).
Repro, checkov 3.3.11:
Step 1) main.tf has aws_s3_bucket.this with a CKV_AWS_18 violation. Run checkov --create-baseline. Baseline stores resource=aws_s3_bucket.this, check_ids=[CKV_AWS_18].
Step 2) Fix that violation for real in main.tf.
Step 3) Add environments/staging/main.tf with a different, unrelated aws_s3_bucket.this resource that also violates CKV_AWS_18.
Step 4) Run checkov -d . with no baseline: 1 failed check, the new one, correctly detected.
Step 5) Run checkov -d . --baseline .checkov.baseline: 0 failed checks.
Actual: the new violation, in a totally different file, is absorbed by the baseline.
Expected: the baseline should only suppress the specific (file, resource, check) it recorded, not any resource sharing the same address anywhere in the repo.
Why: _is_check_in_baseline (checkov/common/output/baseline.py) matches on finding["resource"] == check.resource and check_id in finding["check_ids"]. The stored "file" key from the baseline JSON is never compared in that function.
Version: Checkov 3.3.11
Suggest: include file path in the baseline match, not just resource address + check id.
Reproduced locally, not just read from source. Background, optional: https://doi.org/10.5281/zenodo.21908527