Empty artifactLocation in SARIF for AVD-AZU-0010

[illrill]

Description

AVD-AZU-0010 does not populate artifact location properly in the SARIF file, which causes github/codeql-action/upload-sarif@v3 to fail.

Same situation as in #7905

Desired Behavior

Populate artifact location in the SARIF properly

Actual Behavior

{
  "version": "2.1.0",
  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
  "runs": [
    **TRIMMED FOR BREVITY**
      "results": [
        {
          "ruleId": "AVD-AZU-0010",
          "ruleIndex": 0,
          "level": "error",
          "message": {
            "text": "Artifact: \nType: azure-arm\nVulnerability AVD-AZU-0010\nSeverity: HIGH\nMessage: Network rules do not allow bypass for Microsoft Services.\nLink: [AVD-AZU-0010](https://avd.aquasec.com/misconfig/avd-azu-0010)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "message": {
                "text": ""
              }
            }
          ]
        }
      ],
      "columnKind": "utf16CodeUnits",
      "originalUriBaseIds": {
        "ROOTPATH": {
          "uri": "***REDACTED***"
        }
      }
    }
  ]
}

Reproduction Steps

1.
2.
3.
...

Target

Filesystem

Scanner

Misconfiguration

Output Format

SARIF

Mode

Standalone

Debug Output

N/A

Operating System

Ubuntu 20

Version

0.63.0

Checklist

• Run trivy clean --all
• Read the troubleshooting

[nikpivkin]

Hi @illrill ! Did you scan the Terraform or the ARM template?

[illrill]

ARM template (pre-converted from Bicep with bicep build)

[nikpivkin]

Track #8984