我们可以使用 sonarqube 从 Terraform 和 azure devops ci/cd 管道扫描（基础设施即代码）IaC 吗？

Question

can we use sonarqube to scan IaC code ( not application code ) ( IaC code here meaning is terraform code to create Azure infrastructure such as RBAC, PIM, allowed locations etc) for error and vulnerabilities with Azure DevOps CI/CD pipelines?

i found some link but not sure?

https://registry.terraform.io/providers/jdamata/sonarqube/latest/docs/resources/sonarqube_qualitygate_project_association

Answer 1

I confirm SonarSource (SonarQube, SonarCloud, SonarLint) doesn't provide yet any feature to scan IaC files (Terraform, CloudFormation, ...). This is part of our 2021 roadmap to bring features to secure Cloud Native apps which include to raise issues on your IaC files. The work just started on our side, so don't expect this to come soon but more starting from Q3.

Answer 2

There is no SonarQube plugin for analyzing Terraform code. You can use Terrascan or TFLint as static analysis tool.

https://github.com/accurics/terrascan

https://github.com/terraform-linters/tflint

Answer 3

Here is another one ==> oak9 ( www.oak9.io ). It focuses on securing your application architecture by analyzing your IaC. It has a number of features including out-of-the-box security and compliance blueprints, integrations across CI/CD toolsets & code-repositories, integrations with different cloud service providers and a lot more. Full disclosure - I work on the security team here

Answer 4

U can try referring this link but its missed alot features as an iaac.

https://www.sonarqube.org/features/multi-languages/terraform/