The Sonar CloudFormation Plugin integrates CloudFormation security checks into SonarQube, leveraging popular tools such as cfn-nag and Checkov to enhance Infrastructure as Code (IaC) security.

Overview

This plugin allows for the incorporation of CloudFormation and Terraform template rules into your SonarQube quality profiles, ensuring that security best practices are followed. With compatibility for various SonarQube versions, the plugin supports:

• cfn-nag for basic CloudFormation security checks.
• Checkov for extensive security scanning across Terraform configurations.

Compatibility

• 1.7.3 (EOL) versions work with SonarQube >= 7.6 and <= 8.9.x, supporting cfn-nag only.
• 2.1.8 (EOL) versions are compatible with SonarQube >= 7.9 and <= 8.9.x, requiring JSON or YAML plugin support for both cfn-nag and Checkov.
• 3.x versions function with SonarQube >= 9.2, utilizing built-in capabilities for Terraform and CloudFormation, while supporting both cfn-nag and Checkov.

Configuration

Configure quality profiles in SonarQube to apply CloudFormation/Terraform rules. Detailed installation instructions can be found on the releases page.

Example Installation Run the following commands to set up the plugin in a demo Docker instance:

# Run SonarQube Docker instance
docker run -d --name sonarqube -p 9000:9000 sonarqube:latest

docker exec -it sonarqube /bin/bash
cd /opt/sonarqube/extensions/plugins
wget https://search.maven.org/remotecontent?filepath=com/hack23/sonar/sonar-cloudformation-plugin/3.0.10/sonar-cloudformation-plugin-3.0.10.jar --no-check-certificate
exit

docker restart sonarqube

Access the SonarQube dashboard at http://localhost:9000 to view installed profiles.

Utilizing cfn-nag and Checkov Reports

To prepare cfn-nag reports:

cfn_nag --output-format=json src/main/config/template.yml > target/template.yml.nag
sonar.cfn.nag.reportFiles=target/template.yml.nag

Alternatively, for Checkov reports:

checkov -f template.yml -o json --output-file-path template.checkov-report
sonar.checkov.reportFiles=template.checkov-report

Compliance and Security Standards

The plugin facilitates compliance with industry standards by mapping rules to common vulnerabilities such as CWE and NIST SP 800-53, aiding teams in maintaining secure coding practices in their CloudFormation and Terraform templates.

Note

This project is currently not maintained. Users are encouraged to fork the repository for personal customization or updates.