{"id":50656042,"url":"https://github.com/SonarSource/sonar-iac","last_synced_at":"2026-06-24T20:00:35.155Z","repository":{"id":39404729,"uuid":"366089286","full_name":"SonarSource/sonar-iac","owner":"SonarSource","description":" Static Code Analyser for Infrastructure-as-Code languages such as CloudFormation and Terraform as well as DevOps like Docker and Kubernetes","archived":false,"fork":false,"pushed_at":"2026-06-24T15:20:40.000Z","size":15055,"stargazers_count":57,"open_issues_count":6,"forks_count":10,"subscribers_count":17,"default_branch":"master","last_synced_at":"2026-06-24T15:21:56.725Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SonarSource.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2021-05-10T15:25:26.000Z","updated_at":"2026-06-24T13:50:11.000Z","dependencies_parsed_at":"2024-01-22T07:43:19.729Z","dependency_job_id":"a432336c-129c-4c8e-9690-593e85c63b52","html_url":"https://github.com/SonarSource/sonar-iac","commit_stats":null,"previous_names":[],"tags_count":48,"template":false,"template_full_name":null,"purl":"pkg:github/SonarSource/sonar-iac","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonarSource%2Fsonar-iac","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonarSource%2Fsonar-iac/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonarSource%2Fsonar-iac/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonarSource%2Fsonar-iac/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SonarSource","download_url":"https://codeload.github.com/SonarSource/sonar-iac/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonarSource%2Fsonar-iac/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34747387,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-24T02:00:07.484Z","response_time":106,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-08T00:00:28.186Z","updated_at":"2026-06-24T20:00:35.143Z","avatar_url":"https://github.com/SonarSource.png","language":"Java","funding_links":[],"categories":["IaC Security Scanners"],"sub_categories":["Multi-Framework Scanners"],"readme":"Code Quality and Security for Infrastructure-as-Code\n==========\n[![Build Status](https://github.com/SonarSource/sonar-iac-enterprise/actions/workflows/build.yml/badge.svg?branch=master)](https://github.com/SonarSource/sonar-iac-enterprise/actions/workflows/build.yml?query=branch%3Amaster)\n[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=SonarSource_sonar-iac\u0026metric=alert_status)](https://sonarcloud.io/summary/new_code?id=SonarSource_sonar-iac)\n[![Coverage](https://sonarcloud.io/api/project_badges/measure?project=SonarSource_sonar-iac\u0026metric=coverage)](https://sonarcloud.io/summary/new_code?id=SonarSource_sonar-iac)\n\nThis SonarSource project is a [static code analyzer](https://en.wikipedia.org/wiki/Static_program_analysis) for Infrastructure-as-Code (IaC) languages such as CloudFormation, Kubernetes, and Terraform.\nIt is a component of the [SonarQube Server](https://www.sonarqube.org/) platform, and it runs the IaC features on [SonarQube Cloud](https://sonarcloud.io/).\n\nIt enables developers to produce stable and easily supported [integrated code quality and security](https://www.sonarsource.com/solutions/for-developers/?utm_medium=referral\u0026utm_source=github\u0026utm_campaign=clean-code\u0026utm_content=sonar-iac) by helping you find and correct vulnerabilities and code issues in your projects.\n\n# Features\n* 100+ rules\n* Supports Azure Resource Manager JSON/Bicep\n* Supports CloudFormation JSON/YAML\n* Supports Kubernetes YAML and Helm Charts\n* Supports Dockerfiles\n* Supports Terraform for AWS\n  * HCL native syntax for files named with a .tf suffix (JSON format not supported)\n  * Terraform for Azure and GCP: coming soon\n* Supports configuration files for Spring and Micronaut\n* Domains Covered:\n  * AWS S3 Buckets\n  * Permissions\n  * Encryption at Rest\n  * Encryption at Transit (coming soon)\n  * Traceability (coming soon)\n* Metrics (number of lines, comments, etc.)\n* Import of [cfn-lint](https://community.sonarsource.com/t/sonarcloud-can-scan-terraform-and-cloudformation-files-cfn-lint-support/48550) results\n\n## Useful links\n\n* [SonarSource Community Forum](https://community.sonarsource.com/)\n* [Issue tracking](https://jira.sonarsource.com/projects/SONARIAC)\n\n## Structure\nThis project is one analyzer/plugin that scans and raises issues on files associated with multiple languages.\n\nThe main registration point of the plugin to the API is in `sonar-iac-plugin`. The analyses of the different languages are separated into \"extensions\", \nwhich get loaded by the main plugin class and are structured similarly to other analyzers (i.e., parser, visitors, checks, rule resources, etc.)\n\n## Build \u0026 Test\n\n### Requirements\n* Java 17\n* Docker should be installed to perform the build of the Go part inside a container\n  * In some environments, importing a custom certificate must be performed during the Docker build. Refer to the [dedicated readme](sonar-helm-for-iac/Readme.md#build-docker-image) for more details.\n* Alternatively, to replicate CI setup and use system Go toolchain, set environment variable `CI=true`. Go 1.23 and the following dependencies are needed:\n  * musl on Linux (`musl-gcc` should be present on `PATH`)\n\n### Setup\nTo configure build dependencies, run the following command:\n\n```shell\ngit submodule update --init -- build-logic/common\n```\nTo always get the latest version of the build logic during git operations, set the following configuration:\n\n```shell\ngit config submodule.recurse true\n```\nFor more information see [README.md](https://github.com/SonarSource/cloud-native-gradle-modules/blob/master/README.md) of cloud-native-gradle-modules.\n\n### Build and run unit tests:\n```shell\n./gradlew build\n```\n\n### Build without running unit tests:\n\n```shell\n./gradlew build -x test\n```\n\n### Certificate issue during the build\nIf you are behind a corporate proxy, you might encounter certificate issues during the build, with following error:\n\n```text\nERROR: failed to solve: failed to compute cache key: failed to calculate checksum of ref xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx::yyyyyyyyyyyyyyyyyyyyyyyy: \"/Sonar-FGT-FW-TLS-Traffic-Inspection.cer\": not found\n```\n\nTo fix the issue please copy the certificate to `sonar-helm-for-iac` directory or specify `-DtrafficInspection=false` property during the build:\n\n```shell\n./gradlew -DtrafficInspection=false build\n```\n\n### Fix code formatting issues\n\nDuring the Gradle build, a spotless formatting check is executed.\nThis check can also be triggered manually with `./gradlew spotlessCheck`.\nIt checks if the code is correctly formatted using standard Sonar rules.\nIf your build failed, you can fix the formatting just by running:\n\n```shell\n./gradlew spotlessApply\n```\n\n### Fix license packaging issues\nDuring the Gradle build, a license packaging check is executed.\nThis check can also be triggered manually with `./gradlew validateLicenseFiles`.\nIt checks if the license files of third party libraries are correctly packaged to the resource folder according to SonarSource standards.\nSince sonar-iac bundles a go binary, we are also including the licenses of all used go dependencies.\n\nIf your build failed, you can fix the license packaging by running:\n\n```shell\n./gradlew generateLicenseResources\n```\n\nNote that this overwrites your current license files in the `resources/licenses` folder.\n\nTo update or generate rule descriptions, create a Fine-grained GitHub access token for the RSPEC repository (https://github.com/SonarSource/rspec) with read-only permission and set it as an environment variable named GITHUB_TOKEN.\n\n### Update rule description\n\nUpdate all rule descriptions.\n\n```shell\n./gradlew ruleApiUpdate\n```\n\nUpdate all rule descriptions for a specific language.\n\n```shell\n./gradlew ruleApiUpdateArm\n./gradlew ruleApiUpdateCloudformation\n./gradlew ruleApiUpdateDocker\n./gradlew ruleApiUpdateKubernetes\n./gradlew ruleApiUpdateTerraform\n```\n\n### Generate new rule description\n\nTo fetch static files for a rule SXXXX from RSPEC for one of the languages, execute the following command:\n```shell\n./gradlew ruleApiGenerateRuleArm -Prule=SXXXX\n./gradlew ruleApiGenerateRuleCloudformation -Prule=SXXXX\n./gradlew ruleApiGenerateRuleDocker -Prule=SXXXX\n./gradlew ruleApiGenerateRuleKubernetes -Prule=SXXXX\n./gradlew ruleApiGenerateRuleTerraform -Prule=SXXXX\n```\n\nAdditionally, an optional property `-Pbranch=\u003cbranch name\u003e` can be set to fetch rule metadata from a specific branch.\n\n### Generate metadata for external linter rules\n\nTo update rules from external linters (Hadolint, TFLint, CfnLint, Ansible Lint) from their upstream sources, execute the following command:\n\n```shell\n./gradlew generateExternalRules\n```\n\nThis will update all external linter rules across all extensions. To update rules for a specific extension, run the task `generateExternalRules` on a specific Gradle subproject, for example :iac-extensions:terraform:generateExternalRules`.\n\nThese tasks automatically download the latest rule documentation from upstream sources and regenerate the `rules.json` files.\n\n# License\n\nCopyright 2021-2026 SonarSource.\n\nSonarQube analyzers released after November 29, 2024, including patch fixes for prior versions,\nare published under the [Sonar Source-Available License Version 1 (SSALv1)](LICENSE.txt).\n\nSee individual files for details that specify the license applicable to each file.\nFiles subject to the SSALv1 will be noted in their headers.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FSonarSource%2Fsonar-iac","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FSonarSource%2Fsonar-iac","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FSonarSource%2Fsonar-iac/lists"}