sonar-cloudformation-plugin
Cloudformation template rules (cfn-nag,checkov) but also Terraform.
Compatibility
This plugin is compatible:
- 1.7.3(EOL) versions with SonarQube >= 7.6 and = 8.9.x. (Defines cloudformation language only supports cfn-nag) * 2.1.8 versions with SonarQube = 7.9 and = 8.9.x. (Requires json or/and yaml plugin supports cfn-nag/checkov) * 3.x version with SonarQube = 9.2 (Uses built in support for terraform/cloudformation supports cfn-nag/checkov)
# Demo links
Demo Sonarqube quality profile(Cloudformation) : Demo Sonarqube quality profile(Terraform) : Demo Sonarqube quality rules : Demo Sonarqube quality issues :
Configuration of Quality profiles
The Cloudformation/Terraform rules can added as Quality profile you decided to use.
Howto
Cfn-nag
Prepare cfn_nag reports running (cfn_nag --output-format=json src/main/config/template.yml > target/template.yml.nag) and set the property sonar.cfn.nag.reportFiles=target/template.yml.nag (comma separated if multiple reports)
Or scan directories using cfn_nag_scan running (cfn_nag_scan --input-path src/main/config/ -o json -> target/cfn-nag-scan.nagscan) and set the property sonar.cfn.nag.reportFiles=target/cfn-nag-scan.nagscan
Properties supported
sonar.cfn.nag.reportFiles=target/template.yml.nag,target/cfn-nag-scan.nagscan
One or multiple .nag or .nagscan files, note for .nag files the filename should be template filename appended with .nag and for nag_scan any filename with .nagscan suffix.
Custom cfn-nag rules or rules not yet defined
Will be mapped to "Custom cfn-nag failure rule or rule missing integration in this plugin." alt Custom cfn-nag warning rule or rule missing integration in this plugin. Assumes all failures start with uppercase F and all warnings with uppercase W.
Checkov reports
Prepare checkov reports running (checkov -f template.yml -o json > template.checkov-report) and set the property sonar.checkov.reportFiles=template.checkov-report (comma separated if multiple reports)
Properties supported
sonar.checkov.reportFiles=template.checkov-report
One or multiple checkov report files, note for .checkov-report files the filename should be template filename appended with checkov-report.
Custom checkov rules or rules not yet defined
Will be mapped to "Custom checkov failure rule or rule missing integration in this plugin." alt Custom checkov warning rule or rule missing integration in this plugin.
Roadmap
Support more cloudformation checkers and add more rules for cfn_nag.
Group the rules to CWE
CWE-311 - Missing Encryption of Sensitive Data https://cwe.mitre.org/data/definitions/311
CWE-326 - Inadequate Encryption Strength https://cwe.mitre.org/data/definitions/326
CWE-732 - Incorrect Permission Assignment for Critical Resource https://cwe.mitre.org/data/definitions/732
CWE-257 - Storing Passwords in a Recoverable Format https://cwe.mitre.org/data/definitions/257
CWE-778 - Insufficient Logging https://cwe.mitre.org/data/definitions/778
CWE-272 - Least Privilege Violation https://cwe.mitre.org/data/definitions/272
CWE-286 - Incorrect User Management https://cwe.mitre.org/data/definitions/286
CWE-770 - Allocation of Resources Without Limits or Throttling https://cwe.mitre.org/data/definitions/770
CWE-779 - Logging of Excessive Data https://cwe.mitre.org/data/definitions/779.html
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor https://cwe.mitre.org/data/definitions/200.htm
No CWE associated
Group the rules to NIST 800-53
800-53-AC-4 AC-4 INFORMATION FLOW ENFORCEMENT https://nvd.nist.gov/800-53/Rev4/control/AC-4
800-53-AC-6 AC-6 LEAST PRIVILEGE https://nvd.nist.gov/800-53/Rev4/control/AC-6
800-53-AU-12 AU-12 AUDIT GENERATION https://nvd.nist.gov/800-53/Rev4/control/AU-12
800-53-IA-5 IA-5 AUTHENTICATOR MANAGEMENT https://nvd.nist.gov/800-53/Rev4/control/IA-5
800-53-SC-5 SC-5 DENIAL OF SERVICE PROTECTION https://nvd.nist.gov/800-53/Rev4/control/SC-5
800-53-SC-7 SC-7 BOUNDARY PROTECTION https://nvd.nist.gov/800-53/Rev4/control/SC-7
800-53-SC-8 SC-8 TRANSMISSION CONFIDENTIALITY AND INTEGRITY https://nvd.nist.gov/800-53/Rev4/control/SC-8
800-53-SC-12 SC-12 CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT https://nvd.nist.gov/800-53/Rev4/control/SC-12
800-53-SC-13 SC-13 CRYPTOGRAPHIC PROTECTION https://nvd.nist.gov/800-53/Rev4/control/SC-13
800-53-CP-9 CP-9 INFORMATION SYSTEM BACKUP https://nvd.nist.gov/800-53/Rev4/control/CP-9
800-53-RA-5 RA-5 VULNERABILITY SCANNING https://nvd.nist.gov/800-53/Rev4/control/RA-5
800-53-AU-11 AU-11 AUDIT RECORD RETENTION https://nvd.nist.gov/800-53/Rev4/control/AU-11