Terraform
Language-specific information about the way that SonarQube Cloud supports the analysis of Terraform.
Supported versions
The level of support for a language is defined as follows:
Fully supported: Analysis will complete. All the language features are understood and examined.
Supported: Most language features are understood and examined but the version includes unsupported features. Analysis might break or provide incomplete results.
Versions 1.3, 1.4 and 1.5 are supported
Language-specific properties
To discover and update the Terraform-specific properties, navigate in SonarQube Cloud to Your Project > Administration > General Settings > Languages > Terraform. See Configuration overview for more information about setting properties.
Supported platforms
Platforms:
Amazon Web Services
Azure Cloud
Google Cloud Platform
Terraform provider versions
The various Terraform providers are frequently updated. New resources, properties, and default values are added, while at the same time, others are deprecated or dropped. For this reason, Terraform analysis is defensive by default; some issues will be automatically silenced to avoid raising false positives. In order to get a more precise analysis, you can specify the provider versions your code supports via a parameter.
AWS: sonar.terraform.provider.aws.version
Azure: sonar.terraform.provider.azure.version
GCP: For Google Cloud Platform, no versions are currently considered in the analysis
Accepted are versions having the format: X.Y.Z, X.Y or X.
Examples:
sonar.terraform.provider.aws.version=1.93.4sonar.terraform.provider.aws.version=3.4sonar.terraform.provider.aws.version=4
In-line suppression of issues
Adding the NOSONAR comment on the line will suppress all issues on that line:
NOSONARcan be placed anywhere in the comment.The comment check is case-sensitive.
Rather than relying on this method, we suggest refining your analysis scope to avoid creating major gaps in your code review. Because the NOSONAR comment silences all current and future issues on a line without regard for their severity, it is an imprecise tool. Even if you only intend to hide a minor stylistic point, you could unintentionally obscure a serious security flaw.
Related Pages
Last updated
Was this helpful?