CloudFormation

SonarQube Server can analyze Infrastructure-as-Code (IaC) languages such as CloudFormation, Kubernetes, and Terraform.

Supported language versions

The level of support for a language is defined as follows:

• Fully supported: Analysis will complete. All the language features are understood and examined.
• Supported: Most language features are understood and examined but the version includes unsupported features. Analysis might break or provide incomplete results.

2010-09-09: Supported

Language-specific properties

Discover and update the CloudFormation analysis parameters by going to Administration > Configuration > General Settings > Languages > CloudFormation

Importing external reports

For CloudFormation you can import cfn-lint reports. See Administration > Configuration > General Settings > External Analyzers for more information.

In-line suppression of issues

Adding the NOSONAR comment on the line will suppress all issues on that line:

• NOSONAR can be placed anywhere in the comment.
• The comment check is case-sensitive.

Rather than relying on this method, we suggest refining your analysis scope to avoid creating major gaps in your code review. Because the NOSONAR comment silences all current and future issues on a line without regard for their severity, it is an imprecise tool. Even if you only intend to hide a minor stylistic point, you could unintentionally obscure a serious security flaw.

Related pages

• Analysis parameters

• Analysis scope