SONAR FOR IAC

Infrastructure as Code: secure cloud-native apps

Sonar provides a comprehensive code quality and security analysis solution to scan your IaC files in your managed cloud environments to review a wide range of possible issues or security vulnerabilities.

Self-managedSaaS

Trusted and loved by 7 million developers & 400,000+ organizations

  • Barclays
  • Airfrance
  • IBM
  • NASA
  • Microsoft
  • ebay
  • Request demo
  • Take a product tour
  • Sonar Community
  • Contact us
Interstitial
PROTECT YOUR INFRASTRUCTURE

IaC is software - make sure it's clean and secure

It should be properly versioned, have its own pipeline AND it should be tested and secured. Sonar makes it easy to find and fix code issues in the popular languages and tools you’re using to configure and orchestrate your cloud infrastructures.

refactoring bits of code and quality checks are shown as an abstract of a developers environment.
Interstitial

Try it for free

Broad support for your IaC environment

  • Cloudformation Logo
  • Terraform Logo
  • Azure Resource Manager icon
  • Python Logo
  • Typescript Logo
  • Javascript Logo
  • Docker
  • https://assets-eu-01.kc-usercontent.com:443/f42196a6-70a1-01d0-99f1-43134f12a58b/dd29d45e-18d1-4b28-b0d4-9c62934cc7c5/Kubernetes_mark_color_with-padding.svg
  • https://assets-eu-01.kc-usercontent.com:443/f42196a6-70a1-01d0-99f1-43134f12a58b/f612645e-3b99-49d2-b1e4-05824935ff4d/helm-blue.svg

One solution for clean code in your cloud-native apps & IaC

All-in-one tool

Sonar is your tool for clean code in IaC and popular cloud-native languages including JavaScript, Python, Java, Go and C#. You get depth and breadth.

Protect what's important

Keeps vulnerabilities, bugs and code smells out of your biggest asset - your software!

Sonar puts your cloud-native application on a solid foundation

Clean Code principles create safe, reliable infrastructures for your cloud-native apps

Boost environment security

Give your apps a safe place to run. IaC specific rules find vulnerabilities in your cloud infrastructure to minimize user risk and safeguard your org's reputation.

Bring a clean code methodology to IaC

Clean as You CodeTM empowers developers to write code with clear rules & expectations. Devs directly control code quality.

Agnostic approach

Avoid vendor lock-in. Relying on a single vendor limits choices & concentrates risk. Sonar supports AWS, Google Cloud and Azure.

Experiment with confidence

Have fun learning IaC while Sonar protects your code. Sonar is always ready to catch those ‘oops’ mistakes before they fall through the cracks.

CLEAN CODE IN ACTION

A unique approach to spotting vulnerabilities

What sets Sonar apart from other solutions is the approach. In addition to spotting ‘no-doubt’ vulnerabilities, Sonar also employs the concept of Security Hotspots. This approach is designed to minimize false positives and maximize your efficiency.

Image shows overall health of a project with all areas having a passing score
DEDICATED IAC RULES

Extend Clean Code to your cloud-native workflow

Security Hotspots > Code Review

Security Hotspots occur when security-sensitive code is used. The code usage might be okay, but a code review is necessary to know for sure.

Sonar provides a custom UI dedicated to Security Hotspot review. This allows developers and cloud engineers to quickly evaluate security risks while learning about secure coding practices. If the code snippet contains a vulnerability, you can assign it to someone or mark it safe if it doesn’t pose a risk.

Security Vulnerabilities > Code Change/Fix

Sonar also spots security vulnerabilities that require immediate attention. Sonar provides detailed issue descriptions, code highlights and contextual help that explain why your code is at risk.


Remediation is easy -> Just follow the guidance, check in a fix and secure your application!

BROAD VULNERABILITY DETECTION

Over a decade of analyzer development

The Sonar SAST engine detects vulnerabilities in a comprehensive range of categories

Explore Sonarpedia

Public access

Detect if your code is granting public access to security-sensitive resources

Permissions

Discover if you’ve granted permissions that are typically out-of-scope in production

Encryption

Ensure adequate encryption protocols for data at-rest and in-transit

Traceability

Prevent inadvertent disabling or modifying of best-practice traceability mechanisms

The Sonar difference

What makes Sonar a solution and not just a tool is the simple, repeatable process it brings to your daily workflow. The difference is how much more proficient you become as a developer.

Clean as You Code Methodology

Clean as You Code is a simple, powerful methodology that progressively improves the overall quality of the code by solely focusing on code that is added or changed and ensuring that it's clean.

Sonar Quality Gate Pass/Fail

Added or changed code either passes or fails the quality standard. Fail the pipeline when the code quality doesn’t meet the threshold. Prevent code issues from being merged or deployed.

Actionable, highly-precise analysis results

Receive Clean Code metrics at the right place and right time. Deal with real issues, not false positives, thanks to the precise Sonar static analysis.

Clear remediation guidance

Discover issues in context with a rule description that helps you understand WHY there is an issue. Sonar includes examples of compliant code so you understand HOW to fix it.

Ready to secure your IaC code?

  • Legal documentation
  • Trust center
  • Follow SonarSource on Twitter
  • Follow SonarSource on Linkedin

© 2008-2024 SonarSource SA. All rights reserved. SONAR, SONARSOURCE, SONARQUBE, and CLEAN AS YOU CODE are trademarks of SonarSource SA.