can we use sonarqube to scan IaC code ( not application code ) ( IaC code here meaning is terraform code to create Azure infrastructure such as RBAC , PIM , allowed locations etc) for error and vulnerabilities with Azure DevOps CI/CD pipelines ?
i found some link but not sure ?
I confirm SonarSource (SonarQube, SonarCloud, SonarLint) doesn't provide yet any feature to scan IaC files (Terraform, CloudFormation, ...). This is part of our 2021 roadmap to bring features to secure Cloud Native apps which include to raise issues on your IaC files. The work just started on our side, so don't expect this to come soon but more starting from Q3.
Edit 2022-01: SonarQube and SonarCloud now support analysis of CloudFormation and Terraform for AWS + Azure (GPC is coming in Q1 2022). See the announcements for details:
There is no SonarQube plugin for analyzing Terraform code. You can use Terrascan or TFLint as static analysis tool.
Here is another one ==> oak9 (www.oak9.io) . It focuses on securing your application architecture by analyzing your IaC. It has a number of features including out-of-the-box security and compliance blueprints, integrations across CI/CD toolsets & code-repositories, integrations with different cloud service providers and a lot more. Full disclosure - I work on the security team here
