Domains / URLs / internet resources that SonarCloud requires access to

SonarCloud
1

Hi,

We have been running SonarCloud as part of our CI/CD for a while now. Our pipeline is realized using github actions, running on Azure VMs added to our github org as self-hosted github runners. SonarCloud is invoked as part of the maven build step using the sonar-maven-plugin.

The VMs acting as build servers have a strict firewall for outgoing traffic and recently two new domains have popped up in the firewall blocked traffic log:

  • ea6ne4j2sb.execute-api.eu-central-1.amazonaws.com
  • sc-cleancode-sensorcache-eu-central-1-prod.s3.amazonaws.com

I’m suspecting that these are related to sonarcloud since I’m seeing terminated connections in the build log:

07:48:18 GMT  [INFO] ------------- Run sensors on module eksplosiv-org-api
07:48:18 GMT  [INFO] Load metrics repository
07:48:18 GMT  [INFO] Load metrics repository (done) | time=133ms
07:48:18 GMT  [INFO] Sensor cache enabled
07:48:18 GMT  [INFO] Load sensor cache
07:48:20 GMT  [javax.net.ssl.SSLHandshakeException: Remote host terminated the handshake, javax.net.ssl.SSLHandshakeException: Remote host terminated the handshake, javax.net.ssl.SSLHandshakeException: Remote host terminated the handshake]
07:48:20 GMT  Warning:  Failed to prepare download of the sensor cache

Now, it’s not a problem for us to add a firewall rule to allow this traffic, but only if we know these domains can be trusted. Thus I’m writing here hoping that someone affiliated with Sonar can confirm that these domains are in fact used by SonarCloud.

And also, if anyone could point me in a direction for a complete list of domains/URLs/internet resources that SonarCloud requires access to when invoked by the sonar-maven-plugin.

7

Hi @Laffs2k5 ,

I can confirm that we use those domains. We are working to collect all the current domains and will get back to you. I hope this will unlock you for now.
We publish a list so you can have updates from there.

Thanks
Csaba

1 Like
8

Perfect!
Thank you :slight_smile:

9

Hi Peder,

For now, these are all the domains that need to be whitelisted.

  • *.sonarcloud.io
  • ea6ne4j2sb.execute-api.eu-central-1.amazonaws.com
  • sc-cleancode-sensorcache-eu-central-1-prod.s3.amazonaws.com

Thanks
Csaba

2 Likes
11

Thank you :+1:

15

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.