Terraform Rule not Detected in Scan

SonarQube Cloud
1

Hi all,

We’re using SonarCloud with automatic analysis of our GitHub Actions PRs. We’re experimenting with analysing terraform code, the first rule I tried to break (on purpose to test the PR checks) didn’t actually do so.

I’ve created a new PR in which I have added this deliberately bad code:

# TODO: Will this brake?
resource "azurerm_role_definition" "example" { # Sensitive
  name        = "example"
  scope       = "${data.azurerm_subscription.subscription.id}"

  permissions {
    actions     = ["*"]
    not_actions = []
  }

  assignable_scopes = [
    data.azurerm_subscription.subscription.id
  ]
}

resource "azurerm_role_definition" "example2" { # Sensitive
  name        = "example2"
  scope       = data.azurerm_management_group.product_group.id

  permissions {
    actions     = ["*"]
    not_actions = []
  }

  assignable_scopes = [
    data.azurerm_management_group.product_group.id
  ]
}

I was expecting two linting errors:

  • terraform:S6385 - Azure custom roles should not grant subscription Owner capabilities
  • terraform:S1135 - Track uses of “TODO” tags

SonarCloud detected terraform:S1135 however it did not detect terraform:S6385 even though the noncompliant code is the exact sample from the rule definition.

The project is configured to use the Sonar Way quality gate so should be including the rule.

Any help in debugging why this isn’t working would be appreciated.

Thanks,

5

Hi @steven-cooney,

Welcome to Sonar Community — thanks for ask question.

The issue is not raised because of the assignable_scopes you used in your example. Please try with one of the following: data.azurerm_subscription.primary.id or data.azurerm_subscription.current.id (it’s not the full list of all sensitive scopes).

Best
Marcin Stachniuk