Eduarn – Online & Offline Training with Free LMS for Python, AI, Cloud & More

Monday, May 11, 2026

SonarQube / SonarCloud Integration with Azure DevOps for Terraform Projects (Step-by-Step Guide)

 

This guide explains how to:

  • Create a free SonarCloud account
  • Install Sonar Scanner on Ubuntu
  • Integrate SonarCloud with Azure DevOps
  • Scan Terraform code using Azure DevOps pipeline
  • Understand the complete workflow

What Is SonarQube / SonarCloud?

SonarQube is a static code analysis tool used to:

  • Detect bugs
  • Identify vulnerabilities
  • Improve code quality
  • Enforce coding standards

SonarCloud is the cloud-hosted version of SonarQube.

It integrates easily with:

  • Azure DevOps
  • GitHub
  • GitLab
  • Jenkins
  • Terraform projects

Architecture Flow

Terraform Code
      ↓
Azure DevOps Pipeline
      ↓
Sonar Scanner
      ↓
SonarCloud Analysis
      ↓
Quality Reports & Metrics

Step 1: Create Free SonarCloud Account

Visit:

SonarCloud Official Site

Signup Steps

  1. Click Login
  2. Choose:
    • GitHub
    • Azure DevOps
    • GitLab
  3. Authorize SonarCloud access
  4. Create organization

Step 2: Create New Project in SonarCloud

Steps

  1. Login to SonarCloud
  2. Click + Analyze New Project
  3. Select repository
  4. Choose organization
  5. Set:
    • Project Key
    • Display Name

Example:

Organization: terraformsonarqubeproject
Project Key: terraformsonarqubeproject_neelprojectterraform

Step 3: Generate SonarCloud Token

Steps

  1. Click profile icon → My Account
  2. Go to Security
  3. Generate Token

Example:

Name: azuredevops-token

Copy the generated token safely.

Step 4: Install Sonar Scanner on Ubuntu

Update Packages

sudo apt update

Install Java

Sonar Scanner requires Java.

sudo apt install openjdk-17-jdk -y

Verify:

java -version

Download Sonar Scanner

Visit:

Sonar Scanner Downloads

Or use terminal:

wget https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-6.0.0.4432-linux.zip

Install Unzip

sudo apt install unzip -y

Extract Scanner

unzip sonar-scanner-cli-6.0.0.4432-linux.zip

Move Scanner to /opt

sudo mv sonar-scanner-6.0.0.4432-linux /opt/sonar-scanner

Configure Environment Variables

Edit:

sudo vi ~/.bashrc

Add:

export PATH=$PATH:/opt/sonar-scanner/bin

Reload:

source ~/.bashrc

Verify Installation

sonar-scanner -v

Step 5: Install Azure DevOps Self-Hosted Agent (Optional)

If using self-hosted Ubuntu agent:

Create Agent Directory

mkdir myagent && cd myagent

Download Azure DevOps Agent

From Azure DevOps:

  • Organization Settings
  • Agent Pools
  • New Agent

Download Linux agent.

Extract Agent

tar zxvf vsts-agent-linux-x64.tar.gz

Configure Agent

./config.sh

Provide:

  • Azure DevOps URL
  • PAT Token
  • Agent Pool Name

Start Agent

./run.sh

Step 6: Terraform Project Structure

Example:

terraform-project/
│
├── main.tf
├── variables.tf
├── outputs.tf
└── azure-pipelines.yml

Sample Terraform Code

main.tf

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "demo" {
  bucket = "terraform-demo-bucket-neel"
}

Step 7: Azure DevOps Pipeline YAML

Your provided pipeline is correct.

Here is the cleaned professional version.

azure-pipelines.yml

trigger: none

pool:
  name: 'demo'

steps:

- checkout: self

- script: |
    /opt/sonar-scanner/bin/sonar-scanner \
      -Dsonar.projectKey=terraformsonarqubeproject_eduarn_projectterraform \
      -Dsonar.organization=terraformsonarqubeproject \
      -Dsonar.sources=. \
      -Dsonar.host.url=https://sonarcloud.io \
      -Dsonar.login='YOUR_SONAR_TOKEN'
      
  displayName: 'SonarCloud Terraform Analysis'

Important Security Best Practice

Do NOT hardcode tokens directly.

Instead use:

  • Azure DevOps Secret Variables
  • Variable Groups

Secure Version Using Variables

Azure Pipeline YAML

trigger: none

pool:
  name: 'demo'

variables:
  SONAR_TOKEN: $(SONAR_TOKEN)

steps:

- checkout: self

- script: |
    /opt/sonar-scanner/bin/sonar-scanner \
      -Dsonar.projectKey=terraformsonarqubeproject_eduarn_projectterraform \
      -Dsonar.organization=terraformsonarqubeproject \
      -Dsonar.sources=. \
      -Dsonar.host.url=https://sonarcloud.io \
      -Dsonar.login=$(SONAR_TOKEN)

  displayName: 'Run SonarCloud Scan'

Step 8: Create Secret Variable in Azure DevOps

Steps

  1. Azure DevOps Project
  2. Pipelines
  3. Library or Variables
  4. Add Variable:
    • Name: SONAR_TOKEN
    • Value: your token
  5. Mark as:
    ✅ Keep this value secret

Step 9: Run Pipeline

Steps

  1. Commit code
  2. Push to Azure Repos/GitHub
  3. Run pipeline

Pipeline will:

  • Checkout Terraform code
  • Run Sonar Scanner
  • Send analysis to SonarCloud

Step 10: View SonarCloud Results

Open:

SonarCloud Dashboard

You can review:

  • Bugs
  • Vulnerabilities
  • Security hotspots
  • Code smells
  • Coverage reports
  • Maintainability metrics

Example Terraform Issues SonarCloud Detects

SonarCloud can identify:

  • Hardcoded secrets
  • Insecure security groups
  • Public S3 buckets
  • Misconfigured IAM policies
  • Poor Terraform formatting

Terraform + SonarCloud Benefits

Security

Detect cloud security risks early.

Code Quality

Maintain infrastructure standards.

Compliance

Improve governance and auditing.

Automation

Shift security checks into CI/CD.

Real Enterprise Use Case

Modern enterprises integrate SonarCloud into:

  • Terraform pipelines
  • Kubernetes deployments
  • Infrastructure automation workflows

This ensures:

  • Secure infrastructure
  • Standardized deployments
  • Faster audits
  • Reduced vulnerabilities

Best Practices

Use Remote Terraform State

Store state securely.

Scan Every Pull Request

Catch issues before merge.

Use Branch Policies

Enforce quality gates.

Never Hardcode Secrets

Use secret managers.

Enable Quality Gates

Fail pipelines on critical vulnerabilities.

Recommended Future Enhancements

You can later integrate:

  • Terraform fmt
  • Terraform validate
  • Checkov
  • Trivy
  • Snyk
  • Kubernetes scanning

Learning Outcome

After completing this setup, you will understand:

  • SonarCloud integration
  • Terraform code scanning
  • Azure DevOps CI/CD
  • DevSecOps practices
  • Infrastructure quality automation

Useful Official References

at
Labels: , , , , ,

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)

Just One Skill Can Change Your Career: How IT Professionals, Students, and Trainers Can Earn Through EduArn LMS Consulting in 2026

  Just One Skill Can Change Your Career: Earn Through EduArn LMS Consulting Introduction: The Biggest Career Shift Is Happening Right Now ...