search

Skyscanner / LambdaGuard

AWS Serverless Security
Apache License 2.0
400 stars 69 forks source link

Static code analysis -> only with SonarQube ? #11

Closed Magnodin closed 4 years ago

Magnodin commented 4 years ago

Hello Artëm Tsvetkov, Firstly, thanks a lot for your well-done article on: https://medium.com/@SkyscannerEng/introducing-lambdaguard-a-security-scanner-for-aws-lambda-f5c6e23f8345

After finishing to read your presentation about LambdaGuard and to look this Git, I was wondering if it could be possible to use a different than SonarQube static code analyzer with LambdaGuard ? Or it's built-in parallel with SonarQube and is dependent on it...

I really hope you can help me to know a bit more about this !

adeptex commented 4 years ago

Hi Magnodin, using a different analyzer would be a matter of changing this section (or adding a new one) - https://github.com/Skyscanner/LambdaGuard/blob/1ed6f5a353a7fa9abd30eda0a51d3ecfd0efe771/lambdaguard/security/Scan.py#L201-L212

It's using SonarQube because that's what we are currently using at Skyscanner, but it should be plugins-based.

Magnodin commented 4 years ago

Thanks a lot Artëm, you rock!

adeptex commented 4 years ago

cheers :)