Getting Started

Getting Started with SonarQube on AWS

2026-07-30 · sonarqube docs · aws

The CloudSOE SonarQube image gives you a complete SonarQube stack — SonarQube Community Build with a local PostgreSQL database — on a hardened Ubuntu base, with the kernel and ulimit tuning SonarQube’s embedded Elasticsearch requires already applied. The image contains no baked-in passwords: on first boot your instance generates a unique password for both the SonarQube admin account and the database, and writes it to a root-protected file.

What you’ll need

  • An AWS account subscribed to the CloudSOE SonarQube listing on AWS Marketplace
  • An EC2 key pair in your target region (SSH is key-based only)
  • About ten minutes

Step 1 — Launch the instance

  1. Open the SonarQube listing on AWS Marketplace and click Continue to Subscribe, then Continue to Configuration.
  2. Pick your region and click Continue to Launch → Launch through EC2.
  3. Choose an instance type. t3.medium (2 vCPU, 4 GB RAM) is the practical minimum — SonarQube runs a web server, compute engine, Elasticsearch and PostgreSQL on one box.
  4. Select your key pair, and give the root volume at least 30 GB.

Prefer the CLI? Once subscribed:

aws ec2 run-instances \
  --image-id <ami-id-from-the-listing> \
  --instance-type t3.medium \
  --key-name my-key \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=sonarqube-01}]'

Step 2 — Open the firewall ports

Your security group needs exactly two inbound rules:

PortProtocolPurpose
22TCPSSH administration
9000TCPSonarQube web interface

Restrict both to your own IP range (or your CI runners’ range) where possible.

Step 3 — Let first boot finish

On the very first boot the sonarqube-firstboot service:

  • generates a unique password meeting SonarQube’s password policy,
  • sets it on the PostgreSQL sonar database role and in SonarQube’s database configuration,
  • waits for SonarQube to come up, then replaces the default admin/admin login with the generated password,
  • saves everything to a root-protected credentials file.

SonarQube itself takes a couple of minutes to start (Elasticsearch indexing). You can watch:

ssh ubuntu@<public-ip>
systemctl status sonarqube-firstboot sonar

Step 4 — Retrieve your credentials

SSH in as the ubuntu user. The login banner (MOTD) shows your instance’s URL and points at the credentials file:

cat /opt/default-sonar-login.txt

This file (mode 600) holds the generated password for the SonarQube admin account and the PostgreSQL sonar user.

Step 5 — Log in and run your first analysis

Browse to http://<public-ip>:9000 and sign in as admin with the generated password. Create a project (Projects → Create Project → Local project), generate a token, and point a scanner at your server from your build machine:

sonar-scanner \
  -Dsonar.host.url=http://<public-ip>:9000 \
  -Dsonar.token=<your-token>

Next steps