Automatically Improving Code Quality with Amazon CodeGuru - Using Reviewer and Profiler
The ML-based Reviewer automatically detects resource leaks and concurrency problems, and Profiler visualizes CPU bottlenecks with flame graphs. This article introduces patterns for integrating them into CI/CD.
Automated Code Review with CodeGuru Reviewer
CodeGuru Reviewer is a service that uses ML models to automatically detect problems in code. It integrates with GitHub, CodeCommit, and Bitbucket repositories and automatically runs a code review when a pull request is created. The detection targets are resource leaks (unclosed streams and connections), concurrency problems (race conditions and deadlocks), inefficient use of AWS APIs (not using pagination, unnecessary API calls), and security vulnerabilities (hardcoded credentials, SQL injection). Because the findings are posted directly as pull request comments, developers can address them within their normal code review flow. However, from November 7, 2025 onward, CodeGuru Reviewer no longer allows new repositories to be associated, and it can be used only with existing associations.
Performance Analysis with CodeGuru Profiler
CodeGuru Profiler is a service that continuously analyzes the runtime performance of applications. It supports Java and Python applications, and by embedding an agent, it visualizes methods with high CPU usage, latency bottlenecks, and memory allocation hotspots. With flame graphs, you can grasp at a glance the CPU consumption across the entire call stack and identify the code paths you should optimize. Profiler's overhead is kept small. It also supports Lambda functions, so you can identify cold start bottlenecks and inefficient processing.
Integration into CI/CD Pipelines
You can also run full repository scans, which let you detect problems across the entire existing codebase at once. Profiler's recommendations are presented together with an estimate of the cost reduction effect. For example, because concrete indicators are shown, such as "optimizing this method can reduce compute costs by $XX per month," you can use them to prioritize optimization. The findings of Reviewer and Profiler can also be sent to Security Hub, so the security team can centrally monitor code quality across the entire organization.
CodeGuru Pricing
CodeGuru Reviewer is billed monthly based on the number of lines of code analyzed in a repository, and the first 100,000 lines cost about $10.00 per month (as of October 2026). There is no limit on the number of pull request reviews, so it is a pricing structure that makes costs easy to predict even for development teams that create pull requests frequently. CodeGuru Profiler costs about $0.005 per sampling hour per profiling group, up to 36,000 sampling hours per month, and costs vary with the number of applications being profiled.
Types of Problems Detected
CodeGuru Reviewer mechanically picks up problems that are easy to overlook in human review. It points out leaks where resources are not released after use, race conditions when multiple processes run at the same time, flaws in exception handling, and other discouraged ways of writing code. On the security side, it detects risky implementations such as hardcoded sensitive information and insufficient input validation. Even if code appears to work at first glance, such problems surface when production comes under load or under specific conditions. Identifying them mechanically at the review stage helps prevent failures and security incidents in later stages before they happen.
Performance Analysis with Profiler
CodeGuru Profiler visualizes where a running application spends its time and resources. Because it displays processing call relationships as stacked flame graphs, you can intuitively identify places that use a lot of CPU and methods that are called more often than expected. What matters is that you can find bottlenecks based on measured data rather than optimizing by guesswork. You can also grasp problems with memory usage, and by reducing wasteful processing, you may in some cases be able to lower the required instance size and reduce costs. It serves as a means of first measuring and grasping the facts, as the starting point for performance improvement.
Building It into the Development Workflow
Code quality improvement continues only when it is built naturally into the development flow. If you have an existing repository association, a review runs automatically when a pull request is created, so you can receive findings before a problematic change is merged. Developers get automated findings in addition to human reviewers, so they can fill gaps in reviews. As the team repeatedly addresses the findings, the coding quality of the whole team is also raised. By building it into the CI/CD pipeline and making the quality check a condition for passing, you can prevent the release of code that does not meet a certain standard and support quality through mechanisms.
Positioning Relative to Other Approaches
It is appropriate to position automated code analysis not as a replacement for human review but as a complement to it. Machines are good at problems with routine patterns and at checking a wide range of code without omissions. On the other hand, context-dependent judgments such as the validity of a design or its alignment with business requirements are handled by human review. By combining the two, you can automatically reduce mechanical mistakes while people focus on essential discussions. Furthermore, combined with profiling and monitoring that observe runtime behavior, you can build a system that continuously raises quality from development through operations.
Summary
CodeGuru is a service that provides ML-based automated code review (Reviewer) and runtime performance analysis (Profiler). With existing repository associations, Reviewer automatically detects resource leaks and concurrency problems that are easy to overlook in human review, and Profiler continuously visualizes performance bottlenecks in production environments. Building it into the development process can lead to continuous improvement of code quality and application performance.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- Amazon CodeGuru official page
- AWS CodeCommit official page
- AWS Lambda official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.