Amazon CodeGuru Security
A static application security testing service that uses ML to automatically detect source code vulnerabilities and suggest fix code
Overview
Amazon CodeGuru Security is a machine learning-powered static application security testing (SAST) service that automatically detects security vulnerabilities in source code and suggests specific fix code. It covers vulnerability categories included in the OWASP Top 10, such as SQL injection, cross-site scripting (XSS), hardcoded credentials, and cryptographic weaknesses. Supporting major languages including Java, Python, JavaScript/TypeScript, C#, Ruby, and Go, it integrates with CodePipeline and GitHub Actions to detect and block vulnerable code before production deployment when incorporated into CI/CD pipelines.
ML-Based Vulnerability Detection vs. Traditional SAST
CodeGuru Security's detection engine is built on ML models trained on code review data from within Amazon. While traditional rule-based SAST tools detect known vulnerability patterns through pattern matching, CodeGuru Security understands the semantic context of code and traces data flows to determine vulnerability reachability. This can reduce false positives that are not actually exploitable, helping developers focus on genuine vulnerabilities requiring attention. Detection results are assigned severity levels (Critical, High, Medium, Low, Informational) and classified by vulnerability type using CWE (Common Weakness Enumeration) numbers. Furthermore, it automatically generates specific fix code (code patches) for detected vulnerabilities, which developers can apply to their code. Since the ML model also generates these fix suggestions, the proposed code can follow the project's coding style.
CI/CD Pipeline Integration Patterns
There are multiple ways to incorporate CodeGuru Security into development workflows. With GitHub Actions integration, automatic scans run when pull requests are created, displaying detected vulnerabilities as pull request comments. With CodePipeline integration, a security scan stage is added after the build stage, with quality gates that automatically halt the pipeline when Critical or High vulnerabilities are detected. Scan results can be integrated with Security Hub, enabling vulnerability trend analysis on organization-wide security posture dashboards. Incremental scanning (scanning only diffs) helps keep scan times short even for large repositories.
Secret Detection and Operational Best Practices
CodeGuru Security also detects hardcoded secrets in code (API keys, passwords, database connection strings, AWS access keys, etc.). Its ability to scan through Git history detects secrets in past commits, prompting verification of whether they have already been rotated. As an operational best practice, first run a full scan of the existing codebase to inventory current vulnerabilities, then establish a triage process that prioritizes fixes by severity. For new code, block Critical/High through CI/CD quality gates while managing Medium and below as technical debt in a staged approach. Scan policies can exclude specific file paths or rules, suppressing false positives from test code or third-party libraries. Reviewing detection trends weekly and conducting security training for development teams on frequently occurring vulnerability patterns is one way to run a PDCA cycle.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS CodePipeline official page
- AWS Security Hub official page
- Amazon Inspector official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.