Amazon CodeGuru
A service that uses machine learning to automate code reviews and identify application performance bottlenecks
Overview
Amazon CodeGuru is a service that leverages machine learning to improve code quality and optimize application performance. CodeGuru Reviewer automatically analyzes code during pull requests, detecting potential bugs, security vulnerabilities, and AWS SDK best practice violations. CodeGuru Profiler continuously measures runtime application performance, visualizing CPU-intensive code paths and latency bottlenecks. CodeGuru Security performs static analysis to detect vulnerabilities and even suggests fix code.
Code Quality Analysis with CodeGuru Reviewer
CodeGuru Reviewer integrates with GitHub, CodeCommit, and Bitbucket repositories, automatically analyzing diff code whenever a pull request is created. Machine learning models trained on millions of code reviews accumulated within Amazon detect logical issues that conventional linters cannot catch. For example, it identifies try-finally patterns with potential resource leaks, non-thread-safe collection operations, and inefficient AWS SDK call patterns (such as repeated DynamoDB GetItem calls inside loops). It supports Java and Python, and findings are posted directly as comments on the pull request, so developers can review and address them within their normal code review workflow. Full repository scans are also available for evaluating the quality of existing codebases. Each recommendation includes sample code and explanations, helping developers understand why the change is necessary.
Runtime Performance Analysis with CodeGuru Profiler
CodeGuru Profiler continuously profiles CPU usage and latency of applications running in production. Once the agent is embedded in your application, it collects stack trace samples at 5-minute intervals and visualizes them as flame graphs. Flame graphs make it immediately clear which methods consume the most CPU time, pinpointing the code paths that need optimization. For Lambda functions, no agent embedding is required - simply create a profiling group and associate the Lambda function to start measurement. Profiler's anomaly detection feature learns the normal performance profile as a baseline and automatically notifies you when CPU usage or latency increases abnormally. The recommendations engine generates specific improvement suggestions for detected bottlenecks. For instance, if log output formatting consumes 15% of CPU, it suggests switching to a lazy evaluation pattern.
Vulnerability Detection with CodeGuru Security
CodeGuru Security provides static application security testing (SAST), detecting security vulnerabilities in source code. It targets OWASP Top 10 issues including SQL injection, cross-site scripting (XSS), hardcoded credentials, and cryptographic weaknesses, supporting Java, Python, JavaScript, and TypeScript. Findings are tagged with CWE (Common Weakness Enumeration) numbers and severity levels, enabling systematic understanding of vulnerability types and impact scope. A notable feature is the auto-fix suggestion capability, which generates corrected code snippets for detected vulnerabilities. For example, when it detects a non-parameterized SQL query, it suggests fix code using prepared statements. For CI/CD pipeline integration, it can be embedded as a CodePipeline action, setting up a quality gate that halts the pipeline when vulnerabilities are detected. Findings also integrate with Security Hub, enabling management as part of the organization's overall security posture.