Create a code review
Create code reviews in the AWS Security Agent web application to scan your source code repositories and S3 sources for security vulnerabilities. Code reviews perform comprehensive static analysis across your entire codebase, identifying security issues and providing remediation guidance.
Unlike pull request-based code review which analyzes individual code changes (see Review code security findings in pull requests), on-demand code reviews scan your full source code to identify security vulnerabilities and validate compliance with your organization’s security requirements.
In this procedure, you’ll create a code review by selecting source code inputs, configuring permissions, and running the review.
Prerequisites
Before you begin, ensure you have:
-
Access to the AWS Security Agent web application
-
At least one connected GitHub repository or S3 bucket in your Agent Space
Tip
If you already have GitHub repositories connected to your Agent Space, code review is ready to use — no additional setup is required. Choose Start in web app from the Code review card on your Agent Space page, or launch the web application directly.
If you need to connect additional sources or configure S3 buckets, see Enable code review.
Access the code reviews page
Navigate to the code reviews section in the web application.
-
Log in to the AWS Security Agent web application.
-
In the left sidebar, choose Code reviews.
-
You see a list of existing code reviews with their source information, last run status, and findings summary.
Create a code review
Set up a new code review by configuring its source code inputs and permissions.
-
On the Code reviews page, choose Create code review.
Configure code review details
Provide a title and select the source code to review.
-
In the Title field, enter a descriptive name for your code review.
Tip
Use a name that identifies the application, repository, or scope of the review. For example, "billing-service-security-review" or "infrastructure-code-audit".
-
In the Sources section, select the source code inputs for this review. Choose from two tabs:
GitHub repositories
Select from repositories connected to your Agent Space.
-
Choose the GitHub repositories tab.
-
In the Integrated repositories table, select the checkbox next to each repository you want to include in the review.
-
Use the search field to find specific repositories by name.
Note
Only repositories connected to your Agent Space through the code review configuration appear here. To add more repositories, choose Manage in your Admin console or ask your administrator to update the Agent Space configuration.
Tip
When you select a repository, you can specify a branch. By default, the service uses the primary branch. To use a different branch, enter the branch name in the field next to the repository.
S3 sources
Select ZIP files from the S3 buckets connected to your Agent Space. Your Agent Space administrator configures which S3 buckets are available. Any ZIP file stored in one of those buckets can be used as a source for a code review.
-
Choose the S3 sources tab.
-
Enter the S3 URI of each ZIP file you want to include in the review. You can add up to 30 S3 sources.
Note
S3 sources must be ZIP files stored in S3 buckets that are connected to your Agent Space. To make additional buckets available, see Enable code review.
Configure permissions
Select the IAM service role and optional CloudWatch log group for this code review.
-
In the Permissions section, locate the Service role dropdown.
-
Select the IAM role from your configured service roles.
Note
The service role must have permissions to access your source code in S3 and write to CloudWatch logs, and any other AWS resources needed for the code review. Service roles are configured during code review setup in the AWS Management Console.
-
(Optional) In the CloudWatch log group dropdown, select a log group to store code review execution logs.
Note
If you don’t select a log group, AWS Security Agent creates a default log group for storing code review logs.
Configure automatic code remediation
Enable automatic remediation to have AWS Security Agent generate code fixes for all findings as soon as the review completes.
-
In the Automatic code remediation section, select the Enable automatic code remediation checkbox.
How AWS Security Agent delivers the fix depends on the source:
-
Connected private repository – AWS Security Agent submits a pull request (or a merge request, for GitLab) with the fix.
-
Public repository – To avoid disclosing the vulnerability before it’s fixed, AWS Security Agent does not open a pull request. Delivery varies by provider — for example, public GitHub repositories receive a downloadable diff you can apply privately; see the provider’s connection topic.
-
Amazon S3 sources – AWS Security Agent attaches a downloadable code diff to the finding (there’s no connected repository to open a pull request against). Download it from the web application and apply it locally.
Important
Everyone with read access to the private repository can see the remediation pull request. Review the changes before merging.
Note
When automatic code remediation is disabled, you can still trigger it manually for individual findings. This works for findings from a connected repository or an Amazon S3 source.
Set a maximum task-hours limit
Limit how much work AWS Security Agent performs for a code review by setting a maximum number of task hours. Task hours measure the cumulative time the agent spends actively working on the review, including time across parallel analysis. Task hours are not the same as elapsed wall-clock time, because AWS Security Agent runs multiple tasks at once. Total task hours is also the unit that AWS Security Agent bills for a run, so setting a limit caps how much a review can cost. The smallest limit you can set is 20 hours.
-
(Optional) In the Max task hours section, choose a limit:
-
Choose a preset value, such as 20 or 30 hours.
-
Choose No limit to run the review to completion without a task-hours limit.
-
Choose Custom to enter your own value. A custom limit must be at least 20 hours.
-
Tip
For larger applications, or to get the most complete results, set a higher limit such as 30 hours or more. AWS Security Agent bills only for the task hours a run actually uses, so a higher limit does not increase cost unless the review needs the extra time.
Note
When a review reaches its maximum task hours, AWS Security Agent stops working on the review and keeps the findings already discovered. The run finishes with a status of Completed. You can review these findings or run the code review again.
Configure simulated validation
Enable simulated validation to dynamically confirm whether discovered vulnerabilities are exploitable in a running application.
-
In the Simulated validation section, select the Enable simulated validation checkbox.
When enabled, AWS Security Agent provisions a simulated environment after static analysis completes. It onboards your source code, starts services inside the environment, and attempts to exploit vulnerabilities found during the scan. Findings are then updated with a validation status indicating whether the vulnerability was successfully exploited.
Note
Simulated validation is currently available for self-contained dockerizable applications only. When multiple repositories are selected as sources, simulated validation is not available.
Important
Simulated validation adds processing time to your code review run. The validation step provisions an environment and runs exploitation attempts. This typically takes 1–3 hours depending on the number of findings and application complexity.
Allowed network destinations
The simulated environment has outbound network access restricted to a predefined allowlist. Your application can reach the following domains during validation:
The following table lists the allowed domains and their purposes.
| Domain | Purpose |
|---|---|
|
|
AWS services |
|
|
Amazon ECR Public |
|
|
Docker Hub |
|
|
GitHub |
|
|
GitLab |
|
|
npm registry |
|
|
Python Package Index |
|
|
Rust packages |
|
|
Java/Gradle packages |
|
|
.NET packages |
|
|
Ruby packages |
|
|
Go packages |
|
|
Node.js |
|
|
Linux distribution repositories |
|
|
CloudFront distributions |
|
|
Google APIs |
|
|
Microsoft services |
|
|
Source hosting |
Note
If your application requires network access to domains not on this list, the connection will be blocked by the network firewall. Applications that depend on external APIs or services not listed above may not start correctly in the simulated environment.
Create the code review
-
Review your configuration to ensure accuracy.
-
Choose Create code review.
You are redirected to the code review detail page where you can start a review run.
Run a code review
After creating a code review, start a run to begin the analysis.
-
On the code review detail page, choose Start review.
-
AWS Security Agent begins analyzing your source code.
You can also start a review from the Code reviews list page by choosing Start review next to the code review you want to run.
Monitor a code review run
Track the progress of your code review as it executes.
Review run phases
A code review run progresses through the following phases, displayed as a progress indicator:
-
Preflight – AWS Security Agent validates access to your source code and sets up the testing environment. The preflight checks include:
-
Service infrastructure setup
-
S3 source access validation
-
Setup testing environment
-
-
Static analysis – AWS Security Agent scans your source code for security vulnerabilities and requirement violations.
-
Simulated validation (optional) – If simulated validation is enabled, AWS Security Agent provisions a simulated environment and deploys your application. It then attempts to exploit the vulnerabilities discovered during static analysis. This step confirms whether findings are exploitable in the target runtime. This phase only appears when you enable simulated validation during code review creation.
-
Finalizing – AWS Security Agent compiles findings and generates the results summary.
View run details
On the run detail page, navigate between tabs to monitor progress:
-
Code review run – View the run summary including run ID, creation time, status, duration, task hours, severity level breakdown, and risk types chart.
-
Preflight – View the preflight check progress and status of each validation step.
-
Code review logs – View the tasks AWS Security Agent identified and conducted during the review, with detailed task logs for each step.
-
Simulated validation – When simulated validation is enabled, view the provisioning status, validation tasks for individual findings, and their results.
-
Findings – View security findings after the review completes (see Review findings from a code review).
Run history
Each code review maintains a history of all runs. On the code review detail page:
-
The Latest run section shows the most recent run with its start time, status, duration, and ID.
-
The All runs table lists all previous runs with their start time, status, duration, findings summary, and ID.
-
Choose Monitor run to view the details of the latest active run.
-
Choose any run’s start time link to view its full details.
Next steps
After running a code review:
-
Review security findings and their remediation guidance (see Review findings from a code review)
-
Remediate findings through automated pull requests or manual fixes (see Remediate code review findings)
-
Run additional reviews after implementing fixes to verify remediation
-
Adjust your code review configuration or sources as your codebase evolves
