Introduction

This article is an English translation of the article at the following URL, which was originally written in Japanese. The screenshots are still in Japanese. Sorry about that.

It includes three features that became generally available (GA) in April: penetration testing, design review, and code review (the subject of this article).

Code security review (hereinafter referred to as "code review") is a web application diagnostic method that falls under "SAST" (Static Application Security Testing). It is considered a vulnerability assessment that checks for flaws in the source code during the development phase before it is deployed in a test environment, and detects vulnerabilities visible at the code level.

Security Agent Code Review

From here, I will describe the steps to enable the Security Agent and run a code review.

Enable Security Agent

To start using Security Agent, you first need to enable it. Incidentally, simply enabling Security Agent will not incur any charges.

① Click [Set up AWS Security Agent]

④ Enter a service role name. If there is no suitable role available in your account, a new service role will be created.

⑤ If you want to use KMS encryption, check the encryption option checkbox. If the default encryption is sufficient, uncheck the checkbox.

⑥ Set tags as needed.

⑦ Click [Set up AWS Security Agent].

Enable Code Review

① Click "Enable code review".

③ Select "Create a new account" and "GitHub," then click "Next."

⑤ You will be redirected to the GitHub page. Click "Install".

⑦ Click "Only select repositories" and select the repository where you want to install the GitHub App from the "Select repositories" dropdown menu.

⑨ Return to the following screen and click "Add" again.

⑪ Select the GitHub repository name and click "Next".

⑭ If you want to obtain application operation logs in CloudWatch Logs, select the log group where you want to store the logs (you need to create the log group beforehand).

⑮ Create a role for service access. If you have already created one, click "Use existing service role". If the default role is acceptable, click "Create default role".

⑯ Click "Save".

Application User Settings

Add an IAM Identity Center user to allow code reviews from the application.

For testing purposes, you can access it with "Administrator Access" without creating a user, but since administrators don't usually perform vulnerability assessments in normal operation, we'll configure a user even for testing purposes.

① Return to the "Agent Spaces" top page and click "Add Users" from the "Web App" tab.

③ Once the message indicating that the user has been added is displayed, click the Agent Web App URL.

⑤ The screen will display as shown below, and you should confirm that the created Agent Space name is displayed.

② Enter a title for the code review.

③ Select the previously connected GitHub repository, the created service role, and the CloudWatch log group, and click "Create a code review."

Code Review Results

This time it was completed in about an hour.

① Once completed, you can view the code review results.

② The scan results are displayed as follows. Well-known vulnerabilities such as SQL injection, cross-site scripting, and path traversal were detected.

Although it says "Completed," it remained showing "Finalizing" for some reason.

② Edit the extraction criteria and click "Generate and Download." The code review results will be output as a PDF file to your PC's download folder.

② Code remediation will begin.

Impressions of Conducting a Code Review with Security Agent

Recognizing the Importance of SAST

This code review detected many types of vulnerabilities. It's probably difficult to uncover all vulnerabilities through human code reviews alone. I believe it's an important service that complements human code reviews by inspecting for remaining vulnerabilities. Furthermore, I realized that web application security testing should not only utilize external attack-based testing methods like DAST (Dynamic Application Security Testing), but also SAST, which identifies vulnerabilities at the code level and provides a starting point for fixes.

Completely Eliminating Human Reviews is Not Yet Possible

I realized that Security Agent doesn't completely replace human code reviews.

After running the automatic fix and then performing another code review, the fixed vulnerabilities were not re-detected, but several new vulnerabilities were detected. It's possible that a detection method was added during the initial code review, or that it was a false positive, but it's also possible that a fix in one place affected the entire code or even the entire repository.

As such, the results of the review and the recommended fixes for vulnerabilities are not always optimal for the whole system. Furthermore, there's a risk that applying automated fixes too readily could break the entire application. I think that unless people carefully review the fixes and decide whether to automate or manual fixes, it could lead to unnecessary work being done.

Wouldn't it be great if it could be integrated with CodeCommit?

As of May 21, 2026, it's not possible to target CodeCommit repositories for code reviews. It was truly surprising that S3 could be targeted for code reviews, but CodeCommit couldn't. Currently, if a user of CodeCommit wants to perform code reviews with the Security Agent, they would have to either:

• Store source code files in S3 and perform code reviews there


• Migrate the repository to GitHub.

Storing files in S3 is troublesome, and migrating to GitHub doesn't seem practical. I think it would be great if it could integrate with CodeCommit to easily perform code reviews.

CodeCommit was such a valuable service that it was shut down once before returning to GA (General Availability), so I thought it was a bit of a shame that it couldn't be integrated. I guess we can only hope for future AWS updates.

Finally

It's been almost six months since re:Invent 2025, but I finally got to try out Security Agent. Penetration testing, once GA is available, has become difficult to implement at an individual level. The preview period doesn't last forever. I strongly felt that you should try it as soon as possible after the announcement.

You can still relatively easily experience Security Agent through code reviews, which are still in preview, so it's not too late! Why not make your Security Agent debut with a code review and use it as an opportunity to learn about web application security?

Also, since design reviews are still in preview, I plan to try those out soon as well.

I hope this article is helpful to someone. Thank you for reading to the end!