Implementation of AWS Security Agent for Automated Code Security Reviews

Introduction

Most of the time, security is checked after development is completed. But in reality, security should be part of the development process from the beginning. This is where AWS Security Agent becomes useful. It helps organizations build security directly into the Software Development Lifecycle (SDLC) instead of treating it as a separate task at the end.

It provides three core features of AWS security Agent:

1. Code Review: Helps find vulnerabilities in the source code while the application is being developed.

2. Design Review: Focuses on identifying security issues during the planning and architecture stage.

3. Penetration Testing: Tests the application by simulating attacks to discover weaknesses before deployment.

Let’s begin with the Code Review feature — Part 1 of this series. I chose code review because it helps identify security vulnerabilities early during development, improves code quality, and allows developers to fix issues before the code is merged.

This article demonstrates a complete, practical implementation:

• Creating an Agent Space
• Integrating GitHub
• Enabling code review
• Connecting to a repository
• Triggering real security findings through a pull request

Note: The AWS Security Agent code review only works with private GitHub repos. If the repo isn’t private, it won’t work.

Requirements:

Before you start, you should make sure the following requirements are met:

• You should have an active AWS account with the necessary permissions to set up and use AWS security services.
• You should be able to access the AWS Management Console with sufficient privileges to manage security settings and integrations.
• You should have a GitHub account.
• You should have at least one private GitHub repository (the integration currently supports private repositories only).
• You should have at least one sample code file in the repository that can be used to create a test pull request.

Step 1: In This Step, You Will Configure AWS Security Agent and Create a New Agent Space.

Sign in to the AWS Console and open AWS Security Agent. On the landing page, select Set up AWS Security Agent. Under Agent Space configuration, enter an Agent Space name such as “demo_SA” and optionally add a description. Leave all other fields as default and continue to the access configuration.

Step 2: In This Step, You Will Configure User Access.

Under User access configuration, choose one option:

IAM-only access — Simple setup using existing IAM users and roles (no SSO).

Single sign-on (SSO) with IAM Identity Center — Enables centralized access with SSO and must be selected during initial setup. Here, select IAM-only access, then click Set up AWS Security Agent to finish.

Step 3: In This Step, You Will Verify That Your Agent Space Dashboard Is Set Up Correctly.

Open AWS Security Agent, go to Agent Spaces, and select demo_SA. Confirm that the Agent Space loads successfully and that the dashboard displays the three capabilities: Design review with status Ready, Code review with status Needs setup, and Penetration testing with status Needs setup, as shown in the screenshot.

Step 4: In This Step, You Will Integrate AWS Security Agent with GitHub.

From the left navigation, select Integrations, then click Add integration. From the list of integrations, select GitHub. On the page titled Connect GitHub to AWS Security Agent, click the button Install and authorize.

You will be redirected to GitHub. If prompted, verify your GitHub account by entering the verification code sent to your registered GitHub email address and click on verify.

Step 5: In This Step, You Will Authorize AWS Security Agent in Your GitHub Account.

· You will be redirected to GitHub and may be asked to confirm your login. On the Install & Authorize AWS Security Agent page, you will see two options: All repositories, which grants access to all current and future repositories, and Only select repositories, which limits access to specific repositories. Select the option based on which repositories you want to test, then click Select repositories, choose your repository (for example, arjun3112/SA-demo-Rep), review the permissions, and click Install & Authorize to complete the authorization.

Step 6: In This Step, You Will Confirm That the AWS Integration Was Successful.

· After authorization, you are redirected back to AWS Security Agent. Confirm that the banner message says GitHub integration successfully connected. No selection is needed here; this confirms the connection is successful.

Step 7: In This Step, You Will Select and Connect Your Integration.

· Go to Integrations, select the recently created registration (for example, DVWA-SA). Select User in the GitHub account type field, then click Connect.

Step 8: In This Step, You Will Enable the Code Review Feature in Your Agent Space.

· From the AWS Security Agent console, open Agent Spaces and select demo_SA. On the demo_SA page, find the Code review section (which shows Needs setup) and click Enable code review to activate automated code review for pull requests and begin security scanning for your repository.

Step 9: In This Step, You Will Add the Integration, Choose Your Repository, and Configure the Required Capabilities.

· In the Add integration window, select Available registrations, choose the registration DVWA-SA, and click Next.

· On the Connect GitHub repositories screen, select your repository (for example, SA-demo-Rep), verify that the repository type shows Private, and click On the Manage capabilities screen, Under Code review settings, choose between Security requirement validation (checks compliance with your security rules), Security vulnerability findings (detects common code vulnerabilities), or Security requirements and vulnerability findings (enables both for full coverage). Here, I select the combined option Security requirements and vulnerability findings for better findings then click Connect and confirm setup by the “Integration resources added” message.

Step 10: In this step, you will make changes to a file in your GitHub repository to see how the Code Review feature works.

· Return to the Agent Space dashboard and confirm that the Code review status shows Ready, which indicates the integration is active for code review.

· Open your GitHub repository, edit any file, and add a test security issue such as fake hardcoded credentials (for example, a dummy API key). As shown in the attached screenshot, an API key was added directly into the app.py file, and the change was saved by clicking the Commit changes button.

Step 11: In This Step, You Will Raise a Pull Request and Review the Detected Code Review Findings.

· On the Propose changes screen, ensure Create a new branch for this commit and start a pull request is selected, then click Propose changes to create the pull request.

After I create the pull request, the review runs automatically, and within a few minutes I can see a comment from the aws-security-agent bot directly in the pull request.

It detects that an API key is hardcoded inside the app.py file and explains that storing secrets in the source code is risky because even if we remove them later, they can still exist in the repository history and be misused. The bot recommends removing the API key from the code and storing it securely using environment variables or a secrets management service like AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault, and it also refers to OWASP best practices for handling sensitive information properly.

Conclusion

At the organization level, this feature brings real value by making security simple, consistent, and automatic across all teams.

· Consistent Security for Everyone: It applies the same security checks to all repositories and teams, so everyone follows a common security standard.

· Automated, Not Manual: It does not rely only on manual reviews. The checks run automatically whenever a pull request is created.

· Catch Issues Early: It helps identify common problems like hardcoded credentials before the code is merged.

· Instant Feedback for Developers: Developers receive immediate feedback and can fix issues quickly while they are still working on the code.

· Saves Time for Security Teams: Security teams save time because they don’t need to repeatedly check the same types of issues manually.

· Lower Risk in Production: It reduces the overall risk of security problems reaching production.