AWS Security Agent — Design Review Feature

In my previous article, I walked through the Code Review feature of the AWS Security Agent. If you missed it, you can check it out here: Implementation of AWS Security Agent for Automated Code Security Reviews | by Mallikarjuna M | Feb, 2026 | AXIOMIO

In this post, we’re moving on to Part 2 — the Design Review feature. Why is this important? Because catching security issues during the design and architecture phase is far more efficient than fixing them after development begins. Early detection means fewer risks, less rework, and stronger security from the start.

This article explains how Design Review strengthens application security by: • Reviewing architecture diagrams. • Analyzing design documents. • Comparing designs against security best practices.

Step1: In This Step, You Will Create a New Agent Space Specifically for the Design Review Feature in AWS Security Agent.

To begin using the design review feature, an Agent Space must be created. An Agent Space acts as a dedicated workspace for managing security activities related to a specific application or project.

From the AWS Security Agent console, the user navigates to Agent Spaces and selects Create first Agent Space. A name such as SA_Design_Review is provided along with an optional description. Once created, the Agent Space becomes visible in the navigation panel and is ready to manage design reviews.

Step2: In This Step, You Will Start the Design Review Process, initiate a New Security Assessment, and Submit the Architecture Diagram for Evaluation.

After the Agent Space is set up, the next step is to create a design review. Inside the Agent Space, the Design Review section shows a status of Ready. By selecting Start in web app, the user can begin the review process.

The user clicks Create design review, provides a meaningful review name, and uploads design-related files such as architecture diagrams and design documents. These files represent the system architecture and security considerations that need to be evaluated. Once the files are uploaded, the design review is started.

Step3: In This Step, You Will Review the Design Review Completion Status and Analyze the Security Findings of design review.

After processing the uploaded files, AWS Security Agent completes the design review and marks the status as Completed. A confirmation message is displayed, and the review appears in the design reviews list.

The completed review provides key details including the review status, the date and time of completion, the number of security controls evaluated, and the number of files reviewed, and users can select View details to examine the findings or download the report for future reference.

The findings summary provides a clear overview of the security posture of the design. The results are grouped into four categories:

Non-compliant — Security requirements are not met.

Insufficient data — Not enough information is available to assess compliance.

Compliant — Security requirements are satisfied.

Not applicable — The requirement does not apply to the design.

This classification helps teams quickly understand which areas require attention and which controls are already properly addressed.

Example Finding: Secret Protection Best Practices

One of the key findings in the design review is related to Secret Protection Best Practices, which is marked as non-compliant. The review identifies insecure practices such as storing long-term IAM access keys on EC2 instances and saving secrets in Lambda environment variables. These approaches increase the risk of secret exposure and unauthorized access.

To address this issue, AWS Security Agent recommends using IAM roles instead of long-term credentials, storing secrets in AWS Secrets Manager, enabling automatic secret rotation, and removing secrets from environment variables and instance storage. Following these recommendations helps improve the security of sensitive information.

Downloading the Design Review Report

Once the Design Review is completed, users can download the full review report. This report includes all identified findings, detailed explanations, and recommended remediation steps. This document can be used for documentation purposes, audit requirements, or shared with development teams, security teams, and administrators for further review and action.

Conclusion

Early Security Integration: The Design Review feature of AWS Security Agent helps teams address security at the earliest stage of the Software Development Lifecycle (SDLC). It ensures that security is considered before the application is built or deployed.

Preventing Real-World Security Risks: In fast-changing, real-time projects, design mistakes can quickly turn into serious production vulnerabilities. Reviewing architecture diagrams and design documents early helps identify risks such as: Poor secret management, Weak access controls and Missing logging and monitoring mechanisms.

Cost and Time Efficiency: Fixing issues during the design stage is much easier and more cost-effective than resolving them later in development or after deployment. Early detection reduces rework and prevents delays caused by security issues found late in the lifecycle.

Clear Reporting and Collaboration: The findings summary provides a clear overview of security gaps. The downloadable report makes it easy to document results and share them with development teams, security teams, and administrators.