AWS CodeGuru Reviewer gets a library for known security vulnerabilities in Python and Java. It doesn’t fix the problems, but it lets you know when you’re vulnerable.
Amazon Web Services (AWS) is making its code detector CodeGuru Reviewer smarter with a new “Detector Library. This includes numerous known vulnerabilities that Java or Python Web applications may contain. It also includes the recent Log4Shell that has been gripping the world since late last year.
CodeGuru Reviewer presents detailed results with impact analysis for each problem. Today it includes 91 Java detectors and 69 Python detectors.
AWS emphasizes that CodeGuru uses machine learning and automated reasoning to discover problems. This allows it to find additional problems on top of a problem. CodeGuru does not look at the version of libraries you are using, but rather what you are effectively logging. That way, the tool can also protect you when similar bugs strike in the future.
CodeGuru Reviewer is a paid service within AWS and starts from $10 per month for the first 100,000 lines of code in onboarded repositories. After that, it costs $30 per month for each additional 100,000 lines of code.