Amazon Web Services has made AWS Continuum for code vulnerabilities generally available. The security service checks whether reported flaws can be exploited, ranks the resulting issues by business impact and proposes fixes. It is available in the US East (N. Virginia) and US West (Oregon) Regions.
Customers can connect a GitHub repository or an Amazon S3 bucket, then set a scan schedule. For an S3 source, the bucket must be in the same AWS account and Region where Continuum is enabled, and customers must grant access through an AWS Identity and Access Management role.
Customers can also set up a collector in the account and Region where their code runs. AWS says the collector gathers resource and network details that help Continuum assess whether a flaw is reachable and what an attacker could reach from it. The service combines that context with repository data to identify dependencies and rank issues by their proximity to systems such as payment pipelines or customer data stores.
Continuum reproduces findings and generates fixes
For each issue, Continuum provides an evidence level and source analysis. AWS says that when the service can reproduce a finding, it runs the exploit in an isolated sandbox and provides proof-of-concept code and reproduction steps. It also assesses the attack path, the possible scope of damage and whether existing defenses would stop it.
Continuum can generate a code patch, dependency upgrade or configuration change and deliver the proposed fix as a pull request in a connected repository. A person must review and merge each pull request. AWS says a generated patch does not mean the issue has been fixed.
Customers can change their scan schedule or request a scan on demand. AWS points to a separate pricing page but gives no price in its announcement. AWS Continuum for code vulnerabilities is available now in US East (N. Virginia) and US West (Oregon).
