JA EN
shiichan

AWS Continuum for Code Vulnerabilities Is Now GA: From Finding to Fix PR!

AWS Blog ★★★★ View Markdown
#aws#security#ai

Hi, it's Shii-chan!

AWS Blog aws.amazon.com

A new service that could take the pain out of vulnerability triage just showed up!

What was announced?

The AWS Blog announced the general availability of AWS Continuum for code vulnerabilities. It's a security service that uses AI to automatically find, validate and prioritize code vulnerabilities, then delivers ready-to-review fixes as pull requests.

Why it matters

Triaging a mountain of raw scanner findings is a heavy burden for people. Continuum aims to lighten it by showing validated, prioritized issues in the console rather than raw scanner output.

What changes

Work that used to take hours of manual investigation and days of cross-team coordination now arrives as validated issues and fix pull requests that are ready to review.

Dive Deep

How it works

  • Context graph: Continuum builds a graph from your code repositories and AWS environment, learning which systems are business-critical, who owns them, how services depend on each other, and what data they touch
  • Reachability and ranking: An AWS collector gathers resource and network details so Continuum can judge whether a vulnerability is reachable over the network. Issues are ranked by how close the attack path runs to high-value systems such as customer data stores, payment pipelines and authentication services
  • Validation: Each finding gets an evidence level. For reproducible findings, Continuum runs the exploit in an isolated sandbox and attaches proof-of-concept code and reproduction steps. It also assesses blast radius and whether existing defenses would detect or stop the path
  • Remediation: For each confirmed issue, it generates a code patch, dependency upgrade or configuration change and opens it as a pull request in your connected repository

Modes

Today, Continuum proposes each fix and a person reviews and merges it. Nothing ships without approval.

In the future, you will be able to choose which actions Continuum takes on its own within guardrails you define, gated by confidence factors such as test coverage, scope bounds and historical success rate.

The AWS What's New announcement describes these as Learn mode and Enforce mode.

Integrations and setup

  • Code sources: a GitHub integration or an Amazon S3 bucket
  • Scanner findings: shown in the Findings tab, where issues are built from them
  • AWS collector (optional): set up in the account and Region where your code runs, supplying AWS Config resources and network configuration
  • IAM: for S3 sources, access is granted through an IAM role that Continuum assumes

Setup goes like this:

  • Open the AWS Continuum console and go to Code vulnerabilities
  • Connect a code source (GitHub or S3). For S3, the bucket must be in the same account and Region where you turn on Continuum
  • Create an environment that scans the source on a schedule you choose
  • (Optional) Set up an AWS collector and authorize the environment to use it
  • Review issues in priority order, check the evidence and scope, then approve and merge the pull requests you trust

Limits and caveats

  • Available in two Regions: US East (N. Virginia) and US West (Oregon)
  • Every fix requires human approval today
  • A generated patch doesn't mean the issue is fixed; you still need to review and merge
  • Without the AWS collector, Continuum has less infrastructure context for reachability and ranking
  • The blog post doesn't give pricing and points to the pricing page

Wrap-up

  • Finds vulnerabilities with AI, validates them in a sandbox, prioritizes them and delivers fix PRs
  • A context graph and reachability analysis surface the issues that carry real risk
  • Human approval is required today; autonomous action is a future capability
  • Code sources are GitHub or S3; available in US East (N. Virginia) and US West (Oregon)

This is for security and platform teams buried under piles of scanner findings!

Related posts