AWS Continuum for code vulnerabilities reaches general availability

• AWS Continuum for code vulnerabilities is now generally available, finding and validating code vulnerabilities to deliver automated fixes or pull requests.
• The service uses a context graph built from code repositories and AWS environment data to rank issues by business impact and prove exploitability, reducing manual investigation time.
• Remediations are generated as code patches, dependency upgrades, or configuration changes and opened as pull requests in connected repositories, requiring human approval before merging.
• Available today in US East (N. Virginia) and US West (Oregon) Regions, with pricing details available on the AWS pricing page.

How It Works

• Builds a context graph using a collector in the AWS account and Region to gather resource details like AWS Config and network configuration.
• Analyzes findings against code and environment context to assign evidence levels, such as static analysis proofs or sandboxed exploit reproductions.
• Evaluates whether existing defenses like AWS WAF rules and IAM policies would detect and stop the validated attack path.

Availability and Setup

• Connect code sources via GitHub integration or Amazon S3 bucket (same account and Region as Continuum).
• Set up an AWS Continuum collector to provide infrastructure context for reachability and blast radius assessment.
• Configure scan frequency and environment settings, including whether Continuum creates remediation patches.