AWS Continuum GA: Code Vulnerabilities Validated, Fixed as PRs

AWS says a large application estate’s scanners can produce thousands of findings a day, many needing no action, and a critical score on a dev-only tool looks the same as a medium score next to a payments database. AWS Continuum for code vulnerabilities, now generally available, tries to fix that by proving which findings attackers can actually exploit and opening the fix as a pull request. For cloud security and platform teams buried in scanner output, the pitch is fewer, better-ranked issues, with a person still approving every change.

What Happened

AWS’s launch post describes a service that finds and validates code vulnerabilities, ranks the issues by business impact and proposes a fix for each. It is available in US East (N. Virginia) and US West (Oregon).

Setup has three parts:

• Code source: a GitHub integration or an Amazon S3 bucket, scanned on a schedule. An S3 source must sit in the same account and Region, with access through an IAM role Continuum assumes.
• AWS context (optional): a collector in the account and Region where the code runs gathers AWS Config resources and network configuration.
• Environment: ties the two together and controls settings such as whether Continuum creates remediation patches.

Why It Matters

The design shift is from severity scores to evidence. Continuum builds a context graph from repositories and the AWS environment, learning which systems are business-critical, who owns them, how services depend on each other and what data each touches. It then ranks each issue by how close its attack path runs to high-value systems such as customer data stores, payment pipelines and authentication services.

Each finding gets an evidence level, such as a verdict proven by static analysis. For findings it can reproduce, Continuum runs the exploit in an isolated sandbox and attaches proof-of-concept code with reproduction steps. It reports the attack path, source analysis and blast radius, and checks whether existing defenses would catch the path.

AWS’s example issue shows the output. It’s rated High: exploitable with “Static proven” evidence, reachable without authentication or user interaction, and a Moderate impact that lets an attacker change business data for other users in the same tenant. The fix arrived as a GitHub pull request changing four files across a cart service, with the same evidence in the PR description.

What This Means for Cloud Teams

Every fix starts as propose-and-approve. AWS says that in the future teams will be able to let Continuum apply specific classes of fixes on its own once confidence gates pass, such as test coverage, scope bounds and historical success rate. The console also warns that a generated patch doesn’t mean the issue is fixed until someone reviews and merges it.

Stack Archive covered Continuum’s earlier launch alongside AWS Context, and Microsoft’s similar move in Azure DevOps Agentic Autofix. Setup details are in the AWS Continuum User Guide.

Source: AWS News Blog

Content created with AI assistance and reviewed for accuracy.