AWS Code Tool

Purpose & User Intent: This tool helps software teams and DevOps engineers assess AWS code workflows by performing automated checks on code, templates, and IaC configurations. It targets developers, security auditors, and release managers who need early risk signals, compliance hints, and optimization suggestions before deployment. Example: analyze a Lambda deployment package to flag least-privilege IAM roles and identify excessive API calls. Core Logic & Features: Domain capabilities include static code analysis, IaC validation, IAM least-privilege checks, cost optimization signals, and security findings. Required features: (a) input ingestion (code, IaC, manifest), (b) rule-based checks (security, licensing, compliance), (c) structured output with risk scores. Optional/advanced features: integration with CI/CD, export formats, suppression rules, custom rule packs. Example rules: detect S3 public buckets, IAM roles with sts:AssumeRole from wide principals, or outdated runtime versions. Inputs & Outputs: Inputs include: code_snippet (string), repo_url (string, optional), aws_region (string), include_services (list), checks (list of names). Outputs include: findings (array of objects with id, severity, description, suggested_fix), summary (object with risk_count, high_risk_percent), exportable_report (JSON/CSV). Validation: code_snippet non-empty in multi-file mode; region must be valid; repo_url must be valid URL or empty. Algorithms & Calculations: Uses a rules engine with a scoring model (severity scores 0-100), pattern matching for IAM policies, static checks on IaC templates, and cross-service dependency analysis. References AWS Well-Architected Framework and best practices; results aggregated into risk categories. Error & Edge Cases: Handles missing inputs by stopping analysis and returning precise error codes; external data outages yield retry with exponential backoff; invalid IAM policy syntax yields descriptive parse errors; large repos are chunked. Industry/Region & Localization: AWS-centric, best practices aligned to AWS Well-Architected Framework; supports en-US; uses USD for cost hints if pricing data available. Assumptions & Exclusions: Assumes access to provided code artifacts; does not modify repos; excludes runtime performance benchmarking; not a full pentest tool.