Scan, optimize, and repair your code using Amazon Bedrock Agents

Amazon Bedrock is a fully managed service that makes leading AI startups and Amazon’s Foundational Models (FM) available through APIs. So you can choose from a wide range of FMs to find the best model for your use case. With the Amazon Bedrock serverless experience, you can get started quickly, privately customize FM with your own data, integrate it into your applications using Amazon Web Services (AWS) tools, and deploy it without managing infrastructure. can.

Providing a secure code repository is essential for companies involved in cloud computing and software development. As advanced cybersecurity threats become more prevalent, organizations must take proactive measures to protect their assets. Amazon Bedrock provides a powerful solution by automating the process of scanning and remediating repository vulnerabilities. This post explains how you can use Amazon Bedrock to strengthen the security of your repositories and maintain compliance with organizational and regulatory standards.

This solution shows you how to configure Amazon Bedrock Agent to scan specific code repositories, remediate vulnerabilities, and push changes to new branches. This approach speeds development, reduces errors, and adheres to security guidelines.

Solution overview

There are three high-level steps to deploying the solution:

1. Configuring the Amazon Bedrock agent
2. Configure AWS Lambda functions for action groups
3. Add action groups to Amazon Bedrock agent

There are two important steps in the architecture, as shown in the following diagram.

1. The user provides the required information through the Amazon Bedrock agent chat console. These provide code repository URLs such as: https://github.com/abc/testspecify the branch name to scan. for example, major. Next, list the folders you want to exclude from the scan. testspecify the file extensions to exclude. .md and . TXT. Then specify the new branch name where the modified code will be uploaded.
2. The Amazon Bedrock agent forwards the details to the action group that calls the Lambda function. This function takes code, scans it for vulnerabilities using a preselected large language model (LLM), applies repairs, and pushes the repaired code to a new branch for user validation. Masu. Excluded folders and file extensions are not scanned. Once complete, the action group (Lambda function) sends information back to the Amazon Bedrock agent and displays the status to the user.

Figure 1. Architecture diagram

Prerequisites

To implement the solution you will need:

Configure the Amazon Bedrock agent

To configure the Amazon Bedrock agent, follow these steps:

1. In the Amazon Bedrock console, agent In the navigation pane, select Creating an agent.
2. (Optional) Enter agent details, such as agent name and description.
3. Grant your agent permissions to AWS services through an IAM service role. This allows the agent to access the services it needs, such as Lambda.
4. Select FM (such as Claude 3 Sonnet by Anthropic) on Amazon Bedrock.
5. To scan your code repository and remediate vulnerabilities through Amazon Bedrock Agent, attach the following instructions to the agent.

You are an AI assistant that scans and repairs codes. Greet the user and ask for the repository_url and Branch_name that needs to be scanned. Prompts the user for a list of folders that should be excluded from the scan, and also asks the user for a list of specific file extensions that should be excluded from the scan. Push the modified code by asking the user for a new branch name. Pass these inputs to the code scan remediation action group trigger.

Configure Lambda for action group

After you perform the initial configuration of the agent and add the preceding instructions to the agent, create one Lambda function that will be used for the action group.

Create a Lambda function designed to scan your code repository for vulnerabilities, remediate vulnerabilities, and push changes to a new user-specified branch. This function is used by action groups and is called by the Amazon Bedrock agent after a user enters a code repository URL, a branch name, and a list of folders and file extensions to exclude from scanning. A reference to your Lambda code. Ensure that your Lambda function has the necessary IAM permissions and set resource-based policies on your Lambda function to enable Amazon Bedrock Agent. lambda:InvokeFunction action. Please see the policy here.

Add action groups to Amazon Bedrock agent

To add an action group to the Amazon Bedrock agent, follow these steps:

• Add an action group to the Amazon Bedrock agent.
• Assign a meaningful name to your action group and provide details about its functionality in the description field. This helps clarify the purpose of action groups within your workflow.
• for Action group typeand select Define in Function Details.
• for Call action groupselect the Lambda function you created earlier.

This function performs the necessary business logic when the action is called. Be sure to select the correct version of your Lambda function and set your GitHub token as an environment variable. For more information about configuring a Lambda function for an action group, see Configuring a Lambda Function to Send Information for the Amazon Bedrock Agent to Pull from Users.

• for Action group function 1select JSON editor and add the required parameters. A reference to a JSON file.

The following screenshot shows an example of user interaction with Amazon Bedrock Agents.

Figure 2. User interaction with Amazon Bedrock Agent

The following screenshot shows an example of the modified code.

Figure 3. Difference between the actual code and the modified code sample

best practices

Follow these best practices:

• Add automated tests to validate code before committing it to the repository and review modified code before merging it into the default branch.
• To maintain clear version control, use descriptive branch names when creating new branches during repair.
• Configure IAM roles and permissions based on the principle of least privilege to secure your Amazon Bedrock agent and Lambda functions.
• Update prompts to target and remediate use case-specific vulnerabilities

cleaning

Services used in this demo may incur charges. To clean up your resources, follow these steps:

1. Delete a Lambda function if you no longer need it.
2. Delete the action group and agent you created
3. Delete the generated branch from your GitHub repository

conclusion

Amazon Bedrock Agents use generative AI to transform code repositories by scanning for vulnerabilities and automatically applying fixes. This feature is essential for engineers because it speeds up the process of securing code and keeping it compliant with established best practices from the beginning.

The interactive features of Amazon Bedrock Agents automate the vulnerability scanning and remediation process, streamlining initial setup, and greatly enhancing ongoing code maintenance. Although this post focuses on code scanning and remediation, the interactive features of Amazon Bedrock Agents can be applied to a variety of AWS services, making it a dynamic and comprehensive solution for managing and optimizing your cloud infrastructure. We provide

Amazon Bedrock Generation Are you ready to streamline your cloud adoption process with AI? Start by exploring the Amazon Bedrock User Guide to learn how you can accelerate your organization’s journey to the cloud. If you need professional support, consider working with AWS Professional Services to maximize the efficiency and benefits of using Amazon Bedrock.

Harness the potential for fast, secure, and efficient cloud transformation with Amazon Bedrock. Take the first step today and discover how using generative AI can revolutionize your approach to cloud infrastructure.

About the author

rama krishna yala He is an Associate DevOps Consultant at AWS, skilled in designing scalable, reliable, and secure cloud environments. He leverages automation and CI/CD best practices to streamline software delivery, reduce downtime, and improve operational efficiency. Rama is experienced in managing Infrastructure as Code (IaC) to ensure consistent and reproducible deployments. We also focus on implementing robust monitoring and logging solutions to enable proactive problem resolution and optimized performance. Outside of work, Rama enjoys playing badminton and often participates in local tournaments.

Akhil Raj Yalameri He is a Cloud Infrastructure Architect at AWS, specializing in designing cloud infrastructure solutions to enhance data security and cost efficiency. He has experience in integrating technology solutions with business strategies to create scalable, reliable, and secure cloud environments. Akhil enjoys developing solutions focused on business outcomes for customers, incorporating generative AI (Gen AI) technology to drive innovation and cloud enablement. He holds a master’s degree in computer science. Outside of his professional work, Akhil enjoys watching and playing sports.