AWS announced an automated code analysis service

Dec 09 2019

Author: Sergey Khrenov

Amazon recently announced the launch of a new machine-learning based service for automated code reviews aiming at performance optimization.

According to Amazon's statement, Amazon CodeGuru is a machine-learning service for automated code reviews and application performance recommendations. With this tool, "you can find and fix code issues such as resource leaks, potential concurrency race conditions, and wasted CPU cycles." Amazon CodeGuru provides two tools: Reviewer and Profiler.

CodeGuru Reviewer scans pull requests submitted to the version control system (GitHub or AWS CodeCommit), with a price per line calculated based on the project's size. The tool detects code issues and gives recommendations to fix them.

CodeGuru Profiler is used for dynamic analysis, including CPU utilization, memory utilization, and so on. It aggregates the stack traces to visualize the consumption of resources by your code.

As a static analyzer developer, I'm excited more about the first tool, Reviewer, and I couldn't but share the news with you because in January 2019, I wrote an article about the results of checking one of Amazon projects "Searching for errors in the Amazon Web Services SDK source code for .NET". It proved to be pretty high-quality, but it still had bugs such as this:

V3008 [CWE-563] The 'this.linker.s3.region' variable is assigned values twice successively. Perhaps this is a mistake. Check lines: 116, 114. AWSSDK.DynamoDBv2.Net45 S3Link.cs 116

public string Region 
{ 
  get 
  {
    ....
  } 
  set 
  {
    if (String.IsNullOrEmpty(value))
    {
      this.linker.s3.region = "us-east-1";
    }
    this.linker.s3.region = value; 
  } 
}

There is a missing return statement in the body of the if block. This results in the this.linker.s3.region variable always ending up with the value value even if it's an empty string or null.

It would be interesting to run Amazon Reviewer on that project to see if it could find this bug and other similar issues, but, unfortunately, Amazon CodeGuru currently supports only Java applications. They do promise support of "more languages coming soon" though.

I'd also like to know more about how exactly Reviewer works. How do they search for the claimed types of issues in small portions of code? How reliable are the results?

I'm going to continue exploring Amazon CodeGuru. It's definitely worth it, all the more so that you can try it for free for 90 days.