c2.10 Manage application vulnerabilities
Scan applications (DAST) and code (SAST) and pen-test your critical applications. Catch issues as early as the developer’s IDE, again in the pipeline and image registry, and again once deployed — defense in depth across the whole lifecycle.
Implementation guidance
Shift left, then keep scanning
Vulnerabilities are cheapest to fix while the developer is writing the code, but defense in depth means scanning at every stage — some code arrives without IDE checks, and new vulnerabilities (for example in a dependency) surface after deployment.
- In the IDE: Amazon Q Developer flags vulnerabilities as code is written and suggests fixes.
- In the pipeline and registry: Amazon Inspector performs code scans (SAST), software composition analysis, and infrastructure-as-code scans, and scans container images in Amazon ECR and code in repositories such as GitHub and GitLab.
- Once deployed: Amazon Inspector scans AWS Lambda function code.
Partner and open-source options
Partner DAST/SAST tools (for example Checkmarx and Veracode) are on the AWS Marketplace. For open source, the Automated Security Helper (ASH) bundles tools like git-secrets, bandit, npm-audit, checkov, cfn_nag, and cdk-nag to find secrets, vulnerabilities, and bad practices across Git, Python, JavaScript, CloudFormation, Terraform, and Jupyter notebooks.
A WAF is not a substitute
Deploying a web application firewall helps block attacks, but it does not remove the need to fix the underlying vulnerability. Following defense in depth, do both.
Related
This connects to Security Champions and DevSecOps in later phases.
How to validate
- Are you scanning applications with both DAST (running app) and SAST (code)?
- What is your coverage — critical applications only, most, or all?
- Are you scanning for secrets and credentials committed to code?
- Does the pipeline block promotion to production when critical vulnerabilities are found?
Threats addressed
- Web applications that must be exposed to serve users put their vulnerabilities directly within reach of adversaries.
- Most development teams are not security experts and rarely have time to prioritize secure-coding practices without tooling.
AWS services
Amazon Inspector 
Amazon ECR 
Amazon Q Developer