TL;DR
CodeWhisperer is AWS's AI coding assistant, and it's one of the few that ships with real security scanning built in. It flags vulnerabilities like SQL injection and hardcoded secrets as you type. The AWS integration is genuinely strong, though generated code still needs review. Professional tier adds enterprise controls and won't use your code for training.
How CodeWhisperer Works
Amazon CodeWhisperer integrates directly into your IDE and gives you real-time code suggestions:
- Code generation: Suggests complete functions based on comments and context
- Security scanning: Built-in scanning for common vulnerabilities
- Reference tracking: Identifies when suggestions match open source code
- AWS optimization: Especially strong at AWS service integration
Built-in Security Features
Most AI coding tools don't include security scanning. CodeWhisperer does.
Security Scanning
The built-in scanner checks for:
- SQL injection vulnerabilities
- Cross-site scripting (XSS)
- Hardcoded credentials
- Path traversal issues
- Insecure cryptographic practices
- Resource leaks
Pro tip: Run security scans frequently during development, not just at the end. CodeWhisperer can scan your entire project or just the current file.
Reference Tracking
When CodeWhisperer suggests code similar to open source projects, it:
- Flags the suggestion with a reference
- Shows the license of the original code
- Helps you make informed decisions about using the suggestion
AWS Integration Security
CodeWhisperer's AWS context is a real advantage, and it shows in the suggestions. A few areas need extra scrutiny:
IAM Policies
Generated IAM policies tend toward overly broad permissions. Review them before deploying:
- Check for
*in Resource fields - Verify Action permissions are minimal
- Use IAM Access Analyzer to validate policies
AWS Credentials
CodeWhisperer knows AWS patterns well. It still generates placeholder credentials sometimes:
- Never commit AWS access keys
- Use IAM roles instead of access keys when possible
- Use AWS Secrets Manager for sensitive configuration
Important: Even with built-in scanning, don't rely on it exclusively. Review generated code manually and use additional security tools for production applications.
Privacy and Data Handling
Individual Tier
The free Individual tier may use code snippets to improve the service. You can opt out in settings, but the controls are basic.
Professional Tier
The paid Professional tier is cleaner on privacy:
- Code is not used for training
- Admin controls for organization
- SSO integration
- Audit logging
- Custom security policies
Configuration Best Practices
Enable Security Scanning
Make sure security scanning is enabled and run scans regularly:
- Scan on save or at regular intervals
- Review all flagged issues before committing
- Don't dismiss warnings without understanding them
Configure Reference Settings
Decide how to handle open source references:
- Filter suggestions matching certain licenses
- Block or allow specific license types
- Review references before accepting suggestions
Limitations
The built-in scanning is a genuine differentiator. It still has limits:
- It won't catch all vulnerabilities
- Business logic flaws aren't detected
- Authentication design issues may not be flagged
- Generated code can still have subtle security issues
Does CodeWhisperer have built-in security scanning?
Yes. CodeWhisperer includes security scanning that can detect vulnerabilities in generated code. It checks for issues like SQL injection, XSS, and hardcoded credentials. This is a differentiating feature compared to some other AI coding tools.
Is CodeWhisperer free?
CodeWhisperer offers a free Individual tier with unlimited code suggestions. The Professional tier adds admin controls, organizational policies, and additional security features for enterprise use.
Does CodeWhisperer work with non-AWS services?
Yes. While CodeWhisperer excels at AWS service integration, it supports general programming languages and frameworks. You can use it for any project, not just AWS-specific development.
How does CodeWhisperer compare to Copilot?
CodeWhisperer's key advantages are built-in security scanning and strong AWS integration. Copilot has deeper GitHub integration and may have broader training data. Both require security review of generated code.
Using CodeWhisperer?
Complement built-in scanning with a comprehensive security check.