DEV Community: NaoyukiFujita

Let's try threat modeling with AWS Security Agent.

NaoyukiFujita — Mon, 22 Jun 2026 13:10:49 +0000

Introduction

This article is an English translation of the following article.

https://qiita.com/amarelo_n24/items/997a8fb958e14291ce94

At the AWS Summit New York City on June 17, 2026, the public preview of the AWS Security Agent threat modeling feature was announced.

Having previously conducted a code review, I wanted to try out various aspects of the threat modeling feature during its public preview, and so I did.

https://aws.amazon.com/jp/about-aws/whats-new/2026/06/aws-security-agent-threat-modeling/

https://aws.amazon.com/jp/blogs/aws/aws-security-agent-adds-threat-modeling-kiro-power-and-claude-code-plugin-and-more/

This article represents the author's personal views. As it is based on personal testing, please use it only as a reference.

What is Threat Modeling?

Let's start by explaining what "threat modeling" is.

Threat modeling is a series of activities aimed at improving security by identifying threats and defining measures to prevent or mitigate their impact on a system.

*Quoted from the OWASP website
https://owasp.org/www-community/Threat_Modeling

About AWS Security Agent Threat Modeling

This feature identifies threats and suggests recommended countermeasures using the STRIDE framework, based on an overview of the application architecture from design documents or application source code.

SEC01-BP07 of the AWS Well-Architected Framework's security pillar describes identifying threats using threat models. I believe the Security Agent threat modeling feature was released to assist in building according to the Well-Architected Framework.

https://docs.aws.amazon.com/ja_jp/wellarchitected/latest/security-pillar/sec_securely_operate_threat_model.html

What is STRIDE?

The following is an acronym for major threats. It is one of the threat modeling analysis methods that analyzes threats from these perspectives.

Category	Description
Spoofing	Impersonation
Tampering	Tampering
Repudiation	Denial
Information disclosure	Information disclosure
Denial of service	Denial of service
Elevation of privilege	Privilege escalation

https://learn.microsoft.com/ja-jp/azure/security/develop/threat-modeling-tool-threats#stride-model

Trying out threat modeling

Let's try out the AWS Security Agent threat model.

When starting the Security Agent for the first time, you need to create an agent space. Instructions for creating an agent space are described in a previous article from a code review.
https://dev.to/aws-builders/its-not-too-late-make-your-aws-security-agent-debut-with-a-code-review-5egk

① Open the Security Agent screen.
② Click "Start with web app".

③ Click "Create threat model".

④ Select the repository where you want to run the threat model, the functional specification (design document, etc.), the service role to grant access to, and the CloudWatch log group, then create the threat model.

⑤ Click "Start Running" to begin running the threat model.

*You can also view the processing details of the threat model while it's running.

⑥ When the status changes to "Completed," the threat model execution is finished. This time it took about an hour.

Checking Threat Model Execution Results and Outputting Reports

Clicking on a completed threat model allows you to view the total detection results, threats by category, and analysis results for the target web application.

Clicking the "Threat" tag allows you to view details of the detected threats.

Clicking "Generate Report" in the upper right corner of the screen will generate a PDF report. This allows you to share information with people who cannot access the Security Agent.

I ran it in the Tokyo region, but the execution result screen and report were in English. I hope for Japanese language support in future updates.

(Question) Does it not detect web applications created for vulnerability assessment tool verification?

While not exactly a major setback, we encountered a case where the threat model failed to identify (or could not identify) a threat.

Initially, we ran the threat model on a repository containing a web application created for Security Agent verification (created using a generative AI, but I won't go into detail about which one). However, Security Agent determined that there was no threat.

Reading the purpose of the execution target analyzed by the Security Agent, there was a description that determined that "the defect is not a bug to be fixed, but rather something to be evaluated"...

Possible Cause

When instructing the generating AI to create a test application, "Security Agent Because it included the phrase "for operational verification," the repository name suggested a Security Agent PoC (Proof of Concept).
The README also stated that it was a "site dedicated to security testing."

*Part of the README content

It's possible that the Security Agent learned of this information while running the threat model and determined that there was no problem even if a threat existed. Since these two things haven't been changed and run, this remains speculation, but if traces suggesting it was for security tool verification remain in the repository, it's possible it might be judged as not being a problem.

After this, the repository was recreated. The instructions for recreating the repository were made without including any instructions such as "for Security Agent operational verification" or "for vulnerability assessment tool testing." We were able to detect threats by running a threat model on that repository.

Impressions: Implementing threat modeling solely through human effort is extremely difficult.

As I also realized when conducting code reviews, identifying vulnerabilities and threats solely through human effort is incredibly challenging. There aren't many people with the necessary knowledge, and I realized the enormous resources required to create a secure environment.

I also realized that effectively using agents like Security Agent to identify vulnerabilities and threats can significantly improve the resolution of the impact on the system.

However, I don't believe that all the results from the agent are always correct. Depending on the web application's configuration, there may be over-detection, and some low-risk threats may require early intervention. The final decision on whether to address the results and the final triage of threats absolutely must be made by a human.

In conclusion

Although I was familiar with the term "threat modeling," I hadn't delved deeply into what it entailed or what it could reveal. Therefore, I'm glad I was able to experience a part of it by implementing the Security Agent threat model.

Since it will likely cost a considerable amount once it becomes generally available (GA), I plan to use Security Agent in the preview version, where there are no costs involved, to learn more about code review and threat modeling. I hope Security Agent will be a good opportunity to make vulnerability assessment and threat modeling more accessible.

I hope this article is helpful to someone.

Thank you for reading to the end!

I tried out the AWS FinOps Agent as soon as it was released in public preview.

NaoyukiFujita — Thu, 11 Jun 2026 16:45:58 +0000

Introduction

This article is an English translation of the article at the following URL, which was originally written in Japanese.

https://qiita.com/amarelo_n24/items/9f1457a999510a5714a4

On June 9, 2026, AWS FinOps Agent was released as a public preview.

Following the Security Agent and DevOps Agent, another Agent service has been made available.

I didn't get a chance to try the previous two during their previews, so I told myself I absolutely have to try FinOps Agent while it's still in preview! — and dove right in.

Here are my findings and impressions!

https://aws.amazon.com/jp/about-aws/whats-new/2026/06/aws-finops-agent-preview/

Note: This article reflects the author's personal opinions. The results are based on personal use only, so please treat them as a reference.

Note: This article was written based on information as of June 11, 2026. At the time of writing, the service is only available in the US East (N. Virginia) region.

What is AWS FinOps Agent?

It is a cutting-edge agent that continuously monitors costs across your cloud environment, investigates anomalies, and makes it easy to identify optimization opportunities.

It supports:

Cost anomaly investigation triggered by events
Cost queries in natural language
Periodic cost reporting
Responses using context files and memory

It appears to work in conjunction with the following services:

AWS Cost Explorer
AWS Cost Anomaly Detection
AWS Cost Optimization Hub
AWS Compute Optimizer
AWS CloudTrail

Cited from AWS official documentation

https://docs.aws.amazon.com/finops-agent/latest/userguide/what-is.html

Setup

I followed this guide during setup:

https://aws.amazon.com/jp/blogs/news/aws-finops-agent-is-now-public-preview/

Deciding the Agent Name and Creating an IAM Role

Open the FinOps Agent console and create an agent by clicking "Get Started."

Once you've decided on an agent name, create an IAM role with the following permissions:

Permissions for the agent to access AWS resources
Permissions for the web app to access the agent

Third-Party App Integration

You can connect either Jira or Slack to FinOps Agent. I chose to integrate with Slack.
Set up your Slack workspace and channel beforehand.

Note: Steps to create a Slack workspace and channel are omitted here.

Select Slack and configure the integration via the "Add Integration" button.

Click the "Authorize with Slack" button to grant the FinOps Agent app access.

Warning: I was unable to configure agent permissions without first disabling multi-session in the AWS Management Console. Be sure to disable multi-session beforehand.

I thought the agent was successfully created — but then got an error...

It turned out that the FinOps Agent App needed to be added as a member of the Slack channel, but there was no prior explanation of this. While you can set up the Slack integration later, it would have been helpful to have clearer instructions upfront.

After adding the App as a channel member and then configuring the integration, everything worked fine.

Running the Agent

Next, run FinOps Agent from the web app by clicking "Open" in the Open Agent section.

The FinOps Agent chat screen opens. Enter a prompt and it returns an answer. Japanese prompts are accepted, but responses were returned in English.

Costs with credits applied were not included in the totals. When I rewrote the prompt to calculate costs before credit application, it was able to aggregate them correctly.

Tasks

On the left side of the FinOps Agent screen, there is a "Task" menu.

Tasks run in the background without interrupting your conversation. When you ask the agent to create a task, it processes it in the background.

https://docs.aws.amazon.com/finops-agent/latest/userguide/task-management.html

Tasks come in three types:

Run once
Scheduled execution
Event-triggered execution

Interestingly, clicking "Run Once" displays "Create Task," but clicking "Run on a Schedule" switches to the "Automations" selection, and the "Create Task" button at the top of the screen changes to "Create Automation."

I was curious about the difference between Tasks and Automations and noticed this while looking into it. This kind of quirk is perhaps expected in a preview version — it's interesting!

Running a Task

I created and ran a one-time task ("Run Once"). It calculated usage charges for May (before credit application), compiled the results into a PDF report, and sent it to Slack.

The PDF report was delivered to Slack. It was neatly organized and easy to read.

The analysis results were also stored in Artifacts.

Scheduled Execution (Automations)

I set up a task to send a weekly report to Slack every Thursday at 8:00 AM (Wednesday 11:00 PM UTC).

On Thursday, June 11 at 8:02 AM, the aggregated results were sent to Slack. It took 2 minutes for the aggregation and Slack delivery, but I was able to confirm that the scheduled execution worked correctly.

Impressions

Being able to manage costs easily using natural language — without needing to build a cost management agent or dashboard from scratch — and being able to schedule those tasks is really great.

I didn't configure it this time, but with event-triggered execution ("Run when an event occurs"), it seems like you could set up notifications for:

Which service is causing a sudden spike in costs
Recommended actions for cost optimization

One thing I'm curious about is what the FinOps Agent usage fee will be once it reaches general availability (GA). Since I use AWS for personal purposes and can't spend too much, whether using FinOps Agent to optimize costs will yield a good return on investment is something I'll be keeping an eye on.

It may be challenging to get impressive results with personal usage, but I still want to find interesting use cases.

Closing Thoughts

Since I use AWS for personal purposes and pay out of pocket (or use credits), I try to be careful about cost management to avoid unexpected charges. Even so, I often end up leaving resources running by mistake and incurring unnecessary costs. With that in mind, I'd like to start leveraging FinOps Agent to better manage and optimize my costs going forward.

I hope this article is helpful to someone out there.
Thank you so much for reading all the way to the end!

It's not too late! Make your AWS Security Agent debut with a code review!

NaoyukiFujita — Sat, 30 May 2026 00:45:11 +0000

Introduction

This article is an English translation of the article at the following URL, which was originally written in Japanese. The screenshots are still in Japanese. Sorry about that.

https://qiita.com/amarelo_n24/items/e196b74f718c750a0e18

The penetration testing feature for AWS Security Agent (hereinafter referred to only as "Security Agent"), which was announced at AWS re:Invent 2025, has been generally available (GA). Code review and design review are still in preview as of May 25th, so those who haven't been able to try Security Agent yet can still try these features. I wasn't able to try penetration testing during the preview period , so I decided to at least experience code review and made my Security Agent debut!

This article reflects the author's personal views. It is based on personal testing and should be used for reference only. Furthermore, the author has no experience in app development, so the terminology used may not be entirely accurate. Any corrections or errors in the content would be greatly appreciated.
This article was written based on information as of May 25, 2026.

What is a Security Agent?

As mentioned above, this service was announced during AWS re:Invent 2025. It is a frontier agent that proactively protects applications throughout the entire development lifecycle in all environments (quoted from the official AWS page).

https://aws.amazon.com/security-agent/

It includes three features that became generally available (GA) in April: penetration testing, design review, and code review (the subject of this article).

Function name	Feature Overview	Status（As of 2026/5/25）
Penetration testing	Attempting to infiltrate the system from an external source to evaluate security measures.	GA
Design Review	Analyze product specifications, architecture documents, and technical designs from a security risk perspective.	Preview
Code Review	Inspect source code and repositories to detect code-level vulnerabilities.	Preview

Code security review (hereinafter referred to as "code review") is a web application diagnostic method that falls under "SAST" (Static Application Security Testing). It is considered a vulnerability assessment that checks for flaws in the source code during the development phase before it is deployed in a test environment, and detects vulnerabilities visible at the code level.

Security Agent Code Review

From here, I will describe the steps to enable the Security Agent and run a code review.

Enable Security Agent

To start using Security Agent, you first need to enable it. Incidentally, simply enabling Security Agent will not incur any charges.

① Click [Set up AWS Security Agent]

② Enter [Agent Space name].
③ Specify [User access configuration].

If you have enabled AWS Organizations and also enabled IAM Identity Center, you might want to select "Single sign-on (SSO) with IAM Identity Center." I chose this option because I also run a one-person organization. Even if you haven't enabled Organizations yet, this might be a good opportunity to try out a one-person organization.

④ Enter a service role name. If there is no suitable role available in your account, a new service role will be created.
⑤ If you want to use KMS encryption, check the encryption option checkbox. If the default encryption is sufficient, uncheck the checkbox.
⑥ Set tags as needed.
⑦ Click [Set up AWS Security Agent].

⑧ Once you see a message indicating that the application has been successfully enabled, the Security Agent has been successfully activated.

Enable Code Review

① Click "Enable code review".

② Add a "Connected Integration". Click "Add".

③ Select "Create a new account" and "GitHub," then click "Next."

④ Click "Open AWS Security Agent on GitHub".

⑤ You will be redirected to the GitHub page. Click "Install".

⑥ Click on the GitHub account that contains the repository where you want to install the AWS Security Agent GitHub App.

⑦ Click "Only select repositories" and select the repository where you want to install the GitHub App from the "Select repositories" dropdown menu.

⑧ Click "Install," and the setup is complete when a screen like the one below appears.

⑨ Return to the following screen and click "Add" again.

⑩ Select the added integration and click "Next".

⑪ Select the GitHub repository name and click "Next".

⑫ Select the features to enable. If you want to perform code reviews, enable "Code review comments". If you want to automatically remediate detected vulnerabilities, enable "Automatic remediation". Click Connect and confirm that "Integration resource added" is displayed.

⑬ Select the code review settings and click "Next". I selected "Security requirements and vulnerability detection results," which is selected by default.

⑭ If you want to obtain application operation logs in CloudWatch Logs, select the log group where you want to store the logs (you need to create the log group beforehand).
⑮ Create a role for service access. If you have already created one, click "Use existing service role". If the default role is acceptable, click "Create default role".
⑯ Click "Save".

This time, we created a default role, but I think it's necessary to create a role with carefully considered policy settings. I'll investigate what policies are necessary in the future.

⑰When it displays as shown below and "Ready" appears in the code review section, code review is enabled.

Application User Settings

Add an IAM Identity Center user to allow code reviews from the application.

For testing purposes, you can access it with "Administrator Access" without creating a user, but since administrators don't usually perform vulnerability assessments in normal operation, we'll configure a user even for testing purposes.

① Return to the "Agent Spaces" top page and click "Add Users" from the "Web App" tab.

② Select the IAM Identity Center username you want to allow access to the Security Agent web app and click "Add users".

③ Once the message indicating that the user has been added is displayed, click the Agent Web App URL.

④ When the following screen appears, click "Sign in" or wait a moment, and you will be redirected to the Agent Web App screen.

⑤ The screen will display as shown below, and you should confirm that the created Agent Space name is displayed.

Running the Code Review

Now, we will run the code review.

① From the Agent Web App home screen, click "Create a code review."

② Enter a title for the code review.
③ Select the previously connected GitHub repository, the created service role, and the CloudWatch log group, and click "Create a code review."

④ Once the message indicating that the code review has been created is displayed, click "Start review." A confirmation screen will appear, so click "Start review" again.

⑤ The message "Code review started" will be displayed. Reloading the screen will display "In progress."

⑥ Clicking on the created code review will show the progress. Wait until completion.

Code Review Results

This time it was completed in about an hour.

① Once completed, you can view the code review results.

② The scan results are displayed as follows. Well-known vulnerabilities such as SQL injection, cross-site scripting, and path traversal were detected.

Although it says "Completed," it remained showing "Finalizing" for some reason.

Downloading Code Review Results

You can download the code review results as a PDF file. This is likely for requesting corrections or sharing information with developers who do not have an AWS account, or for storing it as evidence.

① Click "Generate Report" in the upper right corner of the code review results screen.

② Edit the extraction criteria and click "Generate and Download." The code review results will be output as a PDF file to your PC's download folder.

Automatic Remediation of Detected Vulnerabilities

Detected vulnerabilities need to be fixed. It is possible to fix them automatically instead of manually.

① Select the vulnerability you want to automatically fix and click "Fix Code."

② Code remediation will begin.

If "Automatic remediation" is not enabled, the following error will appear. In the GitHub repository's features management, turn on the "Automatic remediation" toggle button and save.

③ Scroll to the bottom of the screen to see the detection results for the selected vulnerability. The code remediation status will be displayed. Once the fix is complete and the status changes to "COMPLETED," a pull request is sent to GitHub.

④ Opening the pull request reveals that it was automatically created by Security Agent and details of the changes. If there are no issues with the content, merge it.

Impressions of Conducting a Code Review with Security Agent

Recognizing the Importance of SAST

This code review detected many types of vulnerabilities. It's probably difficult to uncover all vulnerabilities through human code reviews alone. I believe it's an important service that complements human code reviews by inspecting for remaining vulnerabilities. Furthermore, I realized that web application security testing should not only utilize external attack-based testing methods like DAST (Dynamic Application Security Testing), but also SAST, which identifies vulnerabilities at the code level and provides a starting point for fixes.

Completely Eliminating Human Reviews is Not Yet Possible

I realized that Security Agent doesn't completely replace human code reviews.

After running the automatic fix and then performing another code review, the fixed vulnerabilities were not re-detected, but several new vulnerabilities were detected. It's possible that a detection method was added during the initial code review, or that it was a false positive, but it's also possible that a fix in one place affected the entire code or even the entire repository.

As such, the results of the review and the recommended fixes for vulnerabilities are not always optimal for the whole system. Furthermore, there's a risk that applying automated fixes too readily could break the entire application. I think that unless people carefully review the fixes and decide whether to automate or manual fixes, it could lead to unnecessary work being done.

Wouldn't it be great if it could be integrated with CodeCommit?

As of May 21, 2026, it's not possible to target CodeCommit repositories for code reviews. It was truly surprising that S3 could be targeted for code reviews, but CodeCommit couldn't. Currently, if a user of CodeCommit wants to perform code reviews with the Security Agent, they would have to either:

Store source code files in S3 and perform code reviews there
Migrate the repository to GitHub.

Storing files in S3 is troublesome, and migrating to GitHub doesn't seem practical. I think it would be great if it could integrate with CodeCommit to easily perform code reviews.

CodeCommit was such a valuable service that it was shut down once before returning to GA (General Availability), so I thought it was a bit of a shame that it couldn't be integrated. I guess we can only hope for future AWS updates.

Finally

It's been almost six months since re:Invent 2025, but I finally got to try out Security Agent. Penetration testing, once GA is available, has become difficult to implement at an individual level. The preview period doesn't last forever. I strongly felt that you should try it as soon as possible after the announcement.

You can still relatively easily experience Security Agent through code reviews, which are still in preview, so it's not too late! Why not make your Security Agent debut with a code review and use it as an opportunity to learn about web application security?

Also, since design reviews are still in preview, I plan to try those out soon as well.

I hope this article is helpful to someone. Thank you for reading to the end!