AWS CodeCommit Integration

CodeScan connects to any AWS CodeCommit repository, runs a full AI security scan across your source files, and — with one click or one command — opens a Pull Request in your AWS Console with every vulnerability patched.

What you need before you start

Step 1 — Find your repository name and region

CodeScan needs only the repository name (not the full ARN) and the AWS region it lives in.

1a. Repository name

1. Sign in to the AWS Management Console
2. Navigate to Developer Tools → CodeCommit → Repositories
3. The Name column shows the exact repository name to use — copy it

1b. Region

The region is visible in the top-right corner of the AWS Console or in the repository URL:

# URL pattern — region is the first segment after amazonaws.com
https://us-east-1.console.aws.amazon.com/codesuite/codecommit/repositories/my-backend-api
#       ^^^^^^^^^^

# Common region codes
us-east-1        US East (N. Virginia)
us-west-2        US West (Oregon)
eu-west-1        Europe (Ireland)
eu-central-1     Europe (Frankfurt)
ap-southeast-1   Asia Pacific (Singapore)
ap-northeast-1   Asia Pacific (Tokyo)

Step 2 — Create an IAM user with minimal CodeCommit permissions

Never use your root account credentials. Create a dedicated IAM user so you can scope permissions tightly and rotate the key independently.

2a. Create the IAM user

1. In the AWS Console, go to IAM → Users → Create user
2. Enter a name, e.g. codescan-scanner
3. On the Set permissions page, choose Attach policies directly
4. Click Create policy (opens new tab) and paste the JSON below
5. Name the policy CodeScanMinimalAccess and create it
6. Back on the user creation page, attach CodeScanMinimalAccess
7. Complete user creation

Minimal IAM policy — paste this exactly

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CodeScanReadWrite",
      "Effect": "Allow",
      "Action": [
        "codecommit:GetBranch",
        "codecommit:GetRepository",
        "codecommit:GetFolder",
        "codecommit:GetFile",
        "codecommit:CreateBranch",
        "codecommit:CreateCommit",
        "codecommit:CreatePullRequest"
      ],
      "Resource": "arn:aws:codecommit:*:*:*"
    }
  ]
}

# To restrict to a specific repo only, replace the Resource line with:
# "Resource": "arn:aws:codecommit:us-east-1:123456789012:my-backend-api"

2b. Generate the Access Key

1. In IAM, click the user you just created
2. Go to the Security credentials tab
3. Scroll to Access keys and click Create access key
4. Choose Application running outside AWS as the use case
5. Click through to the confirmation page — you will see:
   Access key IDAKIAIOSFODNN7EXAMPLE

   Secret access keywJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
6. Copy both values immediately. AWS shows the secret key only once — it cannot be retrieved later. Paste them somewhere safe before closing.

Step 3 — Use the AWS tab in the CodeScan web scanner

3a. Open the Remote Repo panel

1. Go to codesscan.com/scan and sign in
2. In the left sidebar, click the ⎇ REMOTE REPO tab (next to ⬆ FILES)
3. At the top of the panel you will see three provider chips — click AWS

3b. Fill in the fields

3c. Fetch & Scan

Click ⎇ Fetch & Scan. CodeScan will:

1. Authenticate with AWS using your Access Key
2. Resolve the default branch and latest commit ID
3. Walk the repository folder tree recursively (up to 8 levels deep)
4. Fetch each source file concurrently (up to 60 files by default)
5. Run the full 5-step AI security pipeline on every file
6. Run secret scanning in parallel (detects hardcoded API keys, tokens, passwords, certificates)
7. Display results in the CODE FINDINGS, DEPENDENCIES, and SECRETS tabs

The sidebar confirms the fetch with the repo name, branch, and number of files loaded.

Step 4 — Review and apply fixes

Apply a fix to a single vulnerability

1. In the CODE FINDINGS tab, click any file card to open the Detail view
2. Click a vulnerability to expand its full description
3. Click ⚡ Apply AI Fix — the fix is generated and applied to the file in the scanner
4. Use the Show diff toggle to review exactly what changed

Use CodescanBot to apply fixes (conversational)

1. Open CodescanBot (click ◈ CodescanBot in the header or press Ctrl+K)
2. Select a vulnerability from the list
3. Click the ⚡ Apply fix chip or type “fix this”
4. The bot explains the change and applies it — the file updates automatically in the scanner

Step 5 — Create the Fix Pull Request

Once one or more files have been patched in the scanner, a green button appears in the sidebar:

1. Click ⎇ Create Fix PR
2. A modal opens. Confirm or edit:
   • Branch name — default: codescan/security-fixes-YYYYMMDD
   • PR title — default: [CodeScan] Security fixes — N file(s) patched
3. Click ⎇ Create PR
4. CodeScan creates the fix branch, commits all patched files in a single atomic CreateCommit call, and opens the PR
5. The PR URL appears in the sidebar — click it to open the diff in the AWS Console

What the PR looks like in the AWS Console

• Navigate to CodeCommit → Repositories → your-repo → Pull requests
• Source branch: codescan/security-fixes-20260514
• Destination branch: your default branch (e.g. main)
• The description lists every patched file with a review checklist
• The Changes tab shows the exact diff — only vulnerable lines were modified
• Run your tests and CI pipeline, then approve and merge the PR normally

How the fix commit is built (technical detail)

CodeCommit's CreateCommit API accepts multiple file changes in a single call — all patches are applied atomically. The flow:

Step 6 — Using the CLI instead

The CLI gives you the same scan + fix + PR workflow from your terminal, ideal for CI/CD pipelines and automation scripts.

Install & login

npm install -g codescan-flowlog
codescan login

Set credentials as environment variables (recommended)

export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
export AWS_REGION=us-east-1
# All codecommit commands now pick these up automatically

Scan a repo (read-only — nothing written to CodeCommit)

# Basic scan of the default branch
codescan codecommit scan my-backend-api

# Scan a specific branch
codescan codecommit scan my-backend-api --branch develop

# Show every finding (not just summary)
codescan codecommit scan my-backend-api --verbose

# Save full JSON report to file
codescan codecommit scan my-backend-api --output report.json

# Scan more than 60 files
codescan codecommit scan my-backend-api --max-files 120

# Pass credentials inline (without env vars)
codescan codecommit scan my-backend-api \
  --access-key-id AKIAIOSFODNN7EXAMPLE \
  --secret-access-key wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY \
  --region us-east-1

Scan + fix + open PR (one command)

# Fix high+ severity findings and open PR
codescan codecommit fix my-backend-api

# Preview what would change (dry run — nothing written to AWS)
codescan codecommit fix my-backend-api --dry-run

# Fix only critical findings
codescan codecommit fix my-backend-api --severity critical

# Custom branch name and PR title
codescan codecommit fix my-backend-api \
  --pr-branch security/q2-patches \
  --pr-title "Security: patch SQL injection and hardcoded secrets — Sprint 18"

# Scan a non-default branch
codescan codecommit fix my-backend-api --branch staging

Recommended workflow

# 1. Dry run to preview what would change
codescan codecommit fix my-repo --dry-run

# 2. Review the output carefully, then apply for real
codescan codecommit fix my-repo

# 3. The PR URL is printed — open it in the AWS Console
# 4. Review the diff in the Changes tab
# 5. Run your tests, then approve and merge

CLI flag reference — codescan codecommit

AWS CodeBuild — automated security scanning in CI/CD

Add CodeScan to your CodeBuild project so every commit to a monitored branch triggers a security scan. The build fails if critical vulnerabilities are found, blocking the merge.

# buildspec.yml
version: 0.2

env:
  parameter-store:
    CODESCAN_TOKEN: /codescan/token

phases:
  install:
    runtime-versions:
      nodejs: 20
    commands:
      - npm install -g codescan-flowlog

  build:
    commands:
      - codescan scan --dir ./src
          --gate
          --fail-on high
          --save-history
          --output codescan-report.json

artifacts:
  files:
    - codescan-report.json

Store your CodeScan token in AWS Systems Manager Parameter Store as a SecureString under /codescan/token and grant the CodeBuild service role ssm:GetParameters access to that path.

Full pipeline with scan + auto-fix PR (CodePipeline)

# Add as a second CodeBuild action in your pipeline:
version: 0.2

env:
  parameter-store:
    CODESCAN_TOKEN:          /codescan/token
    AWS_ACCESS_KEY_ID:       /codescan/aws-key-id
    AWS_SECRET_ACCESS_KEY:   /codescan/aws-secret

phases:
  install:
    runtime-versions:
      nodejs: 20
    commands:
      - npm install -g codescan-flowlog

  build:
    commands:
      # Fix critical/high findings and open a PR automatically
      - codescan codecommit fix $REPO_NAME
          --region $AWS_DEFAULT_REGION
          --severity high
          --pr-title "CodeScan automated fix — $CODEBUILD_BUILD_NUMBER"
          --dry-run   # remove --dry-run when you are ready to auto-merge

Troubleshooting

Quick reference cheatsheet

# ── Credentials (set once, reuse everywhere) ──────────────────────
export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
export AWS_REGION=us-east-1

# ── Find your repo name ────────────────────────────────────────────
# AWS Console → Developer Tools → CodeCommit → Repositories → Name column

# ── Scan ──────────────────────────────────────────────────────────
codescan codecommit scan my-repo                   # default branch
codescan codecommit scan my-repo --branch develop  # specific branch
codescan codecommit scan my-repo --verbose         # all findings
codescan codecommit scan my-repo --output r.json   # save report

# ── Fix + PR ──────────────────────────────────────────────────────
codescan codecommit fix  my-repo                   # fix high+ → PR
codescan codecommit fix  my-repo --dry-run         # preview only
codescan codecommit fix  my-repo --severity critical
codescan codecommit fix  my-repo --pr-branch security/q2-fixes

# ── Web UI ────────────────────────────────────────────────────────
# codesscan.com/scan → ⎇ REMOTE REPO → AWS chip
# Enter: repo name + region + Access Key ID + Secret Access Key → Fetch & Scan