Penetration testing every deployment with AWS Continuum

Source: AWS Security Blog

Author: Jigar Bhatt

URL: https://aws.amazon.com/blogs/security/penetration-testing-every-deployment-with-aws-continuum/

https://aws.amazon.com/blogs/security/penetration-testing-every-deployment-with-aws-continuum/

ONE SENTENCE SUMMARY:

AWS Continuum adds AI-scoped, post-deploy penetration testing gates to CI/CD, confirming exploitability per-change and blocking promotions via OIDC-authenticated automation.

MAIN POINTS:

  1. SAST/SCA/DAST flag patterns; penetration tests confirm actual exploitability of vulnerabilities.
  2. Continuum runs server-side AI agents to find and validate exploitable issues in running apps.
  3. Gate executes post-deployment in staging, blocking production promotion above chosen severity thresholds.
  4. Change-based scoping tests only commit range since last passing gate, enabling per-deploy speed.
  5. Scoping outcomes include in scope, scoped out, or scope conflict with configurable blocking behavior.
  6. Setup requires configured pentest, IAM role for pipeline, and a pipeline gate step.
  7. OIDC federation replaces long-lived AWS keys, reducing common CI/CD credential leakage risks.
  8. Trust and permissions policies must be tightly scoped; pin sub claims to branches/environments.
  9. GitHub example needs contents: write to advance baseline marker and avoid widening ranges.
  10. Rollout settings independently control severity, scope conflict, and infrastructure-error fail-open/closed behavior.

TAKEAWAYS:

  1. Per-deploy pentesting becomes practical when tests are scoped to just-deployed changes.
  2. A failing gate signals a reproducible exploitable vulnerability, not a signature-based suspicion.
  3. Baseline advances on any passing run, so report-only periods can “clear” commits permanently.
  4. Using OIDC with least-privilege IAM roles strengthens pipeline security and eliminates stored keys.
  5. Production-grade adoption needs pinned action versions, restricted variable overrides, and fail-closed on infra errors.