Amazon Q Developer (CodeWhisperer)

Key Features

Best For

Key Specifications

AWS Service Integration: Native Cloud Development

Amazon CodeWhisperer excels at generating code for AWS services, leveraging its deep knowledge of AWS APIs and best practices. As an AWS-native tool, it understands the nuances of cloud development patterns and generates optimized code for various AWS services.

Example: Creating an S3 Bucket with Security Best Practices

When working with AWS S3, CodeWhisperer can generate comprehensive code that follows AWS security best practices. Here's how it assists with a common task:

import boto3
from botocore.exceptions import ClientError
import json

def create_secure_s3_bucket(bucket_name, region='us-east-1'):
    """
    Creates an S3 bucket with security best practices enabled.
    Includes encryption, versioning, and public access blocking.
    """
    s3_client = boto3.client('s3', region_name=region)
    
    try:
        # Create bucket with location constraint
        if region != 'us-east-1':
            s3_client.create_bucket(
                Bucket=bucket_name,
                CreateBucketConfiguration={'LocationConstraint': region}
            )
        else:
            s3_client.create_bucket(Bucket=bucket_name)
        
        # Enable versioning
        s3_client.put_bucket_versioning(
            Bucket=bucket_name,
            VersioningConfiguration={'Status': 'Enabled'}
        )
        
        # Block public access
        s3_client.put_public_access_block(
            Bucket=bucket_name,
            PublicAccessBlockConfiguration={
                'BlockPublicAcls': True,
                'IgnorePublicAcls': True,
                'BlockPublicPolicy': True,
                'RestrictPublicBuckets': True
            }
        )
        
        # Enable server-side encryption
        s3_client.put_bucket_encryption(
            Bucket=bucket_name,
            ServerSideEncryptionConfiguration={
                'Rules': [{
                    'ApplyServerSideEncryptionByDefault': {
                        'SSEAlgorithm': 'AES256'
                    },
                    'BucketKeyEnabled': True
                }]
            }
        )
        
        return f"Secure S3 bucket '{bucket_name}' created successfully in {region}"
        
    except ClientError as e:
        return f"Error creating bucket: {e}"

This example demonstrates CodeWhisperer's strength in AWS development - it doesn't just generate basic API calls, but includes security best practices like encryption, versioning, and public access blocking that are essential for production AWS workloads.

Reference Tracker: Enterprise Compliance Made Simple

Amazon CodeWhisperer includes a sophisticated reference tracking system that addresses a critical concern for enterprise development: ensuring compliance with open-source licensing requirements and avoiding potential legal issues.

How Reference Tracking Works

When CodeWhisperer generates code suggestions, it continuously compares them against its training data to identify potential matches with open-source repositories. When a similarity is detected, the tool:

Enterprise Value

For organizations with strict compliance requirements, this feature provides essential protection against:

• License Violations: Prevents accidental incorporation of GPL-licensed code in proprietary products
• Legal Exposure: Reduces risk of copyright infringement claims
• Audit Requirements: Provides documentation trail for compliance audits
• Attribution Requirements: Ensures proper credit is given to open-source contributors

This transparency around code origins makes CodeWhisperer particularly valuable for enterprise environments where legal compliance is paramount, setting it apart from tools that don't provide visibility into their training data sources.

Integrated Security Scanning: Shift-Left Security

CodeWhisperer's built-in security scanning brings security analysis directly into the IDE, enabling developers to identify and fix vulnerabilities before code is committed. The tool can detect vulnerabilities from the OWASP Top 10 and other security issues across Java, Python, and JavaScript.

Example: Detecting and Fixing Weak Cryptography

Consider a Python function using a weak hashing algorithm - a common security vulnerability:

import hashlib

def hash_password(password):
    """
    Hashes a user's password for storage.
    NOTE: This uses a weak algorithm.
    """
    # Using MD5 is not recommended for password hashing
    password_bytes = password.encode('utf-8')
    hashed_bytes = hashlib.md5(password_bytes)  # ← VULNERABILITY DETECTED
    return hashed_bytes.hexdigest()

# Example usage:
user_password = "mysecretpassword123"
hashed_password = hash_password(user_password)
print(f"Hashed password: {hashed_password}")

CodeWhisperer Detection: The security scanner flags the use of hashlib.md5 and explains that MD5 is cryptographically broken and unsuitable for password hashing due to collision vulnerabilities.

import hashlib
import os

def hash_password_secure(password):
    """
    Hashes a user's password for storage using a secure algorithm (SHA-256) with a salt.
    """
    # Generate a random salt
    salt = os.urandom(32)
    password_bytes = password.encode('utf-8')
    
    # Combine salt and password, then hash
    salted_password = salt + password_bytes
    hashed_bytes = hashlib.sha256(salted_password)  # ← SECURE ALGORITHM
    
    # Store the salt with the hash
    return salt.hex() + ':' + hashed_bytes.hexdigest()

# Example usage:
user_password = "mysecretpassword123"
secure_hash = hash_password_secure(user_password)
print(f"Securely hashed password with salt: {secure_hash}")

Supported Vulnerability Types

CodeWhisperer's security scanning can detect various OWASP Top 10 vulnerabilities including:

• Injection Flaws: SQL injection, command injection, LDAP injection
• Cryptographic Issues: Weak algorithms, hardcoded keys, insufficient randomness
• Security Misconfigurations: Insecure default configurations
• Sensitive Data Exposure: Hardcoded credentials, unencrypted data
• XML External Entities (XXE): Vulnerable XML processing

This integrated approach helps developers learn secure coding practices while fixing vulnerabilities in real-time, creating a more security-aware development culture.

Common Use Cases

• Developers working on AWS projects who need real-time code suggestions and security scans
• Security teams who need to scan their code for vulnerabilities and suggest fixes
• Developers who need to integrate with AWS services and generate code for specific AWS components

Detailed Analysis

Sources

Primary references: blog, docs, release notes, API, and status pages.

Compare Amazon Q Developer (CodeWhisperer) with Other Tools

See how Amazon Q Developer (CodeWhisperer) stacks up against other popular AI coding assistants:

Alternatives to Amazon Q Developer (CodeWhisperer)

Similar tools based on category and feature overlap: