AI Tools for Software Development: The AWS List

Amazon Q Developer is AWS’s primary AI-powered coding assistant that spans most stages of the development lifecycle. It supports developers across code generation, review, testing, documentation, and modernization. Q Developer is a way to operationalize AI within coder workflows, for rapid prototyping through to complex coding tasks.

You can use Amazon Q Developer inside your chosen integrated development environment (IDE), such as Visual Studio Code, JetBrains, VS Code, and Visual Studio. Q Developer provides AI-powered code completion, a conversational AI chat, and contextual real-time code suggestions and code snippets across multiple programming languages in your developers' preferred development environment.

Amazon Q Developer also includes specific workflow commands, such as:

• Review for code quality analysis, Software Composition Analysis (SCA), deployment risk, secrets detection, IaC misconfiguration, and Static Application Security Testing (SAST)
• Test for unit tests at the class or function level across 25+ programming languages
• Doc to create inline documentation and developer references from existing application logic
• Transform to handle automated code refactoring and modernization, including Java 8/11 to Java 17 migrations

Amazon Q Developer also extends to the command line, allowing developers to use natural language prompts to generate shell commands, troubleshoot AWS deployments, and interact with AWS APIs more efficiently.

As Amazon Q Developer is trained extensively on AWS APIs and architecture patterns, it’s a good choice for ISVs already using an AWS-centric stack. Q Developer Pro tier configurations also support VPC connectivity and controls around how the system handles customer prompts and generated code.

Within the SDLC, Amazon Q Developer fits into everyday AI coding workflows, reviewing pull requests, generating tests, writing application logic, and modernizing legacy systems. For reference, AWS also includes the Amazon Q Detector Library for a complete list of review detectors. Detectors contain rules that are used to identify critical security vulnerabilities like OWASP Top 10 and CWE Top 25 issues, including secrets exposure and package dependency vulnerabilities.

Amazon CodeGuru provides runtime profiling. Although Amazon Q Developer also has pre-production developer-facing use cases, CodeGuru is designed more specifically to help with CI/CD pipeline-integrated analysis. It offers two components: CodeGuru Reviewer and CodeGuru Profiler.

The capabilities of CodeGuru Reviewer have mainly been absorbed by Amazon Q Developer’s /review function, so there is no need to implement both, as AWS progresses to the in-IDE capabilities of Q Developer.

CodeGuru Profiler focuses on live production workloads. It mainly identifies CPU-intensive methods, latency bottlenecks, and anomalous memory behavior. CodeGuru Profiler focuses on live validations, letting you analyze the code running under real production conditions.
Typically, you can use CodeGuru Profiler to establish runtime baselines for any long-running services or applications, including those with a microservices architecture.

Amazon DevOps Guru offers machine learning-based operational anomaly detection for AWS environments. Unlike CodeGuru Profiler’s application review, DevOps Guru focuses on the application’s infrastructure behavior after deployment. DevOps Guru is a DevOps pipeline tool for in-situ monitoring.

DevOps Guru ingests operational telemetry from Amazon CloudWatch, AWS CloudTrail, AWS Config, and Amazon X-Ray Traces to identify patterns like latency spikes, resource exhaustion, unusual behavior, and high error rates. It then collects these findings into insights, suggesting probable root causes and effective remediation pathways. Especially for ISVs with rapid release cycles, the increased visibility here can help make sure that architectural complexity doesn’t translate into more problems. It acts as a production monitoring layer, catching infrastructural behaviors that pass testing but may still create operational drift when under real load.

Within the SDLC, DevOps Guru works as a post-deployment monitoring layer that complements development review and testing tools. It works alongside these tools, bringing an extra layer of validation and verification that builds upon earlier solutions.

While AWS CodeBuild isn’t an AI-powered tool, it does serve as an execution layer where outputs from other AI coding assistants become enforceable.In an AI-assisted workflow, CodeBuild:

• Enforces test coverage thresholds generated through Amazon Q Developer /test
• Fails build jobs when /review finds high-severity risks (above your threshold)
• Runs automated integration and regression testing against generated code

Although other tools on this list actually help you generate output, CodeBuild is where you validate and gate those outputs. It provides the CI validation that transforms AI outputs into actual operational parts of your workflow.

For ISVs looking to build AI-driven development pipelines, CodeBuild acts as the bridge between AI-powered development and release governance.

Amazon Bedrock offers access to AI foundation models through APIs, packaged in a fully managed service by AWS. Bedrock lets you access AI models directly, allowing you to scale models without having to build, host, or manage your own infrastructure.Bedrock is useful when building internal AI-powered tools or customer-facing AI features. For example, you can use Amazon Bedrock to:

• Create AI applications or functions without managing model infrastructure
• Build Amazon Bedrock Knowledge Bases for retrieval-augmented generation (RAG) across any internal documentation, architectural standards, or runbooks.
• Implement Amazon Bedrock Guardrails to filter outputs, block topics, or identify PII within both prompts and responses, helping to align with compliance constraints on model I/O.

You can access both on-demand and provisioned throughput pricing models with Bedrock. For ISVs experimenting with internal tooling, on-demand usage may suffice. Provisioned usage is typically for larger deployments that have been carefully assessed and planned.
Under AWS’s Shared Responsibility Model, AWS manages the underlying model infrastructure while customers remain responsible for how they manage their infrastructure, including data classification, access controls, creating prompts, application behavior, and governance policies surrounding model output.

AWS Glue and Amazon SageMaker support ISVs building custom machine learning models or internal generative AI systems with developer tooling that goes beyond prebuilt solutions.

AWS Glue is the data preparation and ETL layer that can process repositories, telemetry, pull requests, operational logs, or test suites into structured datasets. You can use this prepared data for model training or fine-tuning.

Amazon SageMaker then provides the model lifecycle tooling itself across training, development, evaluation, and deployment. You can use SageMaker JumpStart for accessing prebuilt AI models, including code-focused existing models (such as CodeLlama). SageMaker Pipelines allows you to automate ML workflows for ISVs operationalizing custom model training.

This layer of AWS tooling is most relevant for ISVs building highly specialized internal systems, such as custom review engines, organization-specific documentation assistants, or test models trained against proprietary standards.

While Amazon Q Developer or Bedrock will address the majority of development workflows, Glue and SageMaker provide extra flexibility for custom behavior that generalized tooling can’t cover.

Amazon Inspector offers automated vulnerability management across EC2 instances, container images, and AWS Lambda workloads.

As Inspector continuously scans the runtime environment and any deployed artifacts for vulnerabilities, it helps to pinpoint emerging vulnerabilities after deployment.
Within these workflows, Inspector supports:

• Container image scanning through Amazon ECR integrations
• Software composition analysis for Lambda packages
• EC2 package vulnerability management for OS-level package vulnerabilities

ISVs using containerized SaaS architectures on Amazon EKS or ECS (or Lambda-heavy serverless stacks) can use Inspector to add visibility into vulnerabilities that static review tools alone can’t detect. You can use Inspector to create another review layer alongside tools like Amazon Q Developer’s /review and CodeGuru Reviewer. These services operate at different stages of the SDLC, providing visibility into pre-merge and deployed runtime environments.

AWS provides AI tools for software development that cover the full software development lifecycle. Across code generation, review, testing, CI enforcement, operational monitoring for custom model deployment, and runtime vulnerability management, AWS has a tool that can help improve your existing workflows and save you time.

Especially for ISVs currently scaling or modernizing internal workflows, the wide range of AWS AI tools can help across the entire SDLC.

Programs like AWS ISV Accelerate can help ISVs that have mature operational practices, such as those with AI-assisted development tooling, gain more business.

Get started with Amazon Q Developer to start using AI tools for software development on AWS.